Navigate the query tree

Overview

The query tree is a visual representation of your investigation history, designed to help you quickly

  • Navigate through your query history
  • Revisit executed query results
  • Enhance and run queries
  • Keep track of your investigation steps

query tree

How it works

A query tree is composed of

  • Root node: The initial node created in the query tree when you execute your first DQL query.
  • Query nodes: Each time you modify and execute a DQL query, a new query node is added to the tree.
  • Query branches: A string of query nodes forms a query branch. If you navigate to a previous query and then modify and execute it, a new query branch with a new query node is created from the respective query. Query branches are visual representations of your investigation paths.

Despite any modification in the query tree, the following elements are always preserved:

  • The integrity of the previously existing queries and results
  • The relations among queries
  • The context of the investigation

If you modify your query to a point where no further analysis is possible, you can navigate back in the tree to your last working query and continue your investigation from there. This creates a new branch in the query tree.

Manage query tree

In the More actions menu displayed when you hover over a node, you can

  • Rename the query node

  • Change the query node color individually or in bulk for fast identification

    • To color multiple nodes at once

      1. Use Alt+Click to select the branch or Shift+Click to select multiple nodes.
      2. Select the color.

      Once you change the color of your last query node, all the subsequent query nodes automatically acquire that color, until you change it again.

  • Delete any part of the query tree you consider irrelevant

    • To delete multiple nodes at once

      1. Use Shift+Click to select multiple nodes.
      2. Select Delete nodes.

    • To delete all branches except a selected one

      1. Use Alt+Click to select the branch you want to keep.
      2. Select Keep selected branches.

Preview and reuse queries

You can quickly preview and reuse queries straight from the query tree, without having to navigate to them. This saves you time and is more convenient.

  • To preview a query

    1. Select More actions to the right of the desired node.
    2. Hover over the node name.

  • To reuse a query

    1. Select More actions to the right of the desired node.
    2. Hover over the node name and select Copy Copy to clipboard .

    copy query from query tree

Related topics