Skip to main content

Advanced Search

Advanced Search is a rule-based query builder available on Devices, Users, Vulnerabilities, and Software, for filtering beyond what the basic search box and facet rail can express, including rules that reference a different asset type than the page you’re on.

What it can do that basic search can’t

  • Cross-asset-type rules: for example, on Devices, add a rule for “Vulnerability severity equals Critical” to filter devices down to ones with a matching finding, even though severity isn’t a device field at all.

  • Multiple conditions combined with AND/OR: build a rule list like “OS platform is Windows AND no EDR source reported.”

  • Filtering by a specific source’s own reported value, not just the resolved consensus value, useful when you want to check what one particular connector said, independent of what other sources agree or disagree with.

  • Tags: on Devices and Users, filter by the tags applied to a record (see Tags).

Using it

  1. Open any list page with the query builder available (look for the “Advanced Search” panel above the table).
  2. Add a rule: pick an asset type, a field, an operator, and a value.
  3. Add more rules and choose AND/OR to combine them.
  4. Click Run Query to apply the filter.

Dates that keep sliding

On a date field (for example Last activity), choose After or Before, then click one of the buttons under the value box (Today, 7 days ago, 30 days ago, and so on). The rule becomes a rolling date, shown as “7 days ago (rolling)”. Each time the query runs, Navigator counts back from that moment, so a saved query for “active in the last 7 days” always means the last 7 days, not the 7 days before the day you saved it. This applies everywhere a saved query is used: the list pages, exports, and scheduled actions.

To pin a rolling date to a specific day instead, click Use a fixed date, or type a date into the value box yourself. Days are counted in UTC.

Saving a query

Once you’ve built a query you’ll want again, save it by name. Saved queries can be kept private to you or shared with the rest of your organization. A saved query is re-validated against the current set of available fields every time it’s loaded, so if a field it depends on is ever renamed or removed, you’ll get a clear error instead of a silently wrong filter.

Saved queries are listed on the Saved Queries page, where you can export them or attach actions such as a scheduled email report.

Next → Saved Queries