Overview

The Query Library is where everything built on top of your collected data is kept: the widgets you place on dashboards, the evidence queries that collect compliance evidence, and the alert queries that run on a schedule.

This guide covers the three tabs, what each one lists, the actions on each row, and how to set up a drilldown on a widget. Creating evidence queries and alerts step by step is covered in How to Set Up Alerts and Evidence Queries. Building widgets is covered in How to Build Custom Widgets and Dashboards.

Prerequisites

• At least one integration connected with data collected. Until then the Query Library sends you to Admin → Integrations.
• A view permission for each tab you want to use. Every tab and every action is gated separately, as the table shows.

Opening the Query Library

Navigation: Sidebar → Assets → Query Library

1. Click Assets in the sidebar to expand it.
2. Click Query Library.

The page opens on the Widget tab. The three tabs are Widget, Evidence and Alert.

Every tab works the same way:

• A Search box above the table searches by name.
• Click a column heading that supports sorting to sort by it; click again to reverse the order. Each list starts with the newest entries first.
• The footer shows the page controls and a rows-per-page selector offering 10, 20, 50 or 100. The default is 20.
• Each row has a menu at its right-hand end holding its actions.
• Clicking a row in the Widget or Evidence tab opens its preview.

If you lack the view permission for a tab, that tab shows an unauthorised screen while the others keep working. If you lack all three, the whole page shows it.

Widget Tab

Lists every saved widget in your organisation, including the standard widgets that ship with Interno and any widgets ZIN created.

Create Widget at the top right opens the Query Builder. It is shown only if you hold defence:widget:create.

Row actions

Preview a widget

1. Click the widget's row, or open its row menu and click Preview.
2. The widget is drawn in a window with its live data. Chart widgets show their toolbar (Change Preview, Data View, Save as image), and table widgets show their search, filter, column visibility and export controls.
3. Click Close.

Edit a widget

1. Open the row menu and click Edit.
2. The Edit Confirmation window opens: Are you sure you want to edit this widget? If the widget is on any dashboards, the window lists them under This widget is related to:.
3. Click Confirm Edit. The widget opens in the Query Builder.

A change to a widget shows on every dashboard that uses it, which is why the dashboards are listed first.

Delete a widget

1. Open the row menu and click Delete.
2. The Delete Confirmation window opens: Are you sure you want to delete this widget? If the widget is on any dashboards, they are listed under This widget is related to:.
3. Click Confirm Delete.

Deleting a widget cannot be undone, and the widget disappears from every dashboard it was on. Standard widgets cannot be deleted.

Setting Up a Drilldown

A drilldown is a second query attached to a widget. When someone clicks a bar, slice or point on the widget, Interno runs the drilldown for the value they clicked and shows the matching rows.

Without a drilldown, clicking a chart still opens a details window, but it can only show the rows of the widget's own result for that value. A drilldown lets you show different, fuller detail.

Navigation: Sidebar → Assets → Query Library → Widget tab → row menu → Drilldown

1. Open the row menu of the widget and click Drilldown. The Query Builder opens with a Parent Widget panel showing the widget's name, the tables it reads, and its visualisation settings (Chart Type, X-Axis, Y-Axis and, where set, Y-Axis Label, Include Total, Show Legend and Color Palette).
2. Read the warning under the panel. It names the parent widget's x-axis column and tells you that it must appear in your WHERE clause for the drilldown to filter correctly.
3. In Drilldown SQL Query, write the query that returns the detail rows. Include a condition that compares the x-axis column with a sample value in quotes, for example a condition that the status column equals 'Open'. The sample value is a stand-in: when someone clicks the chart, Interno replaces it with the value they clicked.
4. Click View Schema if you need to look up table and column names.
5. Click Preview. The result is shown as a table for the sample value you wrote.
6. Click Create Drilldown above the preview.
7. In the confirmation window (Are you sure you want to create a drilldown for …?), click Create Drilldown.

Interno confirms with Drilldown created successfully and returns you to the Query Library.

Use a drilldown

1. Open a dashboard that holds the widget, or preview the widget in the Query Library.
2. Click a bar, slice or point.
3. The Chart Data Details window opens with Filtered by: and the value you clicked, and a table of the matching rows. Use its search, filter and Export data controls as needed.
4. Click Close.

On a card widget with a drilldown, clicking the card runs the drilldown query as written and shows its rows.

Change or remove a drilldown

1. Open the widget's row menu and click Drilldown again. The existing drilldown query is loaded.
2. To change it, edit the query, click Preview, then Update Drilldown and confirm. Interno confirms with Drilldown updated successfully.
3. To remove it, click Delete Drilldown above the preview and confirm in the Delete Drilldown window. Interno confirms with Drilldown deleted successfully.

Evidence Tab

Lists saved evidence queries, which collect data from your integrations as compliance evidence.

Above the table, the Type filter narrows the list to Control or Parameter. Create Evidence opens the Query Builder; it is shown only if you hold grc:evidence:create.

Row actions

The preview shows the result as a table with search, filter, column visibility and CSV export.

Alert Tab

Lists saved alert queries, which run on a repeating interval and email their result.

Create Alert opens the Query Builder; it is shown only if you hold defence:query:create.

Row actions

Alert rows do not open a preview when clicked. To see what an alert returns, use Trigger and read the email, or open it with Edit and click Preview in the builder.

Troubleshooting

The Query Library sends me to Integrations → Interno has no collected data yet. Connect an integration and let a scan finish.

The whole page shows an unauthorised screen → You hold none of defence:widget:view, grc:evidence:view or defence:query:view. Ask your administrator.

One tab shows an unauthorised screen → That tab's view permission is missing. See the permissions table above.

A tab is empty → Nothing of that kind has been saved yet, or your search matches nothing. Clear the Search box, then use Create Widget, Create Evidence or Create Alert.

The Create button is missing → Creating is gated: defence:widget:create for widgets, grc:evidence:create for evidence, defence:query:create for alerts.

Edit and Delete are missing from a widget's menu → The widget is a standard widget, which cannot be edited or deleted, or you lack defence:widget:create (edit) or defence:widget:delete (delete).

"Standard widget can't be deleted." → Standard widgets ship with Interno and stay in the library. Remove them from a dashboard instead if you do not want to see them.

Drilldown is missing from a widget's menu → Drilldown is not offered for table widgets, standard widgets, or radar, sunburst, theme-river and parallel charts.

Clicking my chart shows the wrong rows, or none → The drilldown query does not compare the parent widget's x-axis column with a value. Open Drilldown, add that condition to the WHERE clause, and update.

The drilldown is refused with "Drill-down SQL validation failed" → The query broke one of Interno's SQL rules; the message names the problem. See How to Build Custom Widgets and Dashboards for the rules.

I opened Create Evidence but the builder shows an unauthorised screen → The Query Builder for evidence and alerts needs defence:query:create as well.

Edit opens the builder but saving is refused → Saving a changed evidence query or alert needs defence:query:update. Deleting an evidence query needs defence:query:delete.

After saving an alert or an evidence query I landed on the Widget tab → The Query Library always opens on Widget. Click the Alert or Evidence tab to see what you saved.

Preview or Trigger is refused → Both need defence:query:execute.

Need more help? Contact support@zeron.one