Manage scheduled queries

Learn how to manage your scheduled and recurring queries.

The Scheduled Queries page displays information about your scheduled and recurring queries. From this page, you can edit scheduled query parameters, view previous executions, disable, and remove scheduled queries. Right-click a query to see the available options.

View executed queries

1. Select Investigation & Response → Search → Scheduled Queries.
2. Locate the scheduled query for which you want to view previous executions.

   If necessary, use the Filter to reduce the number of queries returned.
3. Right-click anywhere in the query row, and select Show executed queries.

   Cortex Cloud filters the queries on the Query Center.

Edit the query frequency

1. Select Investigation & Response → Search → Scheduled Queries.
2. Locate the scheduled query that you want to edit.

   If necessary, use the Filter to reduce the number of queries returned.
3. Right-click anywhere in the query row and then select Edit.
4. Adjust the schedule settings, and then click OK.

Scheduled Queries reference information

The table below lists the common fields in the Scheduled Queries page.

Note

Certain fields are exposed and hidden by default. An asterisk (*) is beside every field that is exposed by default.

Scheduled Queries table

Field	Description
BQL	Whether the query was created by the native search. Native search has been deprecated, this field allows you to view data for queries performed before deprecation.
ISSUED BY	User who ran or scheduled the query.
NEXT EXECUTION	For queries that are scheduled to run at a specific frequency, this displays the next execution time. For queries that were scheduled to run at a specific time and date, this field will show None.
PUBLIC API	Whether the source executing the query was an XQL query API.
QUERY DESCRIPTION	Query parameters used to run the query.
QUERY ID	Unique identifier of the query.
QUERY NAME	For saved queries, the Query Name identifies the query specified by the administrator. For scheduled queries, the Query Name identifies the auto-generated name of the parent query. Scheduled queries also display an icon to the left of the name to indicate that the query is recurring.
QUERY SYNTAX	The exact syntax used to write the query.
SCHEDULE TIME	Frequency or time at which the query was scheduled to run.
XQL	Whether the query was created by XQL search.