Intercept X with EDR EAP - Variable support for queries

Starting on the week of may 18 we will be adding variable support to queries.

You can create queries that now include support for up to 6 variables. A variable will be given a $$ prefix and postfix and can be either a TEXT or DATE value.  You will write your query and specify the variable information in the query.  Then when you run it you will be able to simply drop in the information for the variable and we will automatically substitute the variable with the data you provided.

The query below search for authentication activity for a username.  When running the query you just type in the username you are interested in and press run.