To Delete A Batch Query; Selecting The Query Type; Result Format - Cisco CS-MARS-20-K9 - Security MARS 20 User Manual

Chapter 20 Queries and Reports

To Delete a Batch Query

Click QUERY/REPORTS, then click the Batch Query tab.
Step 1
Step 2 Click Delete.
Step 3 In the confirmation window, click Delete to confirm.
You can only see your own batch queries and their results. The batch queries of others and their results
Note
are not viewable by you, and your batch queries and their results are not viewable by others.

Selecting the Query Type

Figure 20-8
You can select different query criteria by clicking the Query Type link or Edit button. This lets you
determine a query's result format, rank, time, whether it only uses firing events, and the number of rows
returned.
Figure 20-9

Result Format

•
Returns the most reported event types. Ranked by either: number of sessions containing at least one of
the event type or by bytes transmitted in sessions that contain events that meet the query criteria.
78-17020-01
Clicking the Query Type or Edit link
The Query Criteria: Result Page
Event Type Ranking
User Guide for Cisco Security MARS Local Controller
Queries
20-5