Create an advanced query
The advanced query feature allows you to build custom queries to enhance your threat hunting activities. Advanced query offers deep visibility into your
CylanceOPTICSenvironment, expansive query options, and optimized workflows that allow you to combine related searches to reveal new insights. Advanced query is supported for devices with the
CylanceOPTICSagent version 3.0 or later.
Advanced query is available only to customers who have requested and obtained
CylanceOPTICSversion 3.0 or later from
Advanced query relies on the use of EQL syntax. You use EQL to construct queries for events, and the results provide information about the artifacts that were involved in those events. The advanced query UI includes syntax information to help you build EQL queries.
- In the management console, on the menu bar, clickCylanceOPTICS > Advanced Query.
- Do one of the following:TaskStepsCreate a new advanced queryIf you want to use an existing query template to create a new query, clickShow Template Listand click a template, then skip the first step below.
If you want to save query results to view them later from theQuery Snapshotstab, in the results section, click .View a query snapshot
- ClickAdd New Query.
- In the query field, type or paste the EQL syntax for the query.If you want to save the current query as a template, clickSave As Template. Type a name and description and select whether you want the template to be private or available to all administrators. ClickSave. You can pin, edit, and delete queries from the templates list.
- To set the scope of the query, underSearch devices, clickBy ZoneorBy Device. Select one or more zones or devices, then clickSave. If you don't set the scope, the query applies to all zones and devices.
- To set a date and time range for the query, click and configure the range. ClickApply. If you don't set a range, the query applies to all available data.
- Do one of the following:
- If you want to run the query, clickSearch.
- If you want to schedule the query to run at a specific date and time or on a regular interval, clickSchedule Query. Type a name and description, select whether you want the query to be private or visible to all users, and set the date, time, and optional recurrence settings. ClickSchedule Query. You can view and edit scheduled queries, and view and export the results, on theScheduled Queriestab.
- On theQuery Snapshotstab, click a query.
- ClickSearch. Note that this displays the original results of the query when it was saved and is not a new query.
- In the query results, expand the menu to view the available actions for each result. Depending on the type of result, this can include:
- Globally quarantine a file. The file appears inSettings > Global List > Global Quarantine, inProtection > Threats, and in theThreatssection of the device details.
- Request and download a file. If path information is available for files associated with other artifact types, you can also download those files. The file is compressed and password-protected to ensure that it is not accidentally executed. The password is “infected".The size limit for file retrieval is 50 MB. Artifacts and files are retained byCylanceOPTICSfor 30 days (this period can be increased based on your organization's licensing).
If you want to export the query results to a .csv file, click . Type a name and description, specify whether you want the exported results to be private (visible only to you) or public (visible to all administrators), and click
Export. You can download the file from the
Exported Resultstab when it is ready.