Last updated
You can save any VQL queries as a favorite for easy and quick access later.
You can load and save favorites from the Edit menu or the VQL editor's context menu. Simply use the Load from Favorites or Save to Favorites menu items available in those menus at any time while in the VQL editor.
Depending on whether there is a text selection or not, either the whole content of the code area or only the selected text will be saved as a favorite. Ideally complete statements should be selected and saved as favorites, but it is possible to save incomplete statements as well if desired. Incomplete favorites do need to be closed after being loaded to form a valid statement that can be executed correctly.
When saving a query to Favorites, a number of properties can be set to catalog, sort and find favorites later.
Favorites can also be edited later if changes are needed (see Manage Favorites below for editing existing favorites).
Name Name of the favorite.
Category Select a category for your favorite. Your favorite query will be grouped together with other favorites under the same category.
Object type Enter the object type used in this query.
Show in Favorites Select if you want the favorite to be displayed in the Favorites menu. Unchecking this will hide the favorite from the Favorites menu and the Favorites Panel in the Vault Navigator.
Show in Vaults
Enter any vaults this particular favorite should be limited to.
An exclamation mark placed in front of the vault name (e.g. !testVault.domain.com) hides the favorite for the respective vault.
Leaving the field empty will display the favorite in all vaults.
Vaults can also be selected by opening the menu to the right of this field, but only known (previously used) vaults will be displayed in the list.
Description Enter an (optional) description of what this favorite does.
VQL Query Displays the VQL query for this favorite.
Favorites can be managed directly from the context menu, which you can access by right-clicking on the favorite you want to modify.
Once you right-click, the context menu will be displayed, containing the following options:
Run Favorite: Runs the selected favorite.
Edit: Opens the edit window for the selected favorite.
Rename: Activates renaming for the selected favorite.
Delete: Deletes the selected favorite.
Add Favorite: Allows you to add a new favorite.
Add Category: Allows you to add a new category.
Favorites by Category: Displays favorites grouped by category.
Favorites by Object Type: Displays favorites grouped by object type.
Show Hidden: Allows you to select whether to display hidden favorites.
Import from File: Allows you to import favorites from a file.
Export to File: Allows you to export the selected favorite or category to a file.
Additionally:
Favorites can be moved from one category to another using drag and drop.
Standard/shared favorites cannot be edited or moved, but they can be copied using the copy function or drag and drop.
It is not possible to restore a deleted favorite, so take care when using this action.
