> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-agentix/reference-and-developer-docs.md). # Reference and Developer Docs - [Cortex AgentiX XQL](https://cortex-docs.paloaltonetworks.com/cortex-agentix/reference-and-developer-docs/cortex-agentix-xql.md): Learn to query security data with XQL in Cortex AgentiX. - [Get started with XQL](https://cortex-docs.paloaltonetworks.com/cortex-agentix/reference-and-developer-docs/cortex-agentix-xql/get-started-with-xql.md): Get started with Cortex Query Language (XQL) in Cortex AgentiX. - [XQL language features](https://cortex-docs.paloaltonetworks.com/cortex-agentix/reference-and-developer-docs/cortex-agentix-xql/get-started-with-xql/xql-language-features.md): Explore Cortex Query Language features for security data in Cortex AgentiX. - [XQL Language Structure](https://cortex-docs.paloaltonetworks.com/cortex-agentix/reference-and-developer-docs/cortex-agentix-xql/get-started-with-xql/xql-language-structure.md): Understand Cortex Query Language query structure in Cortex AgentiX. - [Adding comments in queries](https://cortex-docs.paloaltonetworks.com/cortex-agentix/reference-and-developer-docs/cortex-agentix-xql/get-started-with-xql/xql-language-structure/adding-comments-in-queries.md): Add comments to XQL queries in Cortex AgentiX. - [Supported operators](https://cortex-docs.paloaltonetworks.com/cortex-agentix/reference-and-developer-docs/cortex-agentix-xql/get-started-with-xql/supported-operators.md): Use supported XQL comparison, Boolean, and set operators in Cortex AgentiX. - [Datasets and presets](https://cortex-docs.paloaltonetworks.com/cortex-agentix/reference-and-developer-docs/cortex-agentix-xql/get-started-with-xql/datasets-and-presets.md): Use XQL datasets and presets to query security data in Cortex AgentiX. - [About examples](https://cortex-docs.paloaltonetworks.com/cortex-agentix/reference-and-developer-docs/cortex-agentix-xql/get-started-with-xql/about-examples.md): Explore XQL query examples for Cortex AgentiX. - [JSON functions](https://cortex-docs.paloaltonetworks.com/cortex-agentix/reference-and-developer-docs/cortex-agentix-xql/get-started-with-xql/json-functions.md): Use JSON functions in XQL queries in Cortex AgentiX. - [How to filter for empty values in the results table](https://cortex-docs.paloaltonetworks.com/cortex-agentix/reference-and-developer-docs/cortex-agentix-xql/get-started-with-xql/how-to-filter-for-empty-values-in-the-results-table.md): Filter empty values in XQL query results in Cortex AgentiX. - [Understanding string manipulation in XQL](https://cortex-docs.paloaltonetworks.com/cortex-agentix/reference-and-developer-docs/cortex-agentix-xql/get-started-with-xql/understanding-string-manipulation-in-xql.md): Use string manipulation in XQL queries in Cortex AgentiX. - [Build XQL queries](https://cortex-docs.paloaltonetworks.com/cortex-agentix/reference-and-developer-docs/cortex-agentix-xql/build-xql-queries.md): Build and run XQL queries with Query Builder in Cortex AgentiX. - [About the Query Builder](https://cortex-docs.paloaltonetworks.com/cortex-agentix/reference-and-developer-docs/cortex-agentix-xql/build-xql-queries/about-the-query-builder.md): Use Query Builder for XQL threat detection and analysis in Cortex AgentiX. - [How to build XQL queries](https://cortex-docs.paloaltonetworks.com/cortex-agentix/reference-and-developer-docs/cortex-agentix-xql/build-xql-queries/how-to-build-xql-queries.md): Build XQL queries with Query Builder in Cortex AgentiX. - [Get started with XQL queries](https://cortex-docs.paloaltonetworks.com/cortex-agentix/reference-and-developer-docs/cortex-agentix-xql/build-xql-queries/how-to-build-xql-queries/get-started-with-xql-queries.md): Get started with XQL queries in Cortex AgentiX. - [Useful XQL user interface features](https://cortex-docs.paloaltonetworks.com/cortex-agentix/reference-and-developer-docs/cortex-agentix-xql/build-xql-queries/how-to-build-xql-queries/useful-xql-user-interface-features.md): Use XQL query interface features in Cortex AgentiX. - [XQL Query best practices](https://cortex-docs.paloaltonetworks.com/cortex-agentix/reference-and-developer-docs/cortex-agentix-xql/build-xql-queries/how-to-build-xql-queries/xql-query-best-practices.md): Apply XQL query best practices in Cortex AgentiX. - [Expected results when querying fields](https://cortex-docs.paloaltonetworks.com/cortex-agentix/reference-and-developer-docs/cortex-agentix-xql/build-xql-queries/how-to-build-xql-queries/expected-results-when-querying-fields.md): Understand expected field query results in Cortex AgentiX. - [Create XQL query](https://cortex-docs.paloaltonetworks.com/cortex-agentix/reference-and-developer-docs/cortex-agentix-xql/build-xql-queries/how-to-build-xql-queries/create-xql-query.md): Create XQL queries in Cortex AgentiX. - [Review XQL query results](https://cortex-docs.paloaltonetworks.com/cortex-agentix/reference-and-developer-docs/cortex-agentix-xql/build-xql-queries/how-to-build-xql-queries/review-xql-query-results.md): Review XQL query results in Cortex AgentiX. - [Translate to XQL](https://cortex-docs.paloaltonetworks.com/cortex-agentix/reference-and-developer-docs/cortex-agentix-xql/build-xql-queries/how-to-build-xql-queries/translate-to-xql.md): Translate natural-language requests into XQL in Cortex AgentiX. - [Graph query results](https://cortex-docs.paloaltonetworks.com/cortex-agentix/reference-and-developer-docs/cortex-agentix-xql/build-xql-queries/how-to-build-xql-queries/graph-query-results.md): Graph XQL query results in Cortex AgentiX. - [Query Builder templates](https://cortex-docs.paloaltonetworks.com/cortex-agentix/reference-and-developer-docs/cortex-agentix-xql/build-xql-queries/query-builder-templates.md): Use Query Builder templates to query security data in Cortex AgentiX. - [Get started with Query Builder templates](https://cortex-docs.paloaltonetworks.com/cortex-agentix/reference-and-developer-docs/cortex-agentix-xql/build-xql-queries/query-builder-templates/get-started-with-query-builder-templates.md): Get started with Query Builder templates in Cortex AgentiX. - [Considerations for using Query Builder templates](https://cortex-docs.paloaltonetworks.com/cortex-agentix/reference-and-developer-docs/cortex-agentix-xql/build-xql-queries/query-builder-templates/considerations-for-using-query-builder-templates.md): Review Query Builder template considerations in Cortex AgentiX. - [Create a query from a template](https://cortex-docs.paloaltonetworks.com/cortex-agentix/reference-and-developer-docs/cortex-agentix-xql/build-xql-queries/query-builder-templates/create-a-query-from-a-template.md): Create queries from Query Builder templates in Cortex AgentiX. - [Run a free text query](https://cortex-docs.paloaltonetworks.com/cortex-agentix/reference-and-developer-docs/cortex-agentix-xql/build-xql-queries/query-builder-templates/run-a-free-text-query.md): Run free-text queries with Query Builder in Cortex AgentiX. - [Query Builder template examples](https://cortex-docs.paloaltonetworks.com/cortex-agentix/reference-and-developer-docs/cortex-agentix-xql/build-xql-queries/query-builder-templates/query-builder-template-examples.md): Explore Query Builder template examples in Cortex AgentiX. - [Overview of the Query Center](https://cortex-docs.paloaltonetworks.com/cortex-agentix/reference-and-developer-docs/cortex-agentix-xql/build-xql-queries/overview-of-the-query-center.md): Monitor in-progress and completed XQL queries in Query Center in Cortex AgentiX. - [Edit and run queries in Query Center](https://cortex-docs.paloaltonetworks.com/cortex-agentix/reference-and-developer-docs/cortex-agentix-xql/build-xql-queries/overview-of-the-query-center/edit-and-run-queries-in-query-center.md): Edit and run XQL queries in Query Center in Cortex AgentiX. - [Query Center reference information](https://cortex-docs.paloaltonetworks.com/cortex-agentix/reference-and-developer-docs/cortex-agentix-xql/build-xql-queries/overview-of-the-query-center/edit-and-run-queries-in-query-center/query-center-reference-information.md): Reference Query Center features and XQL query controls in Cortex AgentiX. - [Manage scheduled queries](https://cortex-docs.paloaltonetworks.com/cortex-agentix/reference-and-developer-docs/cortex-agentix-xql/build-xql-queries/manage-scheduled-queries.md): Manage scheduled and recurring XQL queries in Cortex AgentiX. - [Scheduled Queries reference information](https://cortex-docs.paloaltonetworks.com/cortex-agentix/reference-and-developer-docs/cortex-agentix-xql/build-xql-queries/manage-scheduled-queries/scheduled-queries-reference-information.md): Reference scheduled XQL query settings in Cortex AgentiX. - [Manage your personal query library](https://cortex-docs.paloaltonetworks.com/cortex-agentix/reference-and-developer-docs/cortex-agentix-xql/build-xql-queries/manage-your-personal-query-library.md): Save and manage personal XQL queries in Cortex AgentiX Query Library. - [XQL macros](https://cortex-docs.paloaltonetworks.com/cortex-agentix/reference-and-developer-docs/cortex-agentix-xql/build-xql-queries/xql-macros.md): Use XQL macros to reuse query logic in Cortex AgentiX. - [Manage your macros](https://cortex-docs.paloaltonetworks.com/cortex-agentix/reference-and-developer-docs/cortex-agentix-xql/build-xql-queries/manage-your-macros.md): Create and manage XQL macros in Cortex AgentiX. - [Legacy Query Builder](https://cortex-docs.paloaltonetworks.com/cortex-agentix/reference-and-developer-docs/cortex-agentix-xql/build-xql-queries/legacy-query-builder.md): Use the Legacy Query Builder for entity queries in Cortex AgentiX. - [Create authentication query](https://cortex-docs.paloaltonetworks.com/cortex-agentix/reference-and-developer-docs/cortex-agentix-xql/build-xql-queries/legacy-query-builder/create-authentication-query.md): Create authentication queries with Legacy Query Builder in Cortex AgentiX. - [Create event log query](https://cortex-docs.paloaltonetworks.com/cortex-agentix/reference-and-developer-docs/cortex-agentix-xql/build-xql-queries/legacy-query-builder/create-event-log-query.md): Create event log queries with Legacy Query Builder in Cortex AgentiX. - [Create file query](https://cortex-docs.paloaltonetworks.com/cortex-agentix/reference-and-developer-docs/cortex-agentix-xql/build-xql-queries/legacy-query-builder/create-file-query.md): Create file queries with Legacy Query Builder in Cortex AgentiX. - [Create image load query](https://cortex-docs.paloaltonetworks.com/cortex-agentix/reference-and-developer-docs/cortex-agentix-xql/build-xql-queries/legacy-query-builder/create-image-load-query.md): Create image load queries with Legacy Query Builder in Cortex AgentiX. - [Create network connections query](https://cortex-docs.paloaltonetworks.com/cortex-agentix/reference-and-developer-docs/cortex-agentix-xql/build-xql-queries/legacy-query-builder/create-network-connections-query.md): Create network connection queries with Legacy Query Builder in Cortex AgentiX. - [Create network query](https://cortex-docs.paloaltonetworks.com/cortex-agentix/reference-and-developer-docs/cortex-agentix-xql/build-xql-queries/legacy-query-builder/create-network-query.md): Create network queries with Legacy Query Builder in Cortex AgentiX. - [Create process query](https://cortex-docs.paloaltonetworks.com/cortex-agentix/reference-and-developer-docs/cortex-agentix-xql/build-xql-queries/legacy-query-builder/create-process-query.md): Create process queries with Legacy Query Builder in Cortex AgentiX. - [Create registry query](https://cortex-docs.paloaltonetworks.com/cortex-agentix/reference-and-developer-docs/cortex-agentix-xql/build-xql-queries/legacy-query-builder/create-registry-query.md): Create registry queries with Legacy Query Builder in Cortex AgentiX. - [Query across all entities](https://cortex-docs.paloaltonetworks.com/cortex-agentix/reference-and-developer-docs/cortex-agentix-xql/build-xql-queries/legacy-query-builder/query-across-all-entities.md): Query across all entities with Legacy Query Builder in Cortex AgentiX. - [Cortex XQL syntax, parameters, and examples](https://cortex-docs.paloaltonetworks.com/cortex-agentix/reference-and-developer-docs/cortex-agentix-xql/cortex-xql-syntax-parameters-and-examples.md): Reference XQL syntax, parameters, and query examples in Cortex AgentiX. - [Troubleshoot](https://cortex-docs.paloaltonetworks.com/cortex-agentix/reference-and-developer-docs/troubleshoot.md): Learn how to troubleshoot Cortex AgentiX, such as sending audit notifications to a Syslog Server. - [About health issues](https://cortex-docs.paloaltonetworks.com/cortex-agentix/reference-and-developer-docs/troubleshoot/about-health-issues.md): Monitor Cortex AgentiX health issues for data ingestion, collection, correlation, and event forwarding. - [Monitor data ingestion health](https://cortex-docs.paloaltonetworks.com/cortex-agentix/reference-and-developer-docs/troubleshoot/about-health-issues/monitor-data-ingestion-health.md): Monitor data ingestion health and identify issues in Cortex AgentiX. - [Monitor correlation rules](https://cortex-docs.paloaltonetworks.com/cortex-agentix/reference-and-developer-docs/troubleshoot/about-health-issues/monitor-correlation-rules.md): Monitor correlation rule execution and health in Cortex AgentiX. - [Investigate and resolve health issues](https://cortex-docs.paloaltonetworks.com/cortex-agentix/reference-and-developer-docs/troubleshoot/about-health-issues/investigate-and-resolve-health-issues.md): Investigate and resolve health issues in Cortex AgentiX. - [In-product support ticket creation](https://cortex-docs.paloaltonetworks.com/cortex-agentix/reference-and-developer-docs/troubleshoot/in-product-support-case-creation.md): Open a support ticket directly in Cortex AgentiX and record your console to capture your issues and have the ticket handled efficiently. - [Reference](https://cortex-docs.paloaltonetworks.com/cortex-agentix/reference-and-developer-docs/reference.md): Access Cortex AgentiX API documentation, reference resources, and fair usage policy information. - [Cortex AgentiX API](https://cortex-docs.paloaltonetworks.com/cortex-agentix/reference-and-developer-docs/reference/cortex-agentix-api.md): Generate API keys and make API calls in Cortex AgentiX. - [Fair Usage policy for Cortex AgentiX](https://cortex-docs.paloaltonetworks.com/cortex-agentix/reference-and-developer-docs/reference/fair-usage-policy-for-cortex-agentix.md): Understand the fair usage policy for Cortex AgentiX services and capabilities. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://cortex-docs.paloaltonetworks.com/cortex-agentix/reference-and-developer-docs.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.