Create custom table queries: best practice

Create a query that displays the results in a table so that you can act on the query results.

For example, you might need to purge data or events based on your query. You might have events of a specific type that are overwhelming your database, such as 1051 and 1059 events. You can also use this technique to purge other threat events based on the custom queries you create.

A table query is used to return data in a simple table format, without graphs or charts. Server tasks can act on simple table data. For example, you can automatically delete this data.

This task creates a custom query that returns all 1051 and 1059 events in the database.

For details about product features, usage, and best practices, click ? or Help.

To open the Queries dialog box, select Menu → Reporting → Queries & Reports, then click New Query.
Click Events in the Features Group and Client Events in the Result Types, and click Next.
In the Display Results As pane, click List, then click Table, then click Next.
Click Next to skip the Columns dialog box.
Note
You can skip this step because ePO - On-prem does not use the columns you choose in the server task.
In Available Properties under Client Events, click Event ID to create an Event ID filter.
An Event ID row is added in the Filter pane.
Click the plus sign, +, at the right to add another Event ID comparison row, select equals in the Comparison column, add 1051 and 1059 in the Value column; then click Save and Run.
(Optional) You can select all these 1051 and 1059 events, then click Actions | Purge to purge them in real time. You can filter which events to purge based on those events older than X Days, Weeks, Months, or Years. Or you can Purge using a specific previously defined query.
Tip
Instead of purging the events in real time during business hours, you can create a server task that runs the purge nightly during off hours.
To create a erver task, select Menu → Automation → Server Tasks and click Actions → New Task.
Give the task an appropriate name and description; then click Next.
For example, Purge of 1051 and 1059 Events Nightly.
Click Purge Threat Event Log from the Actions list, then click Purge by Query.
In the list, find and click the custom query that you created.
Schedule the task to run every night, then click Save.