Saved Queries in Threat Flow allow you to save a combination of a query and a set of filters when browsing the Conversation Explorer, providing you with an easy way to revisit, manage, and monitor specific conversations based on your topics of interest.

When browsing Conversation Explorer, click the ⭐ icon in the Search Bar. You'll be prompted to give it a name. We recommend trying to keep it relevant to the type of information you're hoping to gather from it. There is currently no limit on how many Saved Queries you can create.

Saved Queries will save your query, Date Range, and any other filters you add using Conversation Explorer's Filters

When that filter is selected from the Saved Query list, all of the above will be applied to the Conversations displayed.

In Conversation Explorer, click the Saved Queries button to view a list of the Saved Queries you've created. From here you can select one Saved Query at a time to surface the latest conversations based on what you had previously configured. You can also delete or rename a Saved Query from this panel by clicking on the ... next to any Saved Query.

If a Saved Query is selected and you modify the query or adjust any filters, a red dot will appear to indicate unsaved changes. To save these updates, open the Saved Query dropdown and click Update.

Saved Queries are a powerful organizational feature of Threat Flow, but there's more that can be done. For example, you can add individual conversations to create Custom Intel, which creates a unique summary based on the conversations you select.

To get started, click the + icon next to any conversation. This adds the conversation to the Preview Custom Intel drawer, which when clicked, will show you all of the conversations you've selected. Conversations will remain in the Preview until you click Create Intel. From the drawer, you can remove any conversations you change your mind about, or add more while using Conversation Explorer.