Create Advanced Searches in Data Control

Applies To: WatchGuard Data Control

When you create a new search, it appears in the list of searches with the date and time it was created, as well as the name and status (for example, In progress, Canceled, or Finished). You can refine your search on the Advanced Search page. To refine your search, enter keywords in the Free Search text box or you can create a Guided Search.

The Guided Search interface presents multiple text boxes to search for a combination of keywords (for example, all, any or none). To create a guided search, enter keywords in different text boxes. If you include + or - characters in a guided search, they form part of the search keyword.

To create a guided search:

  1. In WatchGuard Cloud, select Monitor > Endpoints.
  2. Select Status.
  3. From the left pane, select Data Control.
  4. At the bottom of the dashboard page, in the Searches section, click Advanced Search.

    To edit an existing search, in the row for the search, click The options icon., and select Edit Search.
    The Advanced Search page opens.

Screen shot of WatchGuard EPDR, Data Control Advanced Search

  1. If required, enter a name for the search.
  2. Select Guided Search.

Screen shot of WatchGuard EPDR, Data Control Guided Search

  1. In the Search for Files With section, in the search boxes, enter keywords to search for.
    • All of these exact words or phrases — Search looks for files that contain all of the specified words or entries.
    • Any of these exact words or phrases — Search looks for files that contain any or all of the specified words or entries.
    • None of these exact words or phrases — Search looks for files that do not contain any of the specified words.
  1. In the Personal Data section, specify the entities that the files with PII you want to find must include.
  2. Screen shot of WatchGuard EPDR, Data Control Personal Data

    • All — Select the All tab to search for files with PII that include all selected entities (Boolean AND logic).
    • Any — Select the Any tab to search for file with PII that include at least one of the selected entities (Boolean OR logic).
  1. In the Narrow Search to section, from the Computers drop-down list, select an option:
    • All — Search all computers with a Data Control license assigned and with the search option enabled in the settings.
    • The following computers — Search only the specified computers. Use the check boxes to select the computers with a Data Control license to search for the specified content.
    • The following computer groups — Search computers from the specified groups. Displays the folder structure with the computer hierarchy configured in WatchGuard Endpoint Security. Use the check boxes to select the groups to search for the specified content. For more information, see Manage Groups.
  2. In the Cancel the Search Automatically section, from the Cancel Automatically drop-down list, select the search timeout period for computers that are not powered on or offline.
    This indicates how long to wait before Data Control cancels the search.

Screen shot of WatchGuard EPDR, Data Control cancel search automatically

  1. Click Search.

Related Topics

About Data Control Search

Search Result Normalization

Manage Searches in Data Control

Search Files with Data Control

Data Control Settings