> ## Documentation Index
> Fetch the complete documentation index at: https://docs.levelblue.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Defining a Launch Query Action

The BlueApp for LevelBlue Forensics and Response supports an extensive list of system-level functions that you can execute on a host system. Many of the most common data collection functions are included in the forensic profile actions or as standalone actions. You can also use the Launch Query action to specify any of the supported functions and any needed parameters for the function.

You can use the Launch Query action when you need to perform one of the following tasks:

* [Create a scheduled Forensics and Response job](log-collect-blueapp-forensics-resp)
* [Launch a Forensics and Response action from an alarm or event](event-alarm-action-blueapp-forensics-resp)
* [Create a Forensics and Response orchestration rule](rule-blueapp-forensics-resp)
* [Run an action from the BlueApp for LevelBlue Forensics and Response page](actions-blueapp-forensics-resp)

See the information in [Data Collection Functions](data-function-ref-blueapp-forensics-resp) and [Enforcement System Functions](enforce-function-ref-blueapp-forensics-resp) to determine the query syntax and parameters for the function you want to run using the Launch Query action.

**To define a query for the BlueApp for LevelBlue Forensics and Response**

1. In USM Anywhere, go to **Data Sources > BlueApps**.

2. Click the **Available Apps** tab.

3. Search for the BlueApp, and then click the tile.

4. Click the **Actions** tab.

5. Locate the Launch Query action and click **Run**.

   This opens the Select Action dialog box.

6. If needed, select the sensor on which the BlueApp is enabled to display more options.

7. Specify the asset that you want to use as a target for the action.

   You can enter the name or IP address of the asset in the field to display matching items that you can select. Or you can click **Browse Assets** to open the Select Asset dialog box and browse the asset list to make your selection.

8. In the Query field, enter the function to perform.

   <Frame>
     <img src="https://mintcdn.com/levelblue-5324744e/saQsJL5uxJZR1Kxa/images/usm-anywhere/alienapps/forensics-resp/forensics-resp-launch-query.webp?fit=max&auto=format&n=saQsJL5uxJZR1Kxa&q=85&s=5efd1e5c0d6d69e89a8a132535b8445a" width="529" height="584" data-path="images/usm-anywhere/alienapps/forensics-resp/forensics-resp-launch-query.webp" />
   </Frame>

9. (Optional) If the function requires parameters, use the Parameter fields to enter the values in order.