→ Detect and investigate endpoint threats by running custom queries automatically, then retrieve and analyze the results to enhance incident response workflows → Automate query management by listing and categorizing existing queries, enabling security teams to quickly find relevant detection patterns and reduce manual lookup time → Control query execution lifecycle by scheduling query runs, checking their progress, and cancelling them when necessary, ensuring timely and precise security data retrieval