Skip to main content
This page is the operator-level introduction. The full grammar with all confirmed field paths is at Reference → Query Syntax.

​
Where queries work

The same grammar across every surface means one mental model.

​
Shape

Every clause is:
The operator is : (not =). Combine clauses with AND, OR, and NOT:
Hit Enter to apply. Saved queries become **Custom *** in the view dropdown until you click Save View (the floppy icon in the footer).

​
Value types

Values are typed — autocomplete shows what’s valid per field:

​
Autocomplete

The search input autocompletes both field names and values. As you type, it suggests:
  • Matching field names (with type and description)
  • After :, the valid values for that field
So you can build queries fully via autocomplete — type a few characters, arrow-select, repeat.

​
Verified examples

Example queries:
Filters to Windows devices. os is an enum of Windows, MacOs, Linux.

​
Vital states are booleans

A common source of confusion: Vital state isn’t a single string. Each integration exposes four boolean fields per device: Compose them with AND for the state you want:

​
Real integration prefixes

Integrations that expose system.* Vitals include:
  • system.azure_ad
  • system.crowdstrike
  • system.jamf
  • system.microsoft_defender_atp
  • system.microsoft_intune
  • system.onprem_ad
  • system.sccm
  • system.servicenow
  • system.zscaler_client
Your tenant’s list reflects whichever integrations are connected.

​
Saved views

Build a query → click the Save icon in the footer → name it → it appears in the view dropdown next to **Custom ***. Saving lets you reuse the query and schedule it as a report.

​
Natural language

In AI-enabled tenants, the command bar in Device Explorer accepts plain English. The AI translates intent into a structured query you can then edit:
“show me windows devices in End-User that don’t have CrowdStrike”
becomes something like:
Always read the translated query before saving — the AI is good but not infallible.

​
Tips

Always start with autocomplete. Type the field name slowly — the description tooltip tells you the type and whether there’s an enum. Saves a lot of guessing.
Compose Vitals four-way. Don’t fight a missing Healthy literal. Embrace the four-boolean model — it’s strictly more expressive than a single state string.
Save the queries you write more than twice. Saved views appear in the Default View dropdown and are the basis for Scheduled Reports.

​
What’s not in the query language

Based on autocomplete-only verification, these patterns are not supported by the current grammar:
  • <, >, <=, >= numeric / time comparisons (autocomplete offers value tokens, not comparators)
  • contains, starts with, ends with (string operators)
  • IN (...) lists — use OR instead
  • is empty / is not empty
If you need a comparison that the operator : can’t express directly, build it via composition (multiple clauses with AND/OR/NOT) or use the API for richer filtering.

​
See also

Query Syntax (full reference)

Every confirmed field path

Tags & Logic Engine

Same syntax drives tag rules

Devices

Where you’ll spend most query time