Query and investigate

Hunting and triage in Vigilfield use three things. Each has a place in the app sidebar.

• Queries are single runs of a VFQL query. You write one on the Run Query page, run it, and read its rows. Every run is kept as a record, with its text, its state, and its results.
• Investigations are saved workspaces. An investigation holds an ordered list of artifacts. Each artifact is a named VFQL query with its latest run and results. Use an investigation when a question takes more than one query, or when you want to come back to it or share it with your team.
• Folders group investigations. Folders can hold other folders.

Investigations and folders live on the Investigations page. Queries live on the Queries page.

A typical flow:

1. Open Queries and click New Query.
2. Write a query and click Run.
3. When a result is worth keeping, click Save as Investigation.
4. In the investigation, add more artifacts to pivot on what you found.
5. File the investigation in a folder.

Every query surface uses VFQL, and only VFQL. To learn the language, read VFQL, the query language. To see what is supported, read VFQL and Kusto (KQL) compatibility.

Where to go next

• Queries: run a query, follow its state, read and page its results, and understand the limits.
• Investigations: create an investigation and work with its artifacts.
• Folders: organize investigations.