Overview

The Query Library holds the saved queries that Interno runs on your behalf. It has three tabs:

This guide covers the Evidence and Alert tabs. Widgets are covered in *How to Build Custom Widgets and Dashboards*.

Navigation: Sidebar → Assets → Query Library

Prerequisites

• At least one integration connected and syncing, so there is data to query
• defence:query:view to see the Alert tab; grc:evidence:view to see the Evidence tab
• defence:query:create to open the Query Builder for either type
• grc:evidence:create for the Create Evidence button
• defence:query:execute to preview an evidence query or trigger an alert

If you have none of the three tabs' view permissions, the whole Query Library page shows an Unauthorized screen.

Evidence queries

An evidence query collects data that supports a compliance control, or that fills a named parameter.

Creating one

1. Open Query Library and select the Evidence tab.
2. Click Create Evidence. The Query Builder opens.
3. Build the query:

• Query tab — pick a source and fields, and optionally add filters, aggregation, grouping, ordering and a limit.
• SQL tab — write the query directly.
• AI tab — describe what you want in plain language.

An information icon on the builder header notes: "If you are going to automate parameters, make sure you have selected only one aggregation, nothing else."

1. Click Create Evidence. A form appears.
2. Complete the form:

1. Click Create.

> There is no Description field on an evidence query — that field only appears for widgets and alerts.

If the preview returned more than one row, an information icon appears next to the button warning: "You have selected more than one row, please make sure you want to automate control evidence not parameters."

The Evidence list

Above the table there is a search box and a Type filter offering Control and Parameter.

Running an evidence query

1. Find the row and open its action menu.
2. Click Preview.

The query runs and the results appear in a table inside the preview panel. This needs defence:query:execute.

The action menu also offers Edit (confirm, then the Query Builder reopens) and Delete.

Scheduled alerts

An alert runs a query every N days and emails the result to a list of users.

Creating one

1. Open Query Library and select the Alert tab.
2. Click Create Alert. The Query Builder opens.
3. Build the query on the Query, SQL or AI tab.
4. Click Create Alert. A form appears.
5. Complete the form — all four fields are required:

1. Click Create.

> Row limit. The Create Alert button is disabled while the preview returns more than 100 rows, and an information icon explains: "You have selected more than 100 rows, make sure total number of rows is less than 100." Add a filter or a limit to bring the result set down.

How alerts run

• The alert executes on its interval. After each run, Last Executed is updated and Next Execution is set to the interval's number of days later.
• Each run emails every user in the Users list with the title, description and the results rendered as a table.
• The email is sent on every run — including runs that returned nothing. An empty table means the query matched no rows this cycle.
• If no users are selected, the query still runs but no email is sent.

The Alert list

Use the search box to find an alert by name.

Running an alert immediately

1. Open the row's action menu and click Trigger.
2. On the Trigger Confirmation dialog — "Are you sure you want to trigger this alert?" — click Trigger.

The query runs and the email goes out straight away. The schedule is unaffected.

The action menu also offers Edit and Delete.

Troubleshooting

The Query Library page shows an Unauthorized screen → You have none of defence:widget:view, grc:evidence:view or defence:query:view. Ask your administrator for the ones you need.

One tab shows Unauthorized while the others work → Each tab is gated separately: Widget needs defence:widget:view, Evidence needs grc:evidence:view, Alert needs defence:query:view.

The Create Evidence button is missing → That button requires grc:evidence:create.

Create Evidence opens but the builder refuses me → The Query Builder itself requires defence:query:create for both evidence and alerts. You need both that and grc:evidence:create to create evidence end to end.

Preview or Trigger fails → Both require defence:query:execute.

Edit opens the builder but saving fails → Saving an edited evidence query or alert requires defence:query:update. This is a different permission from defence:query:create, which is what governs whether the Edit menu item is shown.

The Create Alert button stays greyed out → The preview is returning more than 100 rows. Narrow the query.

The query returns no rows → Confirm the source integration is connected and has completed a sync, and check the filters on the query.

I am looking for a tab called Evidences or Alerts → The tabs are named Widget, Evidence and Alert, in the singular.

Need more help? Contact support@zeron.one