Manage scheduled queries

Manage scheduled and recurring XQL queries in Cortex XSIAM.

The Scheduled Queries page displays information about your scheduled and recurring queries. From this page, you can edit scheduled query parameters, view previous executions, disable, and remove scheduled queries. Right-click a query to see the available options.

View executed queries

1. Select Investigation & Response → Search → Scheduled Queries.
2. Locate the scheduled query for which you want to view previous executions.

   If necessary, use the Filter to reduce the number of queries returned.
3. Right-click anywhere in the query row, and select Show executed queries.

   Cortex XSIAM filters the queries on the Query Center.

Edit the query frequency

1. Select Investigation & Response → Search → Scheduled Queries.
2. Locate the scheduled query that you want to edit.

   If necessary, use the Filter to reduce the number of queries returned.
3. Right-click anywhere in the query row and then select Edit.
4. Adjust the schedule settings, and then click OK.