> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-xql/build-xql-queries/how-to-build-xql-queries.md). # How to build XQL queries The Cortex Query Language (XQL) enables you to query data ingested into Cortex Cloud for rigorous endpoint and network event analysis returning up to 1M results. To help you create an effective XQL query with the proper syntax, the query field in the user interface provides suggestions and definitions as you type. XQL forms queries in stages. Each stage performs a specific query operation and is separated by a pipe character (|). Queries require a dataset, or data source, to run against. Unless otherwise specified, the query runs against the **`xdr_data`** dataset, which contains all log information that Cortex Cloud collects from all Cortex product agents, including EDR data, and PAN NGFW data. In XDM queries, you must specify the dataset mapped to the XDM that you want to run your query against. {% hint style="info" %} ### Important Forensic datasets are not inlcuded by default in XQL query results, unless the dataset query is explicitly defined to use a forensic dataset. {% endhint %}
Dataset query syntax In a dataset query, unless otherwise specified, the query runs against the `xdr_data` dataset, which contains all log information that Cortex Cloud collects from all Cortex product agents, including EDR data, and PAN NGFW data. In a dataset query, if you are running your query against a dataset that has been set as default, there is no need to specify a dataset. Otherwise, specify a dataset in your query. The Dataset Queries lists the available datasets, depending on system configuration. {% hint style="info" %} ### Note * Users with different dataset permissions can receive different results for the same XQL query. * An administrator or a user with a predefined user role can create and view queries built with an unknown dataset that currently does not exist in Cortex Cloud. All other users can only create and view queries built with an existing dataset. * When you have more than one dataset or lookup, you can change your default dataset by navigating to **Settings** → **Configurations** → **Data Management** → **Dataset Management**, right-click on the appropriate dataset, and select **Set as default**. For more information about setting default datasets, see [Dataset management](/cortex-xdr-3.x/cortex-xdr-3.x-documentation/data-management/dataset-management.md). {% endhint %} The basic syntax structure for querying datasets that are not mapped to the XDM is: ```programlisting dataset = | ... | ... | ... ``` or ```programlisting dataset in () | ... | ... | ... ``` You can specify a dataset using one of the following formats, which is based on the data retention offerings available in Cortex Cloud. * Hot Storage queries use the format `dataset = `. This is the default option. Example 188. ```programlisting dataset = xdr_data ``` * Cold Storage queries use the format `cold_dataset = `. Example 189. ```programlisting cold_dataset = xdr_data ```

Note

You can build a query that investigates data in both a cold dataset and a hot dataset in the same query. In addition, as the hot storage dataset format is the default option and represents the fully searchable storage, this format is used throughout this guide for investigation and threat hunting. For more information on hot and cold storage, see Dataset management.

When using the hot storage default format, this returns every `xdr_data` record contained in your Cortex Cloud instance over the time range that you provide to the Query Builder user interface. This can be a large amount of data, which may take a long time to retrieve. You can use a `limit` stage to specify how many records you want to retrieve. There is no practical limit to the number of stages that you can specify. See [Stages](/xql-command-reference-guide/readme/stages.md) for information on all the supported stages. In the `xdr_data` dataset, every user field included in the raw data for network, authentication, and login events has an equivalent normalized user field associated with it that displays the user information in the following standardized format: `\` For example, the `login_data` field has the `login_data_dst_normalized_user` field to display the content in the standardized format. To ensure the most accurate results, we recommend that you use these `normalized_user` fields when building your queries.
Additional components XQL queries can contain different components, such as functions and stages, depending on the type of query you want to build. For a complete list of the syntax options available with example queries, see [Stages](/xql-command-reference-guide/readme/stages.md) and [Functions](/xql-command-reference-guide/readme/functions/index.md).
**Get started with XQL queries** Before you begin running XQL queries, consider the following information: * Use the interface to help you build queries Cortex Cloud offers features in the XQL search interface to help you build queries. For more information, see [Useful XQL user interface features](/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/build-xql-queries.md). * Understand query defaults and limitations Before you run a query, review this list to better understand query behavior and results. For more information, see [Expected results when querying fields](/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/build-xql-queries.md). * Translate Splunk queries to XQL If you have existing Splunk queries, you can translate them to XQL. For more information, see [Translate to XQL](/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/build-xql-queries.md). **Useful XQL user interface features** The user interface contains several useful features for querying data, and for viewing results: * **XQL query**: The XQL query field is where you define the parameters of your query. To help you create an effective XQL query, the search field provides suggestions and definitions as you type.

Note

Schema changes to datasets may not be reflected in the autocomplete suggestions and definitions as you type in real time the XQL query and can appear with a slight delay.

Tip

When creating XQL queries, you can:

* **Translate to XQL**: Converts your existing Splunk queries to the XQL syntax. When you enable Translate to XQL , both an **SPL query** field and an **XQL query** field are displayed. You can easily add a Splunk query, which is converted automatically into XQL in the **XQL query** field. This option is disabled by default. * **Query Results**: After you create and run an XQL query, you can view, filter, and visualize your **Query Results**. * **XQL Helper**: Describes common stage commands and provides examples that you can use to build a query. * **Query Library**: Contains common, predefined queries that you can use or modify to your liking. In addition, there is a personal query library for saving and managing your own queries so that you can share with others, and queries can be shared with you. For more information, see [Manage the Graph Search Query Library](/cortex-cloud-runtime-security/graph-search/manage-the-graph-search-query-library.md). * **Schema**: Contains schema information for every field found in the result set. This information includes the field name, data type, descriptive text (if available), and the dataset that contains the field. Contains the list of all the fields of all the datasets that were involved in the query. **XQL Query best practices** Cortex Cloud includes built-in mechanisms for mitigating long-running queries, such as default limits for the maximum number of allowed issues. The following suggestions can help you to streamline your queries: * Add a smaller limit to queries by using a `limit` stage. The default results for any query is a maximum of 1,000,000 results, when no limit is explicitly stated in the query. Queries based on XQL query entities are limited to 10,000 results. Adding a smaller limit can greatly reduce the response time. Example 190. ```programlisting dataset = microsoft_windows_raw | fields *host* | limit 100 ``` * Use a small time frame for queries by specifying the specific date and time in the **Timeframe**, such as selecting **Relative time** and defining **Last 30 Minutes**, instead of picking the nearest larger option available or defining an extended time period. * Use filters that exclude data, along with other possible filters. * Select the specific fields that you would like to see in the query results. **Expected results when querying fields** The following are returned when querying fields: * If specific fields are stated in the [fields](/cortex-xdr-3.x/cortex-xdr-3.x-documentation/cortex-xdr-xql/stages/fields.md) stage, those exact fields will be returned. * The `_time` system field will not be added to queries that contain the `comp` stage. * All current system fields will be returned, even if they are not stated in the query. * Each new column in the result set created by the [alter](/xql-command-reference-guide/readme/stages/alter.md) stage will be added as the last column. You can specify a different column order by modifying the field order in the [fields](/cortex-xdr-3.x/cortex-xdr-3.x-documentation/cortex-xdr-xql/stages/fields.md) stage of the query. * Each new column in the result set created by the [comp](/cortex-xdr-3.x/cortex-xdr-3.x-documentation/cortex-xdr-xql/stages/comp.md) stage will be added as the last column. Other fields that are not in the `group by / calculated` column will be removed from the result set, including the core fields and `_time` system field. * When no limit is explicitly stated in a `datamodel` query, a maximum of 1,000,000 results are returned (default). When this limit is applied to results using the [limit](/xql-command-reference-guide/readme/stages/limit.md) stage, it will be indicated in the user interface. **Create XQL query** Review the following topics: * [How to build XQL queries](/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/build-xql-queries.md) Build Cortex Query Language (XQL) queries to analyze raw log data stored in Cortex Cloud. You can query datasets using specific syntax.
How to create a dataset query 1. From Cortex Cloud, select **Investigation & Response** → **Search** → **Query Builder**. 2. Click **XQL**. 3. *(Optional)* Change the default time period against which to run your query from the time picker at the top right of the window. You can select the required **Timeframe** from any of the following options available: * Preset time ranges easily available to select from, such as **24 hours** and **30 days**. * Recently used selections from your previous queries. * **Relative time**: Define the time frame as the last \ minutes, days, or hours by setting the number. * **Calendar**: Create a customized time period by selecting the date range from the calendar and the specific **Start Time** and **End Time**.

Note

  • Whenever the time period is changed in the query window, the config timeframe is automatically set to the time period defined for the entire query, including queries that are part of the join stage. Yet, this won't be visible as part of the query. Only if you manually type in the config timeframe will this be seen in the query.
  • These time picker options are available in XQL queries when using the Query Builder, XQL Widgets, and when defining XQL Widgets in Reports and Dashboards.
4. *(Optional)* To translate Splunk queries to XQL queries, enable **Translate to XQL**. If you choose to use this feature, enter your Splunk query in the **Splunk** field, click the arrow icon (![translate-to-spl-arrow.png](/files/7zPX0WINAuK8cAgkjvPb)) to convert to XQL, and then go to Step 6. 5. Create your query by typing in the query field. Relevant commands, their definitions, and operators are suggested as you type.

Tip

When creating XQL queries, you can:

  • Use the up and down arrow keys to navigate through the auto-suggestion command suggestions and definitions.
  • Select an auto-suggestion command by pressing either the Enter or Tab key.
  • Press Shift+Enter to add a new line, and easily ignore the auto-suggestion output.
  • Close the auto-suggestion output by pressing the Esc key.
1. (Optional) Specify a dataset. You only need to specify a dataset if you are running your query against a dataset that you have not set as default. Otherwise, the query runs against the **`xdr_data`** dataset. For more information, see [How to build XQL queries](/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/build-xql-queries.md). Example 191. ```programlisting dataset = xdr_data ``` 2. Press **Enter**, and then type the pipe character (**`|`**). Select a command, and complete the command using the suggested options. 3. Continue adding stages until your query is complete. Example 192. ```programlisting dataset = xdr_data | filter agent_os_type = ENUM.AGENT_OS_MAC | limit 250 ``` 6. Choose when to run your query: * Run the query immediately. * Run the query by the specified date and time, or on a specific date, by selecting the calendar icon (![query-calendar-icon.png](/files/uNw1gP3LISjOsyrepDou)). 7. *(Optional)* The Save As options save your query for future use: * **BIOC Rule**: When compatible, saves the query as a BIOC rule. The XQL query must contain a filter for the **event\_type** field. * **Correlation Rule**: When compatible, saves the query as a Correlation Rule. For more information, see [What's a correlation rule?](/cortex-cloud-runtime-security/threat-management/detection-rules/what-are-detection-rules/whats-a-correlation-rule.md). * **Query to Library**: Saves the query to your personal query library. For more information, see [Manage the Graph Search Query Library](/cortex-cloud-runtime-security/graph-search/manage-the-graph-search-query-library.md). * **Widget to Library**: For more information, see [Create XQL widgets](/cortex-cloud-runtime-security/dashboards-and-reports/monitor-dashboards-and-reports/advanced-configuration/create-custom-widgets/create-xql-widgets.md). {% hint style="info" %} ### Tip While the query is running, you can navigate away from the page. A notification is sent when the query has finished. You can also **Cancel** the query or run a new query, where you have the option to **Run only new query (cancel previous)** or **Run both queries**. {% endhint %}
**Review XQL query results** Review the following topics: * [How to build XQL queries](/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/build-xql-queries.md) * [Create XQL query](/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/build-xql-queries.md) The results of a Cortex Query Language (XQL) query are displayed in the **Query Results** tab. {% hint style="info" %} ### Note It's also possible to graph the results displayed. For more information, see [Graph query results](/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/build-xql-queries.md). {% endhint %} **Real-time query results** Cortex Cloud displays partial results for queries run in the Query Builder as they are received, subject to the limitations below. In a long-running query, viewing the initial findings enables you to refine, validate, or stop the query. The partial results are displayed only in the **Table** tab. The results are added to the table as they are received in real time. The incremental query results aren't ordered, so they may not be in sequence. {% hint style="info" %} ### Limitations * Real time query results are available only in the Query Builder and in free text query. * Real time results are displayed only for queries run on hot datasets. * The Sort option is available only after all the data is retrieved. * When you formulate complex queries, the results will be displayed when the query has finished running completely, and not in real time. Some of the clauses that are included in this restriction are: * JOIN - incremental results are supported only when the secondary dataset is smaller in size * SORT * COMP * WINDOWCOMP * TOP {% endhint %} {% hint style="info" %} ### Note Results are received incrementally for the first 100K records, or up to 100MB worth of records, whichever comes first. After that, the next update is when the query has finished running completely. {% endhint %}
Understanding the options available to investigate results Use the following options in the **Query Results** tab to investigate your query results: | Option | Use | | ---------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Table tab |

Displays results in rows and columns according to the entity fields. Columns can be filtered, using their filter icons.

More options (table-settings.png) displays table layout options, which are divided into different sections:

Show and hide rows according to a specific field in a specific event: select a cell, right-click it, and then select either Show rows with … or Hide rows with …

| | Graph tab | Use the **Chart Editor** to visualize the query results. | | Advanced tab |

Displays results in a table format which aggregates the entity fields into one column. You can change the layout, decide whether to Show line breaks for any text field in the results table, and change the log format from the table-settings.png menu.

Select Show more to pivot an Expanded View of the event results that include NULL values. You can toggle between the JSON and Tree views, search, and Copy to clipboard.

| | Export to File |

Exports the results to a TSV (tab-separated values) file.

| | Refresh | Refreshes the query results. | | Free text search | Searches the query results for text that you specify in the free text search. Click the **Free text search** icon to reveal or hide the free text search field. | | Filter |

Enables you to filter a particular field in the interface that is displayed to specify your filter criteria.

For integer, boolean, and timestamp (such as \_time) fields, we recommend that you use the Filter instead of the Free text search, in order to retrieve the most accurate query results.

| | Fields menu |

Filters query results. To quickly set a filter, Cortex Cloud displays the top ten results from which you can choose to build your filter. This option is only available in the Table and Advanced tabs,

From within the Fields menu, click on any field (excluding JSON and array fields) to see a histogram of all the values found in the result set for that field. This histogram includes:

Note

In order for Cortex Cloud to provide a histogram for a field, the field must not contain an array or a JSON object.

|
Available options for saving results The Save As options save your query for future use: * **BIOC Rule**: When compatible, saves the query as a BIOC rule. The XQL query must contain a filter for the **event\_type** field. * **Correlation Rule**: When compatible, saves the query as a Correlation Rule. For more information, see [What's a correlation rule?](/cortex-cloud-runtime-security/threat-management/detection-rules/what-are-detection-rules/whats-a-correlation-rule.md). * **Query to Library**: Saves the query to your personal query library. For more information, see [Manage the Graph Search Query Library](/cortex-cloud-runtime-security/graph-search/manage-the-graph-search-query-library.md). * **Widget to Library**: For more information, see Create XQL widgets.
Investigating results in the Causality View or Timeline View You can continue investigating the query results in the Causality View or Timeline by right-clicking the event and selecting the desired view. This option is available for the following types of events: * Process (except for those with an event sub-type of termination) * Network * File * Registry * Injection * Load image * System calls * Event logs for Windows * System authentication logs for Linux For network stories, you can pivot to the Causality View only. For cloud Cortex Cloud events and Cloud Audit Logs, you can only pivot to the Cloud Causality View, while software-as-a-service (SaaS) related issues for audit stories, such as Office 365 audit logs and normalized logs, you can only pivot to the SaaS Causality View.
Add file path to Malware Profile allowed list Add a file path to your existing Malware Profile allowed list by right-clicking a \ field, such as **target\_process\_path**, and select **Add \ to malware profile allow list**.
**Translate to XQL** To help you easily convert your existing Splunk queries to the Cortex Query Language (XQL) syntax, Cortex Cloud includes a toggle called **Translate to XQL** in the query field in the user interface. When building your XQL query and this option is selected, both a **SPL query** field and **XQL query** field are displayed, so you can easily add a Splunk query, which is converted to XQL in the XQL query field. This option is disabled by default, so only the **XQL query** field is displayed. {% hint style="info" %} ### Important This feature is still in a Beta state and you will find that not all Splunk queries can be converted to XQL. This feature will be improved upon in the upcoming releases to support greater Splunk query translations to XQL. {% endhint %}
Supported functions in Splunk The following table details the supported functions in Splunk that can be converted to XQL in Cortex Cloud with an example of a Splunk query and the resulting XQL query. In each of these examples, the `xdr_data` dataset is used. | Splunk Function/Stage | Splunk Query Example | Resulting XQL Query Example | | --------------------------- | ------------------------------------------------------------------------------------------------------------------------------------ | --------------------------------------------------------------------------------------------------------------- | | `avg` | \`index=xdr\_data | stats avg(dst\_association\_strength)\` | | `bin` | \`index = xdr\_data | bin \_time span=5m\` | | `coalesce` | \`index= xdr\_data | eval product\_or\_vendor\_not\_null=coalesce(\_product, \_vendor )\` | | `count` | \`index=xdr\_data | stats count(\_product) BY \_time\` | | `ctime` | \`index=xdr\_data | convert ctime(field) as field\` | | `earliest` | `index = xdr_data earliest=24d` | \`dataset in (xdr\_data) | | `eval` | \`index=xdr\_data | eval field = "test"\` | | `fillnull` | \`index=xdr\_data | fillnull value = "missing ipv6" agent\_ip\_addresses\_v6\` | | `floor` | \`index=xdr\_data | eval floor\_test = floor(1.9)\` | | `iplocation` | \`index=xdr\_data | inputlookup append=true my\_lookup.csv\` | | `iplocation` | \`index = xdr\_data | inputlookup agent\_ip\_addresses\` | | `isnotnull` | \`index=xdr\_data | eval x = isnotnull(agent\_hostname)\` | | `isnull` | \`index=xdr\_data | eval x = isnull(agent\_hostname)\` | | `json_extract` | \`index= xdr\_data | eval London=json\_extract(dfe\_labels,"dfe\_labels{0}")\` | | `join` | `join agent_hostname [index = xdr_data]` | `join type=left conflict_strategy=right (dataset in (xdr_data)) as inner agent_hostname = inner.agent_hostname` | | `latest` | `index = xdr_data latest=-24d` | \`dataset in (xdr\_data) | | `len` | \`index = xdr\_data | where uri != null | | `ltrim(,)` | \`index=xdr\_data | eval trimed\_agent=ltrim("agent\_hostname", "agent\_")\` | | `lower` | \`index = xdr\_data | eval field = lower("TEST")\` | | `max` | \`index =xdr\_data | stats max(action\_file\_size) by \_product\` | | `md5` | \`index=xdr\_data | eval md5\_test = md5("test")\` | | `median` | \`index = xdr\_data | stats median(actor\_process\_file\_size) by \_time\` | | `min` | \`index =xdr\_data | stats min(action\_file\_size) by \_product\` | | `mvcount` | \`index = xdr\_data | where http\_data != null | | `mvdedup` | \`index = xdr\_data | eval s=mvdedup(action\_app\_id\_transitions)\` | | `mvexpand` | \`index = xdr\_data | mvexpand dfe\_labels limit = 100\` | | `mvfilter` | \`index = xdr\_data | eval x = mvfilter(isnull(dfe\_labels))\` | | `mvindex` | \`index=xdr\_data | eval field = mvindex(action\_app\_id\_transitions, 0)\` | | `mvjoin` | \`index=xdr\_data | eval n=mvjoin(action\_app\_id\_transitions, ";")\` | | `pow` | \`index=xdr\_data | eval pow\_test = pow(2, 3)\` | | `relative_time(X,Y)` |
  • \`index ="xdr\_data"
| where \_time > relative\_time(now(),"-7d\@d")`
  • `index ="xdr\_data" | | `replace` | \`index= xdr\_data | eval description = replace(agent\_hostname,"("."NEW")\` | | `rex` | \`index=xdr\_data action\_local\_ip!="0.0.0.0" | rex field=action\_local\_ip "(?\\d+.\d+.\d+.48)" | | `round` | \`index=xdr\_data | eval round\_num = round(3.5)\` | | `rtrim` | \`index=xdr\_data | eval trimed\_hostname=rtrim("agent\_hostname", "hostname")\` | | `search` | \`index = xdr\_data | eval ip="192.0.2.56" | | `sha256` | \`index = xdr\_data | eval sha256\_test = sha256("test")\` | | `sort (ascending order)` | \`index = xdr\_data | sort action\_file\_size\` | | `sort (descending order)` | \`index = xdr\_data | sort -action\_file\_size\` | | `spath` | \`index = xdr\_data | spath output=myfield input=action\_network\_http path=headers.User-Agent\` | | `split` | \`index = xdr\_data | where mac != null | | `stats` | \`index=xdr\_data | stats count(event\_type) by \_time\` | | `stats dc` | \`index = xdr\_data | stats dc(\_product) BY \_time\` | | `strcat` | \`index=xdr\_data | strcat story\_id "/" http\_req\_before\_method comboIP\` | | `sum` | \`index=xdr\_data | where action\_file\_size != null | | `table` | \`index = xdr\_data | table \_time, agent\_hostname, agent\_ip\_addresses, \_product\` | | `tonumber` | \`index=xdr\_data | eval tonumber\_test = tonumber("90210")\` | | `top` |

    The following Splunk functions can be translated to XQL:

    • limit

      \`index = xdr\_data

    | where action\_app\_id\_risk > 0 | | `upper` | \`index=xdr\_data | eval field = upper("test")\` | | `var` | \`index=xdr\_data | stats var (event\_type) by \_time\` |
    • How to translate a Splunk query to XQL syntax 1. Select **Investigation & Response** → **Search** → **Query Builder** → **XQL**. 2. Toggle to **Translate to XQL**, where both a **SPL query** field and **XQL query** field are displayed. 3. Add your Splunk query to the **SPL query** field. 4. Click the arrow (![translate-to-spl-arrow.png](/files/7zPX0WINAuK8cAgkjvPb)). The **XQL query** field displays the equivalent Splunk query using the XQL syntax. You can now decide what to do with this query based on the instructions explained in [Create XQL query](/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/build-xql-queries.md).
    **Graph query results** {% hint style="info" %} ### Notice Building Cortex Query Language (XQL) queries in the Query Builder requires a Data Collection add-on. {% endhint %} To help you better understand your Cortex Query Language (XQL) query results and share your insights with others, Cortex Cloud enables you to generate graphs and outputs of your query data directly from query results page. {% hint style="info" %} ### Tip Alternatively, you can use the Cortex Agentic Assistant to generate custom graphs and charts using natural language prompts. By simply prompting the agent, it will build and execute the query, returning the visual representation. For more information, see [Use natural language to query and visualize your data](/cortex-cloud-runtime-security/agentic-assistant-chat/agentic-assistant-chat/use-natural-language-to-query-and-visualize-your-data.md). {% endhint %} 1. Select **Investigation & Response** → **Search** → **Query Builder** → **XQL**. 2. Run an XQL query. Example 193. Enter the following query: ```programlisting dataset = xdr_data | fields action_total_upload, _time | limit 10 ``` The query returns the `action_total_upload`, a number field, and `_time`, a string field, for up to 10 results. 3. In the **Query Results** section, to graph the results either:
    Use Chart Editor ``` Navigate to **Query Results** → **Chart Editor (![visualizing-query-results-chart-editor.png](../../../.gitbook/assets/27342aa800f89679573a273736772a2a4e9b13a24187089cd1ba82c02e9597c3.png))** to manually build and view the graph using the selected graph parameters: - **Main** - **Graph Type**: Type of graphs and output options available: **Area**, **Bubble**, **Column**, **Funnel**, **Gauge**, **Line**, **Map**, **Pie**, **Scatter**, **Single Value**, or **Word Cloud**.
    ### Note To display the result of as a time duration, choose the graph type **Single Value** and enable **Show as Time**. You can then select the **Time Unit** (millisecond, second, minute, or hour) and the **Display format**.
    - **Subtype** and **Layout**: Depending on the selected type of graph, choose from the available display options. - **Header**: Title your graph. - **Show Callouts**: Display numeric values on the graph. - **Data** - **X-axis**: Select a field with a string value. - **Y-axis**: Select a field with a numeric value. - (Optional) **Series**: For an area, bubble, column, line, map, or scatter chart, you can specify a field (column) to group chart results based on y-axis values. This option is only displayed when one of the supported graph types are selected, and a single y-axis value is selected. - Depending on the selected type of graph, customize the **Color**, **Font**, and **Legend**.
    ``` --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-xql/build-xql-queries/how-to-build-xql-queries.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.