Filter Data with Advanced Query Builder

Key Components

The builder uses a modular interface consisting of three primary segments within each condition:

1. Attribute. The metadata field you are filtering (for example, Classification, User, Service)
2. Operator. The logic applied to the attribute (for example, IS, IS NOT, IS ONE OF, IS ANY OF, IS NONE OF)
3. Value. The specific data point you want to match
   
   

Logical Operators and Grouping

• AND. Search results must satisfy all conditions linked by this operator.
• OR. Search results must satisfy at least one of the conditions linked by this operator.
• Parentheses (Groups). Used to nest conditions. Grouping defines the order of operations, ensuring that complex logic (such as an OR statement within an AND sequence) is processed correctly.
  
  

Points to Remember

• Logical Precedence. Queries are processed linearly from left to right. To ensure a specific logic sequence is prioritized—such as an OR statement within a larger AND string—you must use Parentheses (Groups) to define the order of operations.
• Case Sensitivity. While attribute values (such as User or File Name) are generally case-insensitive, it is recommended to match the exact formatting used by your integrated Cloud Service Provider (CSP).
• Session Persistence. Advanced queries are session-based. If you refresh your browser or navigate away from the Data Explorer page, the query builder will reset to its default state.

Steps to Create an Advanced Query

This section provides a step-by-step procedure to build a multi-condition search in the Advanced Query Builder.

To create an advanced query:

1. Log in to Skyhigh SSE and go to Analytics > DSPM Data Explorer.
2. Next to the attribute filters, click Advanced.
   
   
   
   The interface expands to display the query builder.
3. (Optional) To return to the filter-based search, click Basic.

4. Define a Primary Condition:

   1. Click the Attribute segment and select an attribute from the drop-down.
      
      

   2. Click the Operator segment to select the preferred operator (for example, IS, IS NOT).
      
      

   3. Click the Value segment and select the value to match.

5. Add Sequential Logic (AND/OR):

   1. To add another filter, click the AND or OR button that appears to the right of your completed condition.
      
      

   2. Define the new condition by selecting its attribute, operator, and value segments.
      
      

6. Apply Nested Groups (Optional):

   1. To group multiple conditions, click the open parenthesis "(" icon to start a nested condition.
   2. Add the conditions you prefer to group within the parentheses.
   3. Click the close parenthesis ")" icon to complete the condition.

      Example: User IS [Name] AND ( Service IS Box OR Service IS Endpoint Protector )

7. Click Search.
   The Data Explorer refreshes to display only the objects that meet your criteria.
   
   

8. (Optional) Manage the Query:

   • Modify. Click any segment within an existing condition to update its selection.
   • Remove a Condition. Click the X icon within a specific condition block to delete it. 

Use Case 1: Data Discovery with OR Logic

Goal: Identify files that are classified as either Internal or Public.

Query: Classification IS Internal OR Classification IS Public

This use case utilizes the OR logical operator, ensuring that search results satisfy at least one of the conditions linked by the operator.

To create the query in the Advanced Query Builder:

1. Set the primary condition: Attribute (Classification), Operator (IS), and Value (Internal).
2. Select the OR logical operator to link the next condition.
3. Set the second condition: Attribute (Classification), Operator (IS), and Value (Public).

The resulting search displays all objects that possess either classification, facilitating comprehensive monitoring or reporting on files falling into these two categories.

Use Case 2: Data Discovery with Nested Groups

Goal: Find high-severity incidents triggered by a specific user, but only if those incidents occurred on Box or Slack.

Query: Severity IS High AND User IS [Name] AND ( Service IS Box OR Service IS Slack )

This use case utilizes Parentheses (Groups) and the AND/OR operators, which are fundamental for isolating specific logic within a broader search. Grouping defines the order of operations, ensuring that complex logic is processed correctly.

To create the query in the Advanced Query Builder:

1. Set the primary condition: Attribute (Severity), Operator (IS), and Value (High).
2. Select the AND logical operator to link the next condition.
3. Set the second condition: Attribute (User), Operator (IS), and Value ([Name]).
4. Select the AND logical operator, and then click the open parenthesis "(" icon to start the nested group.
5. Define the first condition within the group: Attribute (Service), Operator (IS), and Value (Box).
6. Select the OR logical operator to link the final condition inside the group.
7. Set the final condition: Attribute (Service), Operator (IS), and Value (Slack). And click the close parenthesis ")" icon to complete the nested group.

The resulting search first filters for the user's high-severity incidents, then narrows the list to only those involving the specified services, facilitating targeted risk investigation.