Queries can be run on the fly as live queries. They can also be saved as scheduled queries to be run on a regular, predetermined basis with the results sent to an application or a specified data store.
The Results page provides information about one or more query’s results in your Organization; you can also view information about live queries from within the page displayed in the figure below.
Note: Query result rows are kept for 48 hours. Assign a remote data store to store results older than 48 hours.
The Results page displays a list of all the scheduled queries for your organization, with a toggle to change the view to live queries. The page provides a high-level summary of the current status, endpoints returned, number of results, the name of the catalog query used, if any, and more. You can also access the details of each query’s results directly from this page. You can also download the results' tables in a
- Show Live Queries - This toggleswitch will switch the page view to include or exclude live queries in the list of scheduled queries.
- Download JSON - Click the Download JSON icon to download the Results page table as a JSON file.
- Refreshed - The last refreshed date and time are displayed. Click the Refresh button to refresh the page view.
Results Page Fields
- Name - Click on the Name link to open the individual Results page, described below. Click the vertical dots to open the dropdown menu. Options include: Link Query, Rename, Copy Link, Copy Query ID, Duplicate, Stop. If the query has expired or is a live query, the Stop option will be unavailable.
- Status - Current status of the queries. A percentage gauge is added for active queries, showing how much has been completed.
- Created - Date and time the query was created.
- Endpoints - Shows the endpoint count in the query’s results out of the total possible endpoints.
- Interval - The timeframe of the query’s schedule.
- Results - How many records are in the results.
- Result Rows - The number of rows in the query’s results.
- Type - The query catalog’s category.
- Catalog - The specific catalog used by the query. Click the link to view the query information.
- Creator - The user who scheduled the query.
- Remote Data Store - The name of the destination data store for the query’s results. (These are managed in Settings -> Remote Data Stores.)
- Errors - The number of errors returned to the query.
Scheduled Query Run Time Display
While a scheduled query is running, the Status column of the Results page will display a progress indicator, as shown in the figure below.
This indicator shows that the query is still running and is actively returning results. On the right side of this status display is the Time Remaining display, shown in the figure below.
This display shows the time remaining before the query finishes. The format it takes is:
- dd = number of days remaining in the query’s run.
- hh = number of hours remaining in the query’s run.
- mm = number of minutes remaining in the query’s run.
- ss = number of seconds remaining in the query’s run.
Viewing Query Result Details
To view the detailed query results, click the query’s Name link, shown in the figure below.
This will display the query’s Results Details page, as shown in the figure below.
Query Results Detail Controls
Results - Click Results to return to the Results overview page. The name of the query is displayed in the upper-left corner. Click the vertical dots to open the dropdown menu. Options include: Copy Link, Copy ID, Duplicate, and Stop.
Latest results - Use this dropdown, shown below, to filter the displayed results:
Latest results - Displays the last result received from each endpoint.
Custom - Choose this option to open fields for entering the From and To time input fields.
Show empty rows - This toggle will allow you to include or exclude rows that have not returned queried information, for whatever reason, to the query results. The default setting for this toggleswitch is off.
Refreshed - Click Refreshed to display any new results that were collected from endpoints that were non-responsive during the query’s previous run. Any changes are displayed immediately, assuming the data is still available.
Download [File Type] - Click the Download [File Type] icon to download the host information as a JSON or CSV file, depending on your download format setting preference.
This function behaves similarly to the Download all as [Format Type] function in on the Query page. Refer to Download all as [Format Type] for using the Download all as [Format Type] function.
Also, refer to Setting the Download File Type for instructions on setting the download file type.
The main area is similar to the live query view. The list of hosts is located in the left column, and the details are listed in the results panel on the right. Each page will show up to 25 host results. If there are more, pagination is available at the bottom of the page.
Depending on the type of query, the details will include Pivot Menus. Pivot menus are available in the results next to observable types in catalog queries or in custom queries if the column name exactly matches an observable type. Click the pivot menu to access the icons to Copy or Add the value to a new case (in a casebook). The pivot menu contents depend on your Cisco Security product integrations as well as the specific type of data. The menu options may include Investigate in Threat Response, Create Judgement, Search in Secure Endpoint, Submit to Secure Malware Analytics, and more.
IMPORTANT: Remember that results is only retained in Orbital for 48 hours. If the results are expired past that point, you can’t use these fields to select a different time to make the results visible again. This is why the data is sent to a data store, so it is available past the expiration date.
If you need to see results that are expired, you will need to duplicate the scheduled query with a new name, or recreate the query and save it.
Return to Table of Contents