Bookmark filter queries
Use the Bookmarking feature in Xprotect to save complex filter queries, especially those you run periodically. Booking a filter query is similar to saving URLs as Bookmarks on Web browsers. In this case, the filter query is saved as a 'Saved Query'. When you want to rerun the same query, you load the Saved Query.
In Xprotect, the two types of Bookmarks/Saved Queries you can save are:
Public - these queries are available for all the users who log into the tenant.
Private - these queries are available only for the user who created the Bookmark.
You can make a Public query Private or vice-versa by editing a Saved Query.
Save a query as a Bookmark/Saved Query
|
Load Saved Queries
If you load a Saved query on an irrelevant page (for example, a Host query on an Alerts page), the query loads, but the page is not filtered, and you will not see any results.
Go to the page that is relevant to the query.
Click the Saved Queries icon.
Click Load (next to the query you want to run).
Complex queries may take a few seconds to load and filter the page.
Modify saved queries
Modify saved queries when you want to make a Private query Public or vice-versa or when you want to change the operators in the query.
|
Next steps
Load saved queries or construct new queries to filter data in Xprotect. See Filter data in Xprotect for more details.