Query case and issue data

Query case and issue data for investigation and reporting.

Cortex Cloud uses Cortex Query Language (XQL) as the primary language for searching, analyzing, and transforming security data. XQL allows for highly efficient querying across vast amounts of security telemetry, such as:

• Threat hunting: Proactively search for malicious activity, anomalies, and indicators of compromise.
• Investigation: Drill into underlying data, affected assets, and attacker actions.
• Forensics: Extract event details for post-incident analysis and compliance audits.
• Reports and dashboards: Visualize security posture and communicate insights to stakeholders.

To use sample investigative queries, go to Investigation & Response → Search → Query Builder → XQL → Query Library. For more information, see Cortex Cloud XQL.

You can query case and issue data in the cases and issues datasets. When using the issues dataset, keep in mind the following:

• Informational issues are not included in this dataset.

The issues dataset is categorized by domain. To query only security issues, run:

dataset = issues | filter issue_domain = "SECURITY"

To query only posture issues, run:

dataset = issues | filter issue_domain = "POSTURE"