Saved Search Queries

Overview

When searching and browsing your data by object type on the Search screen, you can save basic and advanced search queries that you create. Saving a query allows you to run the query and view its results at a later time, visualize the query’s results in a Query card added to a custom dashboard, and use the query to create associations between the query's results and an Intelligence Requirement or a Group.

Before You Start

User Roles

• To save, view, edit, delete, and run saved queries when using the Groups, Indicators, Intelligence Requirements, Tags, Victim Assets, or Victims object filters on the Search screen, your user account can have any Organization role.

Saving Queries

Follow these steps to save a basic or advanced search query on the Search screen:

1. From the Search & Create dropdown on the top navigation bar, select an object type (Groups, Indicators, Intelligence Requirements, Tags, Victim Assets, or Victims).
2. Create a basic search query, or turn on the Advanced Search toggle and create an advanced search query.
3. Click Save Query in the upper right.
4. On the New Query window, enter a name for the query, and then click Save.
   
   Note

   If the search query you are saving matches one you previously saved, you will not be able to save it. This is because you cannot save duplicate queries.

Viewing Saved Queries

Follow these steps to view your saved queries on the Search screen:

1. From the Search & Create dropdown on the top navigation bar, select an object type (Groups, Indicators, Intelligence Requirements, Tags, Victim Assets, or Victims).
2. From the Options ⋯ menu in the upper-right corner, select View Saved Queries to open the Saved Queries drawer and view each saved query’s name and type.
3. On the Saved Queries drawer, click a saved query’s table row to display the query in ThreatConnect Query Language (TQL).

Editing Saved Queries

Follow these steps to edit a saved query on the Search screen:

1. From the Search & Create dropdown on the top navigation bar, select an object type (Groups, Indicators, Intelligence Requirements, Tags, Victim Assets, or Victims).
2. From the Options ⋯ menu in the upper-right corner, select View Saved Queries.
3. On the Saved Queries drawer, click Editin a saved query’s table row.
4. On the Edit Query window, edit the saved query by doing the following:
   1. Update the saved query’s name or the query itself.
   2. Click Validate Query to confirm that the query is valid.
   3. Click Save Changes.

Deleting Saved Queries

Follow these steps to delete a saved query on the Search screen:

1. From the Search & Create dropdown on the top navigation bar, select an object type (Groups, Indicators, Intelligence Requirements, Tags, Victim Assets, or Victims).
2. From the Options ⋯ menu in the upper-right corner, select View Saved Queries.
3. Click Deletein a saved query’s table row.
4. On the Delete window, click Delete to confirm the deletion.

Running Searches Using Saved Queries

When using the basic or advanced search features on the Search screen, you can run a search using a saved query. Follow these steps to use a saved query to search your data on the Search screen:

1. From the Search & Create dropdown on the top navigation bar, select an object type (Groups, Indicators, Intelligence Requirements, Tags, Victim Assets, or Victims).
2. From the Select Saved Query… dropdown in the upper right, select a saved query to run.

After you select a saved query, the Advanced Search toggle turns on and a search using the selected query runs automatically. Also, the saved query’s name displays in the Select Saved Query… dropdown.

ThreatConnect^® is a registered trademark of ThreatConnect, Inc.

20075-14 v.01.A