Get started with XQL queries

Get started with XQL queries in Cortex AgentiX.

Before you begin running XQL queries, do the following:

• Use the interface to help you build queries

  Cortex AgentiX offers features in the XQL search interface to help you build queries.
• Mitigate long-running queries

  Querying the XDM enables searching of Cortex AgentiX's extensive data. We recommend that you use filters to streamline your queries.
• Understand query defaults and limitations

  Before you run a query, review this list to better understand query behavior and results.
• Translate Splunk queries to XQL

  If you have existing Splunk queries, you can translate them to XQL.

Tip

If you are new to creating queries, you can also try our simple search templates, which can help you get started in understanding how queries work. See Get started with Query Builder templates. For more information, see How to build XQL queries.