Query Log - All Customers / MSP Level
launched
Joel Biddle
I would like to be able to view query log results across all my customers at once, not company by company
Minetta Gould
updated the status to
launched
🎉 Update on this one — while a single unified view across all sub-orgs simultaneously isn't something we can offer right now (the data volume makes that a tough lift to do well), we did make a meaningful improvement that should help with exactly the kind of scenario Joel described.
The Query Log is now accessible directly from the MSP dashboard, so you can set your filters once and toggle between sub-orgs without losing your search context. No more exiting and re-entering each org to run the same query. For incident response situations where you need to chase a URL or domain across multiple clients quickly, this should cut that process down significantly.
Check out the details here: changelog link. Thanks for the patience and for sharing such a concrete use case — it helped us understand the real urgency behind this one. 🙌
Minetta Gould
updated the status to
not pursuing
R
Ryan Poppa
Joel Biddle Do you have a specific use case that you are trying to solve for? This would be a considerable amount of data to display and/or parse through, so would love to better understand the request.
Joel Biddle
Ryan Poppa Yes!
We had a business email compromise incident last week where a client sent a large volume of emails that included a link to a malicious phishing URL. This email was sent to internal and external recipients, and some of those recipients were users at OTHER clients of ours.
Once we identified the malicious URL, we added it to the universal block list, which prevented future clicks on the URL in the email from doing damage, but we wanted to identify every attempted access of that URL prior to when we updated of our universal block list.
If I had to search for this myself, client by client, that's really arduous and time consuming at scale. So, I reached out to support to get this information, which took hours (understandably).
It would be much easier if I could search across multiple client accounts simultaneously, so that I could compile of list of users we need to isolate and remediate quickly. Running the same query over and over again under each individual client is time consuming and being fast to respond is critical in this scenario.
I will attach an image of a similar query for reference.
Photo Viewer
View photos in a modal