...
When you are done writing your SQL click OK. If your sql is valid, the window will close, or take you to a sample SQL output (which may be a blank result set, because in this mini return environment, it is time boxed to the last hour or less).
Be sure to click SAVE in the upper left when you are done editing your query. If you don't, navigating to another part of ArcSight will wipe out your edits.
Parameters
Parameters allow you to execute different bits of SQL at report run time. This "dynamic sql" is very powerful. The user can select options from a dropdown list, and the query will execute whatever SQL associated with the selected option.
...