Create and Edit Queries

Live Endpoint Search is only available for devices with the Sophos Endpoint Agent.

You can edit a predefined Live Endpoint Search query or create your own query.

Live Endpoint Search queries use osquery and Structured Query Language (SQL). You must be familiar with osquery or SQL to create or edit a query. For help with osquery, see Osquery Schema.

You can use the Sophos Community to share queries or fine-tune existing ones. See Live Endpoint Search Query Forum.

Click a tab below for guidance on creating or editing queries.

Create QueryEdit Query

To create a query, do as follows:

1. From the Taegis Menu, go to Advanced Search > Live Endpoint Search.

2. Click Create Query.

   

   Create Query

3. In the SQL section, enter the query. For details about the available tables and data, see Osquery Schema.

4. You can add variables to the query. To add a variable, do as follows:

   1. In the Variables section, enter a variable name and a descriptive name.

      Note

      You can't include spaces or dollar signs in the variable.

   2. Specify the variable type and the value that you want to use when the query runs.

   3. (Optional) Click + Add variable for each additional variable you want to define.

   4. In the SQL section, enter the SQL variable, including the dollar symbols, where you want to use the variable.

      Example

      If you enter filepath for the variable name, enter $$filepath$$ in the SQL query:

      SELECT * FROM processes
      WHERE filepath = $$filepath$$
      

      

      SQL Editor with Query Variable

5. In the Endpoint Selection section, select the devices to query.

   

   Endpoint Selection

   Tip

   Click Run Query to test the output before saving.

6. Click Save Query.

7. Enter a Name and Description, and select a Query Category and Supported OS.
8. (Optional) Click Bookmark Query to add the query to your bookmarked queries.

9. Click Save Query.

   

   Save Query

To edit an existing query, do as follows:

1. From the Taegis Menu, go to Advanced Search > Live Endpoint Search.

2. Use the Categories on the left to see queries by their category and then refine the results with the filters and search bar above the table.

   

   Network Category Filter

3. Click the query you want to edit.

4. Click Edit Query to make the SQL query box editable.

   

   Edit Query

5. In the SQL box, enter the changes that you want to make to the existing query. For details about the available tables and data, see Osquery Schema.

6. You can add variables to the query. To add a variable, do as follows:

   1. In the Variables section, enter a variable name and a descriptive name.

      Note

      You can't include spaces or dollar signs in the variable.

   2. Specify the variable type and the value that you want to use when the query runs.

   3. (Optional) Click + Add variable for each additional variable you want to define.

   4. In the SQL section, enter the SQL variable name, including the dollar symbols, where you want to use the variable.

      Example

      If you enter filepath for the variable name, enter $$filepath$$ in the SQL query:

      SELECT * FROM processes
      WHERE filepath = $$filepath$$
      

      

      SQL Editor with Query Variable

7. In the Endpoint Selection section, select the devices to query.

   

   Endpoint Selection

   Tip

   Click Run Query to test the output before saving.

8. Click Save Query.

9. Enter a Name and Description, and select a Query Category and Supported OS.

10. (Optional) Click Bookmark Query to add the query to your bookmarked queries.

    

    Save Query

11. Click Save Query.