Catalog
The Orbital Catalog provides a set of predefined queries and scripts. They can be used to investigate possible security breaches and mitigate incidents found.
The Catalog contains stock and custom queries and scripts:
-
Stock - Queries and scripts created by the Orbital team and Cisco Talos.
-
Custom - Your custom queries and scripts.
Custom queries and scripts are not automatically saved to the catalog. For more details on saving queries and scripts, refer to Using Queries and Using Scripts topics.
System Snapshot
The Orbital Catalog includes three stock System Snapshot entries, one for each supported operating system (Windows, macOS, and Linux). These entries capture the system state by running a set of predefined queries on the targeted endpoint.
When you select Take System Snapshot in the Cisco Secure Endpoint console, the appropriate catalog entry is triggered automatically. The endpoint executes the queries and sends the results back to the Secure Endpoint console.
You can also run a System Snapshot query directly from the Orbital interface. In this case, results appear in the Orbital Results page and are visible only to the Orbital organization that initiated them. Results from queries run directly in Orbital are not sent to Secure Endpoint.