Query Builder

Insights → Query Builder lets you construct, execute, and save graph queries against your security data using a visual interface. It is designed for security analysts who need to answer complex questions about relationships between assets, vulnerabilities, ports, cloud resources, and Active Directory objects.

Open Query Builder

1. Go to Insights → Query Builder.

A ?state= link opens this tab directly.

Layout

The Query Builder has two main areas:

• Sidebar (left) — A searchable folder tree containing saved queries organized into seven categories:

  • Custom Queries — Your own saved queries
  • Common Queries — Frequently used queries for common security scenarios
  • Concerning Exposures — Queries for identifying worrisome exposure patterns
  • Critical Advisories — Pre-built queries for critical CVEs and security vulnerabilities
  • AD Attack Paths — Active Directory privilege escalation and attack path queries
  • Cloud Attack Paths — Cloud infrastructure and service attack path queries
  • ATO Attack Paths — Account takeover and identity-based attack path queries

• Editor (right) — A full-width area where you build and configure queries using filter rows, field selectors, operator dropdowns, and value inputs. The editor occupies the complete width of the viewport, giving each control sufficient space to render without truncation.

Run a query

1. Pick an entity type (assets, risks, and so on).
2. Add filters. Group-by and aggregations are available where the editor shows them.
3. Run the query. Paginated results and live row counts appear in the table.
4. Export from the table or Exports in the top bar.

Execute the current query by clicking Run or pressing Cmd+Enter (macOS) / Ctrl+Enter (Windows/Linux).

Results open in an overlay that covers the editor area and spans the full viewport width. The overlay is non-modal — the Saved Queries sidebar remains accessible while results are displayed, so you can load a different query without dismissing the overlay first. To return to editing the current query, dismiss the overlay; your query configuration is preserved exactly as you left it.

Result Table Behavior

Horizontal Scrolling

The results table scrolls horizontally when the number of columns exceeds the available viewport width. All columns are reachable by scrolling — no columns are hidden or silently truncated. This behavior matches the main Assets table elsewhere in Guard.

Consistent Column Widths

All result columns resolve their widths through a central registry, so column sizing is consistent regardless of which fields your query returns. Columns no longer appear unevenly sized due to missing width definitions.

Vendor Column

The Vendor column shows only the vendor name. The product subtitle that previously duplicated the content of the adjacent Technology column has been removed.

Result Columns and Filtered Fields

Every filterable field in the Query Builder has a corresponding result column. When your query filters on a field, that column is automatically shown in the results table — you do not need to manually add it.

For example, if your query filters on asset origins, an Origins column appears in the results by default. This applies across all Query Builder entities (Assets, Risks, Ports, AD Objects, AWS Resources). Each entity also maintains a minimum set of columns that are always present, with filtered-field columns added on top.

This means the results table always reflects what you queried: the attribute you filtered on is visible without extra configuration.

How It Works

1. Select a saved query from the sidebar, or create a new one with the New Query button.
2. Build your query visually — Add entity nodes (Assets, Risks, Ports, AD Objects, AWS Resources), connect them with relationship edges, and set filters on each node to narrow your results.
3. Execute the query — Click Run or press Cmd/Ctrl+Enter.
4. View results in the full-width overlay. Any field you filtered on appears as a column automatically, alongside the entity's default columns. Scroll horizontally to reach columns that extend beyond the viewport.
5. Dismiss the overlay to return to the editor and refine your query.

Common Queries

The Common Queries folder in the sidebar contains pre-built queries for the most frequently needed security scenarios. Select any entry to load it into the editor immediately — no manual configuration required.

Demonstrated Critical, High & Medium Risks

The Demonstrated Critical, High & Medium Risks query surfaces all open risks that have been demonstrated at Critical, High, or Medium severity in a single view, ordered by priority descending (Critical first). Use this query as a starting point for daily triage to ensure the most actionable findings are visible without additional filtering.

To run it:

1. Open Insights → Query Builder.
2. In the sidebar, expand Common Queries.
3. Select Demonstrated Critical, High & Medium Risks.
4. Click Run (or press Cmd/Ctrl+Enter) to execute.

Results are sorted most-critical-first and can be further refined using the Query Builder's filter and group-by controls.

Critical Advisories

The Critical Advisories folder contains 86 curated saved queries that give your security team immediate, structured access to the highest-priority exploitable vulnerabilities relevant to your assets.

Selection Criteria

Queries in this folder are scoped to CISA Known Exploited Vulnerabilities (KEV) that meet all of the following conditions:

• Network-exploitable — reachable over the network without requiring physical or local access
• Unauthenticated — no credentials required to trigger the vulnerability
• No user interaction — exploitation does not depend on a victim taking an action
• Internet-facing enterprise products — scoped to server-side software and platforms commonly deployed at enterprise scale
• RCE or full-takeover impact — limited to vulnerabilities with remote code execution, authentication bypass, or complete system/account compromise potential

The following categories are explicitly excluded: SOHO and IoT devices, desktop and browser vulnerabilities, denial-of-service only bugs, and vulnerabilities that require authentication.

What Is Covered

The 86 queries include:

• The full set of CISA KEV entries that meet the criteria above, including 32 entries that were previously missing from the library
• A paired advisory for the WordPress Core unauthenticated RCE chain (CVE-2026-63030 and CVE-2026-60137)

Running a Critical Advisory Query

1. Open Insights → Query Builder.
2. In the sidebar, expand Critical Advisories.
3. Select the advisory you want to investigate (use the search box to filter by CVE identifier or product name).
4. Click Run (or press Cmd/Ctrl+Enter) to execute.

Results show all assets in your environment that match the advisory's criteria. Use the results to prioritize remediation for the affected assets.

Paginated Results and Live Row Counts

For flat (non-tree) queries, the Query Builder loads results incrementally so you can work with large datasets without waiting for a full result set to load.

• Infinite-scroll pagination — As you scroll to the bottom of the results overlay, the next page loads automatically. There is no fixed cap on the number of rows you can browse.
• Live result count — A count query runs independently of the data query and displays a "Showing X of Y results" indicator as soon as the total is available, without blocking the initial render of the first page.

Tree queries (those that return hierarchical, graph-structured results) continue to use a single-shot fetch and are not paginated.

Group By and Aggregations

You can summarize query results directly in the Query Builder without exporting data to an external tool. Group by and aggregation controls appear in the query builder header when a table or table-tree query is open.

Grouping Results

Select one or more entity fields to group results by using the Group By control in the query builder header. When a group-by is applied, the results render in a dedicated grouped results table that shows:

• Each unique combination of the selected group columns
• A row count for the number of records in each group
• Any aggregation values you have configured (see below)

You can group by multiple fields simultaneously. The order of the selected fields determines how groups are nested.

Aggregate Functions

With a group-by applied, use the aggregation controls to apply one or more aggregate functions to numeric fields in your result set:

Each aggregation column appears alongside the group columns and row count in the grouped results table.

Typical Use Cases

• Count findings by severity across asset types
• Sum vulnerability scores grouped by cloud region
• Compare average remediation age across asset owners
• Identify the maximum CVSS score per asset category

Key Features

• Full-width editor and results — Both the filter rows and the results overlay use the full viewport width, giving every control and column room to render without truncation.
• Horizontal scroll on results — Columns that extend beyond the visible area are reachable by scrolling; nothing is hidden.
• Consistent dark-theme dropdowns — All dropdowns in the Query Builder use the same dark-theme Select component as the rest of Guard. Native OS-styled selects are no longer present.
• Filtered fields always visible — Any field used in a filter automatically appears as a result column. No manual column configuration is needed.
• Keyboard shortcut — Cmd/Ctrl+Enter runs the current query from anywhere in the editor.
• Save and Duplicate — Save your custom queries for reuse, or duplicate an existing query as a starting point.
• Unsaved Changes Protection — Guard warns you before navigating away from unsaved query edits.
• Deep Linking — Query state is preserved in the URL, making it easy to share specific queries with teammates.

Support

If a filter field is missing, reach out to support@praetorian.com.