How to Use the Query Library

How to Use the Query Library

Overview

The Query Library is where everything you have built on top of your collected data is kept: the widgets you put on dashboards, the evidence queries you collect compliance proof with, and the alert queries that run on a schedule.

This guide covers all three tabs, what each one lists, and the actions available on a row.


Prerequisites

  • At least one integration connected and scanned
  • At least one of the permissions listed above — each tab is gated separately

Opening the Query Library

Navigation: Sidebar → Assets → Query Library

  1. Click Assets in the sidebar to expand it.
  2. Click Query Library.

The page opens with three tabs: Widget, Evidence and Alert. Each has a Search box, and each row has a menu on the right holding its actions.

> Note: If you do not hold the permission for a tab, that tab shows an access-denied screen while the others keep working.


Widget Tab

Lists every saved widget, including the standard ones that ship with Interno.

ColumnWhat it shows
NameThe widget's name
Visualization TypeHow it is drawn, for example a chart type, table or standard
Created ByWho created it
Created OnWhen it was created
Updated ByWho last changed it
Updated OnWhen it was last changed

Create Widget at the top right opens the widget builder. It appears only if you hold defence:widget:create.

Row actions

ActionWhat it does
EditOpens the widget in the builder
DeleteRemoves the widget
PreviewShows the widget's visualisation without leaving the page
DrilldownOpens a drilldown built from this widget

Standard widgets cannot be edited or deleted — attempting to delete one is refused with a message. Drilldown is not offered for table or standard widgets.

> Note: Deleting a widget that is used on a dashboard warns you first and names the dashboards it appears on.


Evidence Tab

Lists saved evidence queries, which collect data from your integrations for use as compliance evidence.

ColumnWhat it shows
IdentifierThe evidence identifier
NameThe evidence query's name
TypeControl or Parameter
Created ByWho created it
Created OnWhen it was created
Updated ByWho last changed it
Updated OnWhen it was last changed

Use the Type filter to show only Control or only Parameter entries. Create Evidence opens the evidence builder.

Row actions

ActionWhat it does
EditOpens the evidence query in the builder (needs grc:evidence:create)
DeleteRemoves the evidence query (needs grc:evidence:create)
PreviewRuns the query and shows what it currently returns

Alert Tab

Lists saved alert queries, which run on a repeating interval.

ColumnWhat it shows
NameThe alert's name
IntervalHow often it runs
Created ByWho created it
Created OnWhen it was created
Last ExecutedWhen it last ran
Next ExecutionWhen it is due to run next

Create Alert opens the alert builder.

Row actions

ActionWhat it does
EditOpens the alert in the builder (needs defence:query:create)
DeleteRemoves the alert (needs defence:query:delete)
TriggerRuns the alert immediately, without waiting for its next scheduled run

Troubleshooting

A tab is empty → Nothing of that kind has been saved yet. Use Create Widget, Create Evidence or Create Alert to add the first one.

I cannot see the Create button → Creating is permission-gated: defence:widget:create for widgets, grc:evidence:create for evidence, defence:query:create for alerts. Editing and deleting evidence are gated on grc:evidence:create as well.

Edit and Delete are missing from a widget's menu → That widget is a standard one. Standard widgets cannot be edited or deleted.

Drilldown is missing from a widget's menu → Drilldown is not available for table widgets, standard widgets, or the advanced chart types.

An alert has not produced anything → Check Last Executed and Next Execution on its row. Use Trigger to run it now and see what it returns.

A tab shows an access-denied screen → Each tab needs its own view permission: defence:widget:view, grc:evidence:view or defence:query:view. Ask your administrator.


Need more help? Contact support@zeron.one