XQL Query best practices

Apply best practices when writing XQL queries.

Cortex Cloud includes built-in mechanisms for mitigating long-running queries, such as default limits for the maximum number of allowed issues. The following suggestions can help you to streamline your queries:

• Add a smaller limit by using a limit stage.

  The default results for any query is a maximum of 1,000,000 results, when no limit is explicitly stated in the query. Queries based on XQL query entities are limited to 10,000 results. Adding a smaller limit can greatly reduce the response time.

  datamodel dataset = microsoft_windows_raw 
  | fields *host* 
  | limit 100

• Use a small Timeframe. Select Relative time and define Last 30 Minutes where possible.
• Use filters that exclude data, along with other applicable filters.
• Select only the fields required in the results.