> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/build-xql-queries/manage-your-macros.md).

# Manage your macros

Save and manage your XQL macros in the Macro Library under **Investigations & Response -> XQL Search**. You can create, edit, share, and delete macros using the same workflows available for saved queries.

## Macro visibility and access

The visibility of saved macros in the Macro Library is governed by RBAC (Role-Based Access Control) and SBAC (Scope-Based Access Control). You can manage who can view (and run) or edit your queries by sharing them with specific users, user groups, or API keys. You can also view queries created and shared by others in your organization if they have granted you access or marked the query as Public.

* **Private macros** are visible only to the creator.
* **Public macros** are available to all users with appropriate permissions.
* All access changes are recorded in the management audit log.
* You can have up to 200 macros in your macro library.

## Add a macro to your macro library

1. In the **Query Builder**, write the XQL code snippet you want to save as a macro. Highlight the XQL code you want to save as a macro, right-click it, and select **Save as Macro to Library**.
2. In the dialog, provide the following details:
   * **Name** (required): A unique name for the macro. Macro names must be unique in both private and shared lists.
   * **Description** (optional): A description of what the macro does.
   * **Labels** (optional): Assign labels for organizing and filtering macros. You can select a label from the list of predefined labels or add your label and then select **Create Label**. Adding a label to your query enables you to search for queries using this label in the Query Library.
   * **Sharing**: Toggle to make the macro public (available to all users) or private.
3. Click **Save**.

Use the following tools and the vertical ellipsis (⋮) menu to manage your saved queries:

Search and filter: Use the search field to find queries by metadata or content. Use the **Show** menu to filter by Owned by Me, Owned by Others, or Palo Alto Networks.

Save as new: Duplicate a query using the vertical ellipsis (⋮) menu.

Share/Manage Access: After a query is saved to the library, the Owner (or an authorized Editor) can manage who else can interact with it using the vertical ellipsis (⋮) menu. The specific option available (Share or Manage Access) is determined by tenant-level settings.

Change owner: Administrators can use the vertical ellipsis (⋮) menu to change the query owner to a different user.

Delete: You can only delete queries that you own.

## Edit a macro

1. In the Macro library, click the macro to open it in the detail pane.
2. Modify the macro definition, name, description, or labels as needed.
3. Click **Save** to update the existing macro, or **Save as New** to create a copy.

**Note**: You can't edit a saved macro if it is referenced in other objects, for example other queries, widgets, dashboards, or scheduled correlation rules.

## Delete a macro

1. In the Macro library, right-click the macro or use the actions menu and select **Delete**.
2. Confirm the deletion.

**Note**: You can't delete a saved macro if it is referenced in other objects, for example other queries, widgets, dashboards, or scheduled correlation rules.

## Usage notes

* Macro names must be unique within the Macro Library.
* All macro modifications (create, edit, delete, access changes) are logged in the management audit log.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/build-xql-queries/manage-your-macros.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.