> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cloud-xql/build-xql-queries/manage-your-query-library.md).
# Manage your query library
Cortex Cloud provides a Query Library for saving and managing your custom Cortex Query Language (XQL) queries. When creating a query in XQL or managing your queries from the Query Center, you can save them in the Query Library.
The Query Library contains a powerful search mechanism that enables you to search in any field related to the query, such as the query name, description, creator, query text, and labels. In addition, adding a label to your query enables you to search for these queries using these labels in the Query Library.
How to add a query to your query library
{% hint style="info" %}
### Note
The **Query to Library** option is only available if your role has the **Create Queries** capability. For more information, see Manage access to saved queries.
{% endhint %}
1. Save a query to your query library.
* **From the Query Builder**
1. Select **Investigation & Response** → **Search** → **Query Builder** → **XQL**.
2. Define the parameters of your query.
3. Select **Save as** → **Query to Library**.
* **From the Query Center**
1. Select **Investigation & Response** → **Search** → **Query Center**.
2. Under **Query History**, locate the query that you want to save.
3. Right-click anywhere in the query row, and select **Save query to library**.
2. Set the query parameters.
* **Query Name**: Specify a unique name for the query. Query names must be unique in both private and shared lists, which includes other people’s queries.
* **Query Description** (Optional): Specify a descriptive summary.
* **Labels** (Optional): Assign labels to categorize your query for faster filtering. You can select a label from the list of predefined labels or add your label and then select **Create Label**. Adding a label to your query enables you to search for queries using this label in the Query Library.
3. Click **Save**.
The query is now listed in the Query Library as a **Restricted** query (visible only to you). To make the query available to other users, user groups, or API keys, you must configure its sharing settings.
Managing your queries
{% hint style="info" %}
### Important
The ability to create, edit, or share queries is governed by access management. If certain options are unavailable, contact your administrator. For more information, see Manage access to saved queries.
{% endhint %}
The visibility of saved queries in the Query Library is determined by access management. You can manage who can view (and run) or edit your queries by sharing them with specific users, user groups, or API keys. You can also view queries created and shared by others in your organization if they have granted you access or marked the query as **Public**.
The following icons in the Query Library table help you identify the sharing status of each query:
* : Identifies **Restricted** queries you created that have not been shared.
* : Identifies queries you created that are currently shared with others.
* : Identifies queries created by another user that have been shared with you.
* : Identifies out-of-the-box (OOTB) system queries provided by Palo Alto Networks.
Use the following tools and the vertical ellipsis (⋮) menu to manage your saved queries:
* **Search and filter**: Use the search field to find queries by metadata or content. Use the **Show** menu to filter by **Owned by Me**, **Owned by Others**, or **Palo Alto Networks**.
* **Save as new**: Duplicate a query using the vertical ellipsis (⋮) menu.
* **Share**/**Manage Access**: Once a query is saved to the library, the Owner (or an authorized Editor) can manage who else can interact with it using the vertical ellipsis (⋮) menu. The specific option available (**Share** or **Manage Access**) is determined by tenant-level settings.
* **Change owner**: Administrators can use the vertical ellipsis (⋮) menu to change the query owner to a different user.
* **Delete**: You can only delete queries that you Own. Palo Alto Networks system queries cannot be deleted.
Manage access to saved queries
Once a query is saved to the library, the Owner (or an authorized Editor) can manage who else can interact with it. The options available depend on the tenant-level settings configured by your administrator.
1. In the **Query Library** tab, locate the query you want to share in the table.
2. Click the three dot, vertical ellipsis (⋮) and select the available action:
* **Share**: This option appears when **Owners can Share objects they created** is enabled in tenant-level settings. It allows you to manage both **General access** and specific principals (users, user groups, and API keys).
* **Manage Access**: This option appears when **Owners can Share objects they created** is disabled in tenant-level settings. It only allows you to change the **General access** state.
3. (If sharing is enabled) To share with specific entities:
* Search for the User, User Group, or API Key.
* Assign the access level: **Viewer** (can run/view) or **Editor** (can modify and, if permitted by tenant-level settings, share).
4. Set the **General access** drop-down menu (if authorized by tenant-level settings):
* **Restricted**: The query is private. It is only visible to the Owner and the specific principals added to the list.
* **Public**: The query is visible to every user who has the Query Library enabled in their role.
Note
When the tenant-level setting Owners and editors can change the general access is unselected, the drop-down is disabled and only an administrator can configure this option.
5. Click **Save**.
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cloud-xql/build-xql-queries/manage-your-query-library.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.