@ashvin unfortunately it does not, at least not for on-demand type queries. It can be run without a central server for regularly scheduled queries, for things you know you always want to look at, and its quite good at that too, but for something like security orchestration, you need the ability to either run the queries on-demand, or already have the data in your logs from your regularly scheduled queries and just search that data. Hope that helps!