Creating a New Query

To create and run a query, navigate to Live Queries and click New Query

1. Type the Query Name and click Next.

   

2. Select Artifacts, choose any Collect Artifacts or all at once if it is required.

3. Check the search artifacts box as required. The following are the search artifacts available to choose.

• Search Files - select the Name or Hash and type the Name or Hash

  Indicator for "File by name" query: "filename.exe" or "C:\Path\to\file\" or "C:\Path\to\file\filename.exe".

• Search Processes - select the All or Name or Hash and type the Name or Hash.

• Search Named objects - Type the Named objects.

• Search Registry - Type the Register Key, Register Name, and Register Value.

  

• Click Next.

4. Choose the targets Target Scope or Endpoint.

   Check your Account > Tenant > group box as the target scope.

   

   or

   Check the Endpoint box.

   

5. On the Summary, verify your query name, collect artifacts and the Accounts, tenant and groups or endpoints. Click Finish to create a query.

   

6. Click Cancel to cancel the live query at any stage and click Confirm button.