Get started with Query Builder templates

Get started with Query Builder templates in Cortex AgentiX.

Before you start running queries with Query Builder templates, do the following:

• Learn about the templates: Although the templates don’t require XQL knowledge, they do require knowledge of operators and other factors. Understanding how the templates work will help you to build effective queries. For more information, see Considerations for using Query Builder templates.

• Look up field and alias descriptions: The templates are based on the fields and aliases in the Cortex Data Model (XDM). For more information about a field or alias, see the Cortex XSIAM Data Model Schema Guide.