Cisco CS-MARS-20-K9 - Security MARS 20 User Manual page 414

Perform a Batch Query
In the Query Event Data window, you can change the query criteria. (For more information on query
Step 3
criteria, see
of the query. In this case we are specifying a Source IP address of 10.1.1.6, a Destination IP address
range previously saved as mygroup, and setting the duration of the query to the past 2 days.Click either
Apply button to apply your changes to the query. The Query Save/Submit window appears.
Figure 20-24
Step 4 The Query Save/Submit window asks you to choose from the options of Save as Rule, Save as Report,
or Submit Batch. To submit your query as a batch query, click Submit Batch. Your query is submitted,
and you are automatically taken to the Batch Query tab.
Figure 20-25
To watch the status of the query in real-time, you can use the Batch Query tab drop-down list to change
Step 5
the Page Refresh Rate from Never (the default) to 1 minute, 3 minutes, 5 minutes, 10 minutes, 15
minutes, or 30 minutes.
User Guide for Cisco Security MARS Local Controller
20-22
Query Criteria, page 20-10). By clicking on various parameters you can change the nature
Query Save/Submit window
Batch Query Tab
Chapter 20 Queries and Reports
78-17020-01