> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-agentix/reference-and-developer-docs/cortex-agentix-xql/build-xql-queries/query-builder-templates/create-a-query-from-a-template.md). # Create a query from a template You can use the Query Builder templates to create effective queries without using the Cortex Query Language (XQL). Review the following topics: * [Query Builder templates](/cortex-agentix/reference-and-developer-docs/cortex-agentix-xql/build-xql-queries/query-builder-templates.md) * [Get started with Query Builder templates](/cortex-agentix/reference-and-developer-docs/cortex-agentix-xql/build-xql-queries/query-builder-templates/get-started-with-query-builder-templates.md) * [Considerations for using Query Builder templates](/cortex-agentix/reference-and-developer-docs/cortex-agentix-xql/build-xql-queries/query-builder-templates/considerations-for-using-query-builder-templates.md) How to create a query from a Query Builder template 1. Select **Investigation & Response** → **Search** → **Query Builder**. 2. In the Query Builder, select the template that you want to use. If you want to use the Free Text Search template, see [Run a free text query](/cortex-agentix/reference-and-developer-docs/cortex-agentix-xql/build-xql-queries/query-builder-templates/run-a-free-text-query.md). 3. (Optional) Change the **Run on** option (upper-right corner) that controls the datasets configured to run with the template. The templates are automatically configured to run on default datasets or you can choose to run them on all datasets. The templates run on the following datasets by default: * **Basic**, **Identity**, **Endpoint**, and **Network** templates: `xdr_data` * **Cloud** template: `cloud_audit_logs` 4. Enter values for any of the predefined fields and specify whether to include **Empty values** in the query.
Guidelines * The query uses an AND operator between the filtering fields. * Separate multiple values with pipes and do not add spaces between the value and the pipe. * Some of the filtering fields are aliases and therefore search all fields that are associated with the alias. * You can run an empty template with no values specified. The query results will show data from all of the fields in the template specific fieldset. For more information about using the filtering fields, operators, and including **Empty values**, see [Considerations for using Query Builder templates](/cortex-agentix/reference-and-developer-docs/cortex-agentix-xql/build-xql-queries/query-builder-templates/considerations-for-using-query-builder-templates.md).
5\. (Optional) Click **Add Field** and select the additional filtering fields or aliases to include in the query." {% hint style="info" %} ### Note * Field names and aliases are listed without their prefix, for example **xdm.SOURCE.USER.USERNAME** is listed as **SOURCE.USER.USERNAME** and **XDM\_ALIAS.ipv4** is listed as **ipv4**. * Fields that are already included in the query template are shown as grayed out. * In the Identity and Network templates, `xdm.event.outcome` shows as grayed out. In these templates, the **ACTION STATUS** and **CONNECTION STATUS** fields are linked to the `xdm.event.outcome` enum. Therefore, you can't duplicate this field in a query. {% endhint %} 6\. Click **TIME** and select a time frame for the query. 7. Click **Run** to start the query, or click **Schedule** to run the query at a specific time. You can also click **Continue in XQL** to open the XQL Query Builder showing the defined XQL fields. In XQL you have the flexibility to add additional stages and functions that are not available in the Query Builder templates. 8. Review the **Results**. The search is limited to 1,000 results. In the **Fields** column, you can see all of the fields that were included in the query in the following order: (1) **\_time**, (2) the filtering fields that you defined, and (3) the fields from the template specific fieldset.

Note

This order might change if you include a filtering field that is listed in the fieldset. In that case, the field is taken out of the fieldset and ordered at the top of the list with the other filtering fields.

The query is also saved in the Query Center. In the Query Center, you can identify your query by filtering the **Created By** column and looking in the **Query Description** column. Queries created from a template are prefixed with the template name. Example * The following query searches for instances of IP 3.3.3.3 with a source host name equal to host1 or host2. IP is an alias field; therefore, the query searches all fields associated with the alias. ```programlisting IP ADDRESS = 3.3.3.3, SOURCE.HOST.OS = host1|host2 ``` * The following query searches for the event outcome success with an event duration value that is not equal to null: ```programlisting EVENT.OUTCOME = XDM_CONST.OUTCOME_SUCCESS, EVENT.DURATION != Empty values ``` **What to do next** * To edit or rerun the query, click **Back to edit** to review the template, or **Continue in XQL** to review the XQL. * Practice running queries with [Query Builder template examples](/cortex-agentix/reference-and-developer-docs/cortex-agentix-xql/build-xql-queries/query-builder-templates/query-builder-template-examples.md). --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://cortex-docs.paloaltonetworks.com/cortex-agentix/reference-and-developer-docs/cortex-agentix-xql/build-xql-queries/query-builder-templates/create-a-query-from-a-template.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.