Queries

A query is an ArcSight resource that defines the parameters of the data you want to report on derived from an ArcSight data source. The result of the query then becomes the basis for one or more ArcSight report and trend. The Query Editor is a component of ArcSight Reporting resource tools.

Queries are used in:

• Reports. See Building Reports for more information.

• Query viewers. Additionally, if you want to run quick SQL queries for monitoring and analysis outside of the reporting resource, you can use query viewers. You can add query viewers to dashboards and generate simple reports on query viewer results. For information on query viewers, see Query Viewers.

• Trends. See Building Trends.