Documentation forSecurity Event Manager

Use query packs for compliance reports

A query pack is a predefined, read-only collection of compliance queries in Historical Events & Reports. Instead of building and running many queries one by one, you can open a query pack and run all its queries together to produce a consistent compliance report.

SEM 2026.4 includes one Query Pack, NIST 800-53, based on NIST 800-53 Rev 5.2.0. The NIST queries in the pack are located under Predefined queries and organized into sections that correspond to NIST 800-53 control families.

Query packs are supported in both the FIPS and non-FIPS editions of SEM.

Query packs are defined by the product. You cannot create your own query packs or edit the queries and sections included in a pack. You can change the timeframe used for your reports, generate reports, and schedule reports.

About the NIST 800-53 queries

When you install or upgrade to SEM 2026.4, 28 predefined NIST 800-53 queries are added to the Queries tab in Historical Events & Reports. Each query uses a default timeframe of Today. The queries are added only once:

  • If you delete one of the NIST queries, it is removed from the NIST query pack and is not restored by a later upgrade.

  • If you created your own NIST query tag before upgrading, your tag is preserved.

Open a Query Pack

  1. Log in to the SEM console and click Historical Events & Reports in the toolbar.

  2. In the left column, click the Queries tab.

  3. In the drop-down list, select Query Packs.

  4. Click NIST 800-53.

The Query Pack page displays the pack description and a summary row with the following information:

  • Timeframe: The timeframe used when the pack runs. Individual means that each query uses its own timeframe. If you override the timeframe, the selected timeframe is followed by (Overridden), for example Last 30 days (Overridden) or Custom (Overridden).

  • Sections: The number of sections in the pack.

  • Queries: The number of queries in the pack.

  • Output: The report output format.

  • Schedule: The report schedule, if one is configured.

  • Delivery: How a scheduled report is delivered.

Below the summary, the queries are grouped into collapsible sections. Each section includes a description. You can:

  • Enter a term in the search box to find matching sections or queries in the pack. If no results appear, clear the search box.

  • Expand or collapse a section to show or hide its queries.

  • Click a query name to open that query in Historical Events. The query runs for its timeframe and the available event data. If no events are displayed, no matching events may exist for that timeframe.

Change the timeframe for a query pack

By default, each query in a query pack runs with its own timeframe. You can override this and apply one timeframe to every query in the pack.

The timeframe setting is saved for your user account only. It does not change the query pack for other users.

  1. Open the Query Pack and click Edit.

  2. Select Override timeframe. This option is cleared by default.

    Overriding the timeframe may produce a discrepancy between the query name and the events included for the range.

  3. Select a timeframe: Last 24 hours, Last 7 days, Last 30 days, or Last 90 days. To use a custom range, enter a Start and End date and time. The start must be before the end.

  4. Click Save.

To return to each query's own timeframe, click Edit and then click Reset to Individual. SEM displays the message Timeframe reset. This Query Pack now uses each query's individual timeframe.

Generate a Query Pack report

Generating a report runs all queries in the pack one after another, using the current timeframe for the pack. The report is created only if all queries run successfully.

  1. Open the query pack and click Generate Report.

  2. Enter a name for the report and select the report format.

  3. Click Generate.

    A Generating Report banner displays the progress. To stop the run, click Cancel in the banner.

    When the run completes, a ZIP file downloads to your computer. If the file does not download, check your browser download settings or blocked download notifications.

  4. Unzip the file using an unzip utility.

The ZIP file contains:

  • A report for every query in the pack, in CSV or PDF format. Events are grouped in the same way as in other query reports.

  • An interactive index.html file that maps each report to its section in the pack. Open this file in a browser to navigate the reports.

A report with no events does not mean that the run failed. It may mean that no matching events exist for the selected timeframe.

Reports may include sensitive event data. Handle and store them according to your organization's policies.

Schedule or unschedule a Query Pack report

You can schedule a query pack report to run automatically. Scheduled query pack reports use the same output, recurrence, and delivery options (such as email and share) as other scheduled reports.

  1. Open the query pack and click Schedule Report.

  2. Select the output, recurrence, and delivery options.

  3. Save the schedule.

The schedule and delivery details are displayed in the summary row of the Query Pack page.

The individual queries in a scheduled Query Pack may not show a scheduled icon in the Queries tab. To check whether a Query Pack report is scheduled, open the Query Pack page.

To stop a scheduled report, open the query pack, click Unschedule report, and confirm. SEM displays the message Report unscheduled. This query pack report will no longer be generated and delivered automatically.

Troubleshoot query pack reports

The following table lists messages you may see when you generate a query pack report.

Message What to do
Another report run is already active for this Query Pack. Please wait for it to finish. Only one report can run for a Query Pack at a time. Wait for the current run to finish, and then try again.
One or more queries in this Query Pack failed to run. Please try again. Because the report is created only when all queries succeed, no report was created. Generate the report again.
The Query Pack report run was cancelled. The run was cancelled and no report was created. Generate the report again when you are ready.
This Query Pack report is taking longer than expected. Please try again later. Try again later. If the problem continues, select a shorter timeframe for the pack and generate the report again.

NIST 800-53 sections

The NIST 800-53 query pack includes the following sections. Each section corresponds to a NIST 800-53 control family.

ID Section
AC Access Control
AU Audit and Accountability
CM Configuration Management
IR Incident Response
CA Security Assessment
SI System and Information Integrity