Using Macros (Classic UI)

A macro is a reusable, modular piece of an AQL search query that you can insert into other searches. It is designed to help you avoid manually constructing lengthy strings of parameters for complex search queries. You can use pre-built, out-of-the-box ThreatStream macros or create custom macros tailored to your organization's needs. Custom macros created within your organization can be reused in Search, edited, cloned, and deleted.

Key Benefits of Macros

Macros provide the following search benefits:

• Simplicity

  You can significantly reduce the complexity of search queries by using macros.

• Maintainability

  You can automatically update all search queries that include macros by configuring only macro definitions (custom macros only).

• Consistency

  You can reduce the amount of search errors due to the same logic used in macros across various queries.

For details on creating custom macros, refer to Creating a Macro (Classic UI).

For details on accessing your organization macros, refer to Viewing Custom Macros (Classic UI).

For details on managing custom macros, refer to Managing Custom Macros (Classic UI).

For details on using macros in Search, refer to Using Custom Macros in Search (Classic UI).

For details on using out-of-the-box macros in Search, refer to Using ThreatStream Macros in Search (Classic UI).