LiveQuery is a feature of VMware Carbon Black's LiveOps product. LiveQuery empowers Security and Operations teams, to perform custom and canned queries on endpoints, and GoLive, tapping into the device, in real time. Team Orion had made updates to the feature without conducting research, during the last Program Increment (PI). They were left wondering how those changes fared with customers, and where the team should look next. I was charged with answering these questions.

Six customers from five organizations, participated in the usability study.

"Where's the search at?"

"If I told my analyst to run this query, he'd get lost and stuck in the headers."