About the Query Builder

The Query Builder facilitates threat detection, case expansion, and data analytics for suspected threats.

The Query Builder aids in the detection of threats by allowing you to search for indicators of compromise and suspicious patterns within data sources. It assists in expanding case investigations by identifying related events and entities, such as activities associated with specific user accounts or network lateral movement. In addition, the Query Builder enables data analytics on suspected threats, helping organizations analyze large volumes of data to identify trends, anomalies, and correlations that may indicate potential security issues. The Query Builder also provides an interactive and visually intuitive way for you to search assets and findings by their relationship types and map them out in real-time.

To support investigation and analysis, you can search all of the data ingested by Cortex Cloud by creating queries in the Query Builder. You can create queries that investigate leads, expose the root cause of an issue, perform damage assessment, and hunt for threats from your data sources.

Cortex Cloud provides different options in the Query Builder for creating queries:

• XQL (Build your own queries)

  You can use the Cortex Query Language (XQL) to build complex and flexible queries that search specific datasets or presets, or the entire xdr_data dataset. With XQL Search, you create queries based on stages, functions, and operators. To help you build your queries, Cortex Cloud provides tools in the interface that provide suggestions as you type, or you can look up predefined queries, common stages and examples. For more information, see How to build XQL queries.

  Note

  Schema changes to datasets may not be reflected in the autocomplete suggestions and definitions as you type in real time the XQL query, and can appear with a slight delay.

  Tip

  When creating XQL queries, you can:

  • Use the up and down arrow keys to navigate through the auto-suggestion commands and definitions.
  • Select an auto-suggestion command by pressing either the Enter or Tab key.
  • Press Shift+Enter to add a new line, and easily ignore the auto-suggestion output.
  • Close the auto-suggestion output by pressing the Esc key.
• Predefined queries for different types of entities
• Graph Search to build queries to search assets, findings, and their contextual data. For more information, see How to build Graph Search queries?.