> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cloud-xql/get-started-with-xql/xql-language-structure.md).

# XQL Language Structure

Cortex Query Language (XQL) queries usually begin by defining a data source, be it a dataset or a preset. After that, you use zero or more stages to form the XQL query. Each stage is delimited using a pipe (|). The function performed by each stage is identified by the stage keyword that you provide.

{% hint style="info" %}

### Note

Specifying a dataset is not required because Cortex Cloud uses `xdr_data` as the default dataset. If you have more than one dataset or lookup, you can change your default dataset by navigating to **Settings** → **Configurations** → **Data Management** → **Dataset Management**, right-click on the appropriate dataset, and select **Set as default**.
{% endhint %}

In the simplest case, you can specify a dataset using one of the following formats.

* Hot Storage queries are performed on a dataset using the format `dataset = <dataset name>`. This is the default option.

  ```programlisting
  dataset = xdr_data
  ```
* Cold Storage queries are performed using the format `cold_dataset = <dataset name>`.

  ```programlisting
  cold_dataset = xdr_data
  ```

{% hint style="info" %}

### Note

You can also build a query that investigates data in both a cold dataset and hot dataset in the same query. In addition, as the hot storage dataset format is the default option and represents the fully searchable storage, this format is used throughout this guide. For more information on hot and cold storage, see [Dataset management](/cortex-cloud-posture-management/data-management/dataset-management.md).
{% endhint %}

When using the hot storage default format, this returns every `xdr_data` record contained in your Cortex Cloud instance over the time range that you provide to the Query Builder user interface. This can be a large amount of data, which might take a long time to retrieve. You can use a `limit` stage to specify how many records you want to retrieve.

```programlisting
dataset = xdr_data | limit 5
```

The records resulting from this query, or the result set, are returned in unsorted order. Every time you run the query, it will probably return a different set of records in no specific order. To create a predictable result set, use other stages to define sort order, filter the result set to identify exactly what records you want returned, to create fields containing aggregations, and more.

There is no practical limit to the number of stages that you can specify. See Stages for information on all the supported stages.

In the `xdr_data` dataset, every user field included in the raw data, for network, authentication, and login events, has an equivalent normalized user field associated with it that displays the user information in the following standardized format:

`<company domain>\<username>`

For example, the `login_data` field has the `login_data_dst_normalized_user` field to display the content in the standardized format. We recommend that you use these `normalized_user` fields when building your queries to ensure the most accurate results.

**Adding comments in queries**

You can add comments in any section when building a query in Cortex Query Language (XQL).

* Comments are added on a single line using the following syntax.

  ```programlisting
   //<comments>
  ```

  For example,

  ```programlisting
  dataset = xdr_data
  | filter event_type=1
  //ENUM.process
  and event_sub_type = 1
  //ENUM.execution
  ```
* To write a comment that extends over multiple lines use the following syntax.

  ```programlisting
  /*multi-line <comments> */
  ```

  For example,

  ```programlisting
  dataset = xdr_data 
  | filter 
  /*multi-line Adding comments is a great thing.
  Here is an example */ 
  event_type=1
  ```


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cloud-xql/get-started-with-xql/xql-language-structure.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.