REGISTERED_QUERIES Option Attributes

A query that uses the REGISTERED_QUERIES option operates against the ec_query Event Collector database table, which stores information about queries that have been registered with Event Collector.

The following table describes the attributes that you can include in a filter expression in a query that uses the REGISTERED_QUERIES option.
Attribute Description/Notes
attributes Required attributes to be fetched when executing this registered query.
correlate Boolean value defining whether correlation is required for this registered query.
filter Filter string used by this registered query.
id Primary key of this registered query.
ref Unique tag defined for this registered query.
sort Attributes defining the sort criteria for this registered query.
target Target of this registered query, defining the database table against which the query executes - for example, AUDIT or REGISTERED_ATTRIBUTES.