Saved Queries and Historical Queries
The Locate page includes fields for re-using queries:
Saved Location. Leads to a list of saved queries. Saved queries are associated with your login. You can view saved queries you create and those shared with you by other users.
Historical Location. Leads to a list of cached queries. Query history is not associated with your login but instead includes all queries from all Lucidum users on the current Lucidum system. Query history is deleted when the Lucidum system is rebooted or restarted.
This chapter describes how to create, use, and manage saved locations (queries) and historical locations (queries).
Creating a Saved Location
From the Locate button, you can save a query for use in a chart, a Dynamic Field, or an Action. To do this:
Follow the steps to Create a query.
In the Locate a Current page, click the Save Location (disc).
The Save Location dialog page appears:
In the Save Location dialog page, supply values in the fields:
Location Name. The name of the saved query.
Description. Optional description of the query.
Group. Optional group to organized saved queries.
The saved query now appears in the list of Saved Queries in the Locate page and in the Query Library page (Settings > Query Library).
Using a Saved Location
You can use a Saved Location from the Locate page.
From the Locate button, you can load a saved query for use in a chart, an action, or a Dynamic Field:
Click the Locate button in the upper right corner of each page in Lucidum.
The Locate page appears.
In the Locate page, click Load from Saved Location.
The Choose a Save Location page appears, with a list of all saved queries.
To choose and load a query, select the Edit Saved Query (up arrow) icon.
The query appears in the Locate a Current page. From this page, you can edit the saved query or apply it to a chart or action.
To apply the saved query to a chart or action, click the Apply (pencil and paper) icon.
Managing Saved Locations
You can manage saved queries in the Query Library page (Settings > Query Library). From the Query Library page, you can:
edit the properties of the saved query
edit the filter for the saved query
use the saved query to build an action
delete the saved query
export a saved query
import a saved query
To access the Query Library page:
Go to Settings > Query Library.
The Query Library page displays all the saved queries in Lucidum:
The Query Library page displays the following about each saved query:
Query Name. Name of the query.
Description. Description of the query.
Group. Category for the query. This is defined when the saved query is created and helps keep the queries organized.
You can perform the following actions on each saved query:
Edit Properties for Saved Query (pencil icon). Leads to the Edit Saved Location modal, where you can edit the name, description, and group for a saved query.
Edit Filter for Save Query (up-arrow icon). Leads to the Edit Filters for Saved Query, where you can edit the filter for the query.
Send Save Query to Action Center (paper airplane icon). Leads to the Actions page, where you can create an action with the saved query loaded in the action definition.
Delete a Saved Query (trash-can icon). Allows you to delete a saved query.
To export a query from the Query Library page, select Export. The query is saved as a JSON file to the local computer.
To import a query into the Query Library page, click the checkbox for the query, select Import and navigate to a saved JSON file.
To share a saved query with another Lucidum user, click the checkbox for the query and then select Share (email icon). The query will appear in the Query Library page for that user.
Historical Query
If you would like to re-run a query that you ran earlier but did not save as a Saved Location (query), you can use the Historical Location (query). Historical Locations are not associated with your login but instead includes all queries from all Lucidum users on the current Lucidum system. Historical Locations are deleted when the Lucidum system is rebooted or restarted.
To load a historical location for use in a chart, a Dynamic Field, or other parts of Lucidum:
From the Locate button, you can load a historical query for use in a chart, an action, or a Dynamic Field:
Click the Locate button in the upper right corner of each page in Lucidum.
The Locate page appears.
In the Locate page, click Load from Historical Location.
The Choose a Historical Location page appears, with a list of all historical queries.
To choose and load a query, select the Edit Historical Query (up arrow) icon.
The query appears in the Locate a Current page. From this page, you can edit the saved query or apply it to a chart or action.
To apply the historical query to a chart or action, click the Apply (pencil and paper) icon.
Managing Historical Queries
You can manage previously run queries in the Query Run History page (Settings > Query Run History). From the Query Run History page, you can:
view the filter for the query
convert the query to a saved location
delete the query
To access the Query Run History page:
Go to Settings > Query Library.
The Query Run History page displays all the previously run queries in Lucidum:
The Query Run History page displays the following about each saved query:
Down arrow icon (v). Displays the query.
Table Name. Table associated with the query. Choices are:
Asset. Retrieve information about assets.
User. Retrieve information about users.
Vulnerability. Retrieve information about vulnerabilities.
Query Time. Date and time the query was last run.
Result Count. Number of records that match the query on its last run.
You can perform the following actions on each previously run query:
Convert to Saved Query (disc icon). Leads to the Add Saved Location modal, where you can define a saved query.
Delete a Historical Query (trash-can icon). Allows you to delete a saved query.