diff --git a/docs/1-Using-Fleet/tutorials/Ask-questions-about-your-devices.md b/docs/1-Using-Fleet/tutorials/Ask-questions-about-your-devices.md
index fd41b241fe..978d22217d 100644
--- a/docs/1-Using-Fleet/tutorials/Ask-questions-about-your-devices.md
+++ b/docs/1-Using-Fleet/tutorials/Ask-questions-about-your-devices.md
@@ -50,6 +50,8 @@ fleetctl apply -f standard-query-library.yml
Success! Now, refresh the **Queries** page in the Fleet, and the "Queries" table will be populated with Fleet's standard query library.
+
+
### Asking questions by running queries
Let's ask the following questions about the simulated Linux hosts connected to your Fleet:
@@ -62,13 +64,20 @@ These questions can easily be answered with Fleet, by running the following quer
On the **Queries** page, enter the query name, "Detect Linux hosts with high severity vulnerable versions of OpenSSL," in the search bar, and select it from the table to navigate to the **Edit or run query** page.
+
+
On the **Edit or run query** page, open the "Select targets" dropdown, and press the purple "+" icon to the right of "All hosts." This means we'll be attempting to run this query against all hosts connected to your Fleet.
+
+
Now hit the "Run" button to run the query, and you're done. The query may take several seconds to complete because Fleet has to wait for the osquery agents to respond with results.
> Fleet's query response time is inherently variable because of osquery's heartbeat response time. This helps prevent performance issues on hosts.
When the query has finished, you should see 4 columns and several rows in the "Results" table:
+
+
+
- The "hostname" column answers: which device responded for a given row of results?
- The "name" column answers: what is the name of the installed software item? The query we just ran asked for all software items that contain "openssl" in their name, so each row in this column should contain "openssl."
@@ -104,4 +113,3 @@ Now you have the results from your query, you can compare the results from the "
| 1.0.1-1.0.1h | [CVE-2014-3511](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3511) |
Do any of the simulated, Linux hosts have a high severity vulnerable version of OpenSSL installed? If the answer is yes, don't worry. The devices are running in a simulated Docker environment and do not provide any additional vectors for performing malicious actions against your device.
-