> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-agentix/reference-and-developer-docs/cortex-agentix-xql/build-xql-queries/how-to-build-xql-queries/create-xql-query.md). # Create XQL query Review the following topics: * [How to build XQL queries](/cortex-agentix/reference-and-developer-docs/cortex-agentix-xql/build-xql-queries/how-to-build-xql-queries.md) Build Cortex Query Language (XQL) queries to analyze raw log data stored in Cortex AgentiX. You can query the Cortex Data Model (XDM) or datasets using specific syntax.
How to create a XDM query 1. From Cortex AgentiX, select **Investigation & Response** → **Search** → **Query Builder**. 2. Click **XQL**. 3. *(Optional)* Change the default time period against which to run your query from the time picker at the top right of the window. You can select the required time period from any of the following options available: * Preset time ranges easily available to select from, such as **24 hours** and **30 days**. * Recently used selections from your previous queries. * **Relative time**: Define the time frame as the last \ minutes, days, or hours by setting the number. * **Calendar**: Create a customized time period by selecting the date range from the calendar and the specific **Start Time** and **End Time**.

Note

  • Whenever the time period is changed in the query window, the config timeframe is automatically set to the time period defined for the entire query, including queries that are part of the join stage. Yet, this won't be visible as part of the query. Only if you manually type in the config timeframe will this be seen in the query.
  • These time picker options are available in XQL queries when using the Query Builder, XQL Widgets, and when defining XQL Widgets in Reports and Dashboards.
4. *(Optional)* To translate Splunk queries to XQL queries, enable **Translate to XQL**. If you choose to use this feature, enter your Splunk query in the **Splunk** field, click the arrow icon to convert to XQL, and then go to Step 6. 5. Create your query by typing in the query field. Relevant commands, their definitions, and operators are suggested as you type.

Tip

When creating XQL queries, you can:

  • Use the up and down arrow keys to navigate through the auto-suggestion command suggestions and definitions.
  • Select an auto-suggestion command by pressing either the Enter or Tab key.
  • Press Shift+Enter to add a new line, and easily ignore the auto-suggestion output.
  • Close the auto-suggestion output by pressing the Esc key.
1. Specify the datasets to run your query against by typing either `datamodel dataset = ...` or `datamodel dataset in (,...)...`. For example: ```programlisting datamodel dataset in (amazon_aws_raw) ```

Note

While datamodel dataset=* is supported in the query, we recommend that you specify specific datasets for quicker and more efficient results.

2. Press Enter, and then type the pipe character (**`|`**). Select a stage, and complete the stage syntax using the suggested options. 3. Continue adding stages until your query is complete. For example: ```programlisting datamodel dataset in (amazon_aws_raw) | filter xdm.source.ipv4 = "10.9.165.1" | fields xdm.source.ipv4, xdm.source.port | limit 100 ``` 6. Choose when to run your query: * Run the query immediately. * Run the query by the specified date and time, or on a specific date, by selecting the calendar icon (![query-calendar-icon.png](/files/KjI3wq8OJJtrRCXI6EKi)). 7. *(Optional)* The Save As options save your query for future use: * **Correlation Rule**: When compatible, saves the query as a Correlation Rule. For more information, see [What's a correlation rule?](/cortex-agentix/configure-cortex-agentix/cases-and-issues-configuration/whats-a-correlation-rule.md). * **Query to Library**: Saves the query to your personal query library. For more information, see [Manage your personal query library](/cortex-agentix/reference-and-developer-docs/cortex-agentix-xql/build-xql-queries/manage-your-personal-query-library.md). * **Widget to Library**: For more information, see [Create XQL widgets](/cortex-agentix/detect-investigate-and-respond-to-threats/monitor-dashboards-and-reports/advanced-configuration/create-custom-widgets/create-xql-widgets.md). {% hint style="info" %} ### Tip While the query is running, you can navigate away from the page. A notification is sent when the query has finished. You can also **Cancel** the query or run a new query, where you have the option to **Run only new query (cancel previous)** or **Run both queries**. {% endhint %}
How to create a dataset query 1. From Cortex AgentiX, select **Investigation & Response** → **Search** → **Query Builder**. 2. Click **XQL**. 3. *(Optional)* Change the default time period against which to run your query from the time picker at the top right of the window. You can select the required **Timeframe** from any of the following options available: * Preset time ranges easily available to select from, such as **24 hours** and **30 days**. * Recently used selections from your previous queries. * **Relative time**: Define the time frame as the last \ minutes, days, or hours by setting the number. * **Calendar**: Create a customized time period by selecting the date range from the calendar and the specific **Start Time** and **End Time**.

Note

  • Whenever the time period is changed in the query window, the config timeframe is automatically set to the time period defined for the entire query, including queries that are part of the join stage. Yet, this won't be visible as part of the query. Only if you manually type in the config timeframe will this be seen in the query.
  • These time picker options are available in XQL queries when using the Query Builder, XQL Widgets, and when defining XQL Widgets in Reports and Dashboards.
4. *(Optional)* To translate Splunk queries to XQL queries, enable **Translate to XQL**. If you choose to use this feature, enter your Splunk query in the **Splunk** field, click the arrow icon (![translate-to-spl-arrow.png](/files/cpet74qPAlhAfuDiqiyP)) to convert to XQL, and then go to Step 6. 5. Create your query by typing in the query field. Relevant commands, their definitions, and operators are suggested as you type.

Tip

When creating XQL queries, you can:

  • Use the up and down arrow keys to navigate through the auto-suggestion command suggestions and definitions.
  • Select an auto-suggestion command by pressing either the Enter or Tab key.
  • Press Shift+Enter to add a new line, and easily ignore the auto-suggestion output.
  • Close the auto-suggestion output by pressing the Esc key.
1. (Optional) Specify a dataset. You only need to specify a dataset if you are running your query against a dataset that you have not set as default. Otherwise, the query runs against the **`xdr_data`** dataset. For more information, see [How to build XQL queries](/cortex-agentix/reference-and-developer-docs/cortex-agentix-xql/build-xql-queries/how-to-build-xql-queries.md). Example 91. ```programlisting dataset = xdr_data ``` 2. Press **Enter**, and then type the pipe character (**`|`**). Select a command, and complete the command using the suggested options. 3. Continue adding stages until your query is complete. Example 92. ```programlisting dataset = xdr_data | filter agent_os_type = ENUM.AGENT_OS_MAC | limit 250 ``` 6. Choose when to run your query: * Run the query immediately. * Run the query by the specified date and time, or on a specific date, by selecting the calendar icon (![query-calendar-icon.png](/files/KjI3wq8OJJtrRCXI6EKi)). 7. *(Optional)* The Save As options save your query for future use: * **BIOC Rule**: When compatible, saves the query as a BIOC rule. The XQL query must contain a filter for the **event\_type** field. * **Correlation Rule**: When compatible, saves the query as a Correlation Rule. For more information, see [What's a correlation rule?](/cortex-agentix/configure-cortex-agentix/cases-and-issues-configuration/whats-a-correlation-rule.md). * **Query to Library**: Saves the query to your personal query library. For more information, see [Manage your personal query library](/cortex-agentix/reference-and-developer-docs/cortex-agentix-xql/build-xql-queries/manage-your-personal-query-library.md). * **Widget to Library**: For more information, see [Create XQL widgets](/cortex-agentix/detect-investigate-and-respond-to-threats/monitor-dashboards-and-reports/advanced-configuration/create-custom-widgets/create-xql-widgets.md). {% hint style="info" %} ### Tip While the query is running, you can navigate away from the page. A notification is sent when the query has finished. You can also **Cancel** the query or run a new query, where you have the option to **Run only new query (cancel previous)** or **Run both queries**. {% endhint %}
--- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://cortex-docs.paloaltonetworks.com/cortex-agentix/reference-and-developer-docs/cortex-agentix-xql/build-xql-queries/how-to-build-xql-queries/create-xql-query.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.