Contact UsTry it for free
© 2026 Direct Cursus Technology L.L.C.

Working with query templates

Written by
Updated at April 3, 2026

Note

This feature is in the Preview stage. To get access, contact tech support or your account manager.

You can save frequently used queries as templates and quickly integrate them in investigations.

The following template categories are available:

  • Personal: Templates created by the user and available across investigations.
  • Instance: Templates available to all users, but restricted to a specific investigation.
  • Global: Templates available to all users across all investigations.

Accessing the templates panel

To open the templates panel:

  1. Open an investigation.
  2. Click Query data on the right side of the screen.
  3. Navigate to the Templates tab.

Templates within each category can be organized into folders. Users can create and give names to folders to facilitate navigation and group templates by threat type, event source, investigation phase, or other criteria.

To access a folder:

  1. Open the templates panel.
  2. Select a category.
  3. Select the relevant folder from the list.

Searching for a template

To find a template:

  1. Open the templates panel.
  2. Enter your keywords in the search field.
  3. The results will be displayed automatically.

The system will search for keywords across template names and contents.

Inserting a template into a query

To insert a template into your current query:

  1. Open the templates panel.
  2. Find the required template.
  3. Click the template.
  4. Select Insert into query.

The template text will be added to the query editor.

Creating a new query from a template

To create a new query from a template:

  1. Open the templates panel.
  2. Find the required template.
  3. Click the template.
  4. Select New query from template.

This will create a new tab pre-populated with a query from the selected template.

Saving a query as a template

To save your current query as a template:

  1. Open the query you want to save.
  2. In the actions menu, select Save as template.
  3. Enter a name for the template.
  4. Select a folder to save it to:
    • Personal: For personal use.
    • Instance: For all instance users.
  5. Click Save query as template.

Creating a template folder

To create a folder for templates:

  1. Open the templates panel.
  2. Select either the Personal or Instance category.
  3. Click New folder.
  4. Enter a name for the directory.
  5. Click Create.

Managing templates

Renaming a template

To rename a template:

  1. Open the templates panel.
  2. Find the required template.
  3. Right-click the template.
  4. Select Rename.
  5. Enter a new name.
  6. Click Save.

Deleting a template

To delete a template:

  1. Open the templates panel.
  2. Find the required template.
  3. Right-click the template.
  4. Select Delete.
  5. Confirm the deletion.

Note

Deletion is restricted to the Personal and Instance categories. You cannot delete any shared templates.

See also

Previous
Managing queries
Next
Working with a database schema and datasets