Managing Saved Searches

Caution: Saved Searches in Security Analytics are deprecated. Please see Saved Searches from AQL Search for more information.

You can use the Manage > Saved Search page to review the Saved Searches created by you, other users, and administrators.

About Saved Searches

  • The Created By column denotes the owner of the saved search.

  • The Modified By column denotes the user who modified the saved search. This is either the owner of the saved search or the administrator.

  • Administrators are ThreatStream org administrators. Administrators can create, modify, and delete all user-defined saved searches. Non-administrators can modify and delete only the saved searches that they own.

Issue a Saved Search

You can issue a saved search that you created, as well as saved searches created by others.

To run a saved search:

  1. Navigate to Manage > Saved Search.

  2. Click the saved search name.

    Search results are shown on the Activity page.

Modify a Saved Search

You can modify the Saved Search configurations that you created but not configurations created by others.

To modify a saved search:

  1. Navigate to Manage > Saved Search.

  2. Click the saved search name to issue the search on the Activity Search page.

  3. Make your modifications.

  4. Save the configuration.

Note: The edits you make to the saved search will impact alerts that reference it.

Delete a Saved Search Configuration

In the Action column, click the Delete icon to delete a search configuration.

Create an Alert Based on a Saved Search

In the Action column, click the Alert icon to start the create alert workflow for an alert based on this saved search configuration. See Using Alerts for complete details on configuring alerts.