> For the complete documentation index, see [llms.txt](https://docs.reveald.com/technical-documentation/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.reveald.com/technical-documentation/admin-guides/epiphany-intelligence-platform-administrator-guide/epiphany-tools/rogue-report/host-list-and-the-query-builder.md).

# Host List and the Query Builder

The **Host List** is located at the bottom of the [Rogue Report](/technical-documentation/admin-guides/epiphany-intelligence-platform-administrator-guide/epiphany-tools/rogue-report.md). It  shows each user that meets the criteria set up using the filters at the top of the pane. In the image below, this report shows *all* users, regardless of which tools they are using. You can tell this by the colored rectangles at the top, which show Windows AD, CrowdStrike, and Tenable.

<figure><img src="/files/hDnvO3DwfmZYrLD6t354" alt=""><figcaption><p>Host List</p></figcaption></figure>

You can quickly filter the information by removing and adding data sources from the list:

* Select the “x” next to a data source name to remove it from the list.
* To add a data source you previously removed, expand the drop-down list and select it.

<figure><img src="/files/aywDTlRg8Yvom3Xl4ABF" alt=""><figcaption><p>Expand the drop-down list (on the right) and select a data source.</p></figcaption></figure>

* To change the detail shown in the list, select the **Advanced Filter**/**Basic Filter** switch on the left.&#x20;
* To perform an advanced query to potentially identify devices that aren’t using the required tools, select the filter icon <img src="/files/3lkRqJZtoFSjn2RfFakd" alt="" data-size="line">. This is described in the next section.

### Query Builder

Based on our example images, let’s assume you need to build a query to show you the users in Windows Active Directory who aren’t using CrowdStrike.

1. Select the filter icon <img src="/files/MoO7SAvsZFgebKj7HSSU" alt="" data-size="line">.
2. Select **in +** <img src="/files/AqvGB8LZT494eGDlyEQN" alt="" data-size="line"> and then select **windows\_ad+** <img src="/files/Fej2qxQoAVaLfuhoAHau" alt="" data-size="line"> <img src="/files/YGhcmtV8b0IPhE1I6llG" alt="" data-size="line">.
3. Select **not +** <img src="/files/VWoLhTnB6QBQ9dDqaZaD" alt="" data-size="line"> and then select **crowdstrike+** <img src="/files/GEUiZOJPKeqKjdo2KxGe" alt="" data-size="line"> <img src="/files/9dVKO9yYazLETuH2GO55" alt="" data-size="line">.
4. Select **Run Query**.&#x20;

This builds a query that tells Epiphany to list all users who are using Windows AD but not using Crowdstrike. These are the devices you need to ensure start using Crowdstrike. You can download this list as a .csv file and it can become a worklist.

<figure><img src="/files/K5pwBek8tnN2nOiBMOYV" alt=""><figcaption><p>Query Builder with a query to show users in Windows Active Directory who aren't using CrowdStrike.</p></figcaption></figure>

For more information on advanced queries follow the information in the [Search and Query Guidelines](https://app.gitbook.com/o/dUU09CQc8vIXNBlaSdQu/s/tkp3obVDMu3n9ZTUpfEP/~/changes/970/admin-guides/epiphany-intelligence-platform-administrator-guide/search-and-query-guidelines) section.
