Query Explorer

Query Explorer is an interactive query interface built into CyberGuard Device Inventory Manager. It lets authorized users search, filter, and analyze device management data across all synchronized Intune entities — without writing SQL or navigating multiple portal screens.

#What It Does

Query Explorer accepts a pipe-based query language (inspired by Kusto Query Language) and executes it in real time against your tenant's synchronized data. Results appear immediately in a paginated table, and can be exported to JSON or CSV in one click.

Typical use cases:

• Find all non-compliant Windows devices and extract their primary user UPN
• List devices with less than 10 GB of free disk space, sorted by available space
• Audit unsigned drivers across the fleet
• Review the last 50 operations recorded in the audit log

Query Explorer requires the Query Explorer permission (see Users & Permissions). You can query only the tables of the features included in your subscription, and only the devices you are allowed to see.

#Query Language

Queries follow this structure:

TableName | command1 | command2 | ...

Each pipe (|) passes the result of the previous step into the next command. Commands are case-insensitive.

#Commands

#Filter Operators

Multiple conditions in a where clause are joined with and:

Devices | where ComplianceState == "NonCompliant" and OperatingSystem contains "Windows"

#Available Tables

The tables below are available when the corresponding feature is part of your subscription. Each table shows the entity name to use in queries and the fields you can reference.

#Devices

Note: CpuNome, NpuPresente, NpuNome, and GpuNomi are enriched fields computed from hardware assessment data. They can be returned via project but cannot be used in where filters or sort by.

#Apps

#Compliance

#WindowsUpdates

#Drivers

#ExtraDevices

Non-Intune devices imported manually (assets, rented equipment).

#SnmpDevices

Devices discovered by the network probe.

#Inventory

Non-hardware assets: software licences, SIM cards, subscriptions.

Category, sub-category and vendor are returned as names, not identifiers, so you can filter on them directly. Status and CostPeriod are returned as their invariant English values — the same ones used by the CSV import and export — so a query works the same way whatever language the portal is displayed in.

Examples:

Inventory | where Category == "SIM" | project Name, Vendor, AssignedUserDisplayName
Inventory | where Status == "Active" and ExpiryDate < "2026-12-31" | sort by ExpiryDate asc
Inventory | where AssignedUserUPN == "mario.rossi@contoso.it"
Inventory | where Company == "Contoso Manufacturing" | project Name, Category, Status

In an Enterprise tenant made of several companies, Company is always filled in — with the sub-company name for assets that belong to one, and with the parent company name otherwise. So you can single out one company, the parent included.

#InventoryAssignments

Assignment history of inventory assets — who held what, and when.

#InventoryCatalog

The self-populating catalogue of categories, sub-categories and vendors.

This table has no Company column, unlike the other three: the catalogue belongs to the tenant, not to a single company. Categories are shared by every company in the group.

Useful to spot duplicates that crept in through imports:

InventoryCatalog | where Type == "Category" | sort by Name asc
InventoryCatalog | where IsActive == "false"

#InventoryAttachments

Metadata of files attached to inventory assets — contracts, invoices, licence certificates. The storage path is deliberately not exposed.

InventoryAttachments | where AlertDate < "2026-12-31" | sort by AlertDate asc

#AuditLog

Always available, regardless of license tier.