XQL query entities

Learn more about the Cortex Query Language (XQL) entities available in the Query Builder.

With Query Builder, you can build complex queries for entities and entity attributes so that you can surface and identify connections between them. Cortex Cloud provides Cortex Query Language (XQL) queries for different types of entities in the Query Builder that search predefined datasets. The Query Builder searches the raw data and logs stored in Cortex Cloud tenant and for the entities and attributes you specify, it returns up to 1,000,000 results.

The Query Builder provides queries for the following types of entities:

• Process: Search on process execution and injection by process name, hash, path, command line arguments, and more. See Create process query.
• File: Search on file creation and modification activity by file name and path. See Create file query.
• Network: Search network activity by IP address, port, host name, protocol, and more. See Create network query.
• Image Load: Search on module load into process events by module IDs and more. See Create image load query.
• Registry: Search on registry creation and modification activity by key, key value, path, and data. See Create registry query.
• Event Log: Search Windows event logs and Linux system authentication logs by username, log event ID (Windows only), log level, and message. See Create event log query.
• Network Connections: Search security event logs by firewall logs, endpoint raw data over your network. See Create network connections query.
• Authentications: Search on authentication events by identity, target outcome, and more. See Create authentication query.
• All Actions: Search across all network, registry, file, and process activity by endpoint or process. See Query across all entities.

The Query Builder also provides flexibility for both on-demand query generation and scheduled queries.

Create authentication query

From the Query Builder, you can investigate authentication activity across all ingested authentication logs and data.

Some examples of authentication queries you can run include:

• Authentication logs by severity
• Authentication logs by the event message
• Authentication logs for a specific source IP address

How to build an authentication query

1. From Cortex Cloud , select Investigation & Response → Search → Query Builder.
2. Select AUTHENTICATION.
3. Enter the search criteria for the authentication query.

   By default, Cortex Cloud will return the activity that matches all the criteria you specify. To exclude a value, toggle the = option to =!.
4. Choose when to run the query.

   Select the calendar icon to schedule a query to run on or before a specific date or Run to run the query immediately and view the results in the Query Center.

   While the query is running, you can always navigate away from the page and a notification is sent when the query completes. You can also Cancel the query or run a new query, where you have the option to Run only new query (cancel previous) or Run both queries.
5. When you are ready, view the results of the query. For more information, see Review XQL query results.

Create event log query

From the Query Builder you can search Windows and Linux event log attributes and investigate event logs across endpoints with a Cortex XDR agent installed.

Some examples of event log queries you can run include:

• Critical level messages on specific endpoints.
• Message descriptions with specific keywords on specific endpoints.

How to build an event log query

1. From Cortex Cloud , select Investigation & Response → Search → Query Builder.
2. Select EVENT LOG.
3. Enter the search criteria for your Windows or Linux event log query.

   Define any event attributes for which you want to search. By default, Cortex XDR will return the events that match the attribute you specify. To exclude an attribute value, toggle the = option to =!. Attributes are:

   • PROVIDER NAME: The provider of the event log.
   • USERNAME: The username associated with the event.
   • EVENT ID: The unique ID of the event.
   • LEVEL: The event severity level.
   • MESSAGE: The description of the event.

   To specify an additional exception (match this value except), click the + to the right of the value and specify the exception value.
4. (Optional) Limit the scope to an endpoint or endpoint attributes:

   Specify one or more of the following attributes: Use a pipe (|) to separate multiple values.

   Use an asterisk (*) to match any string of characters.

   • HOST: HOST NAME, HOST IP address, HOST OS, HOST MAC ADDRESS, or INSTALLATION TYPE.
   • INSTALLATION TYPE can be either Cortex XDR agent or Data Collector.
   • PROCESS: NAME, PATH, CMD, MD5, SHA256, USER NAME, SIGNATURE, or PID.
5. Specify the time period for which you want to search for events.

   Options are Last 24H (hours), Last 7D (days), Last 1M (month), or select a Custom time period.
6. Choose when to run the query.

   Select the calendar icon to schedule a query to run on or before a specific date or Run to run the query immediately and view the results in the Query Center.

   While the query is running, you can always navigate away from the page, and a notification is sent when the query completes. You can also Cancel the query or run a new query, where you have the option to Run only new query (cancel previous) or Run both queries.
7. When you are ready, view the results of the query. For more information, see Review XQL query results.

Create file query

From the Query Builder you can investigate connections between file activity and endpoints. The Query Builder searches your logs and endpoint data for the file activity that you specify. To search for files on endpoints instead of file-related activity, build an XQL query. For more information, see How to build XQL queries.

Some examples of file queries you can run include:

• Files modified on specific endpoints.
• Files related to process activity that exist on specific endpoints.

How to build a file query

1. From Cortex Cloud, select Investigation & Response → Search → Query Builder.
2. Select FILE.
3. Enter the search criteria for the file events query.

   • File activity: Select the type or types of file activity you want to search: All, Create, Read, Rename, Delete, or Write.
   • File attributes: Define any additional process attributes for which you want to search. Use a pipe (|) to separate multiple values (for example notepad.exe|chrome.exe). By default, Cortex Cloud will return the events that match the attribute you specify. To exclude an attribute value, toggle the = option to =!. Attributes are:

     • NAME: File name.
     • PATH: Path of the file.
     • PREVIOUS NAME: Previous name of a file.
     • PREVIOUS PATH: Previous path of the file.
     • MD5: MD5 hash value of the file.
     • SHA256: SHA256 hash value of the file.
     • ACTION_DISK_DRIVER_NAME: The driver where the file was created.
     • FILE_SYSTEM_TYPE: Operating system type where the file was run.
     • ACTION_IS_VFS: Denotes if the file is on a virtual file system on the disk. This is relevant only for files that are written to disk.
     • DEVICE TYPE: Type of device used to run the file: Unknown, Fixed, Removable Media, CD-ROM.
     • DEVICE SERIAL NUMBER: Serial number of the device type used to run the file.

     To specify an additional exception (match this value except), click the + to the right of the value and specify the exception value.
4. (Optional) Limit the scope to a specific acting process:

   Select +PROCESS and specify one or more of the following attributes for the acting (parent) process.

   Use a pipe (|) to separate multiple values. Use an asterisk (*) to match any string of characters.

   • NAME: Name of the parent process.
   • PATH: Path to the parent process.
   • CMD: Command-line used to initiate the process, including any arguments, up to 128 characters.
   • MD5: MD5 hash value of the process.
   • SHA256: SHA256 hash value of the process.
   • USER NAME: User who executed the process.
   • SIGNATURE: Signing status of the parent process: Signature Unavailable, Signed, Invalid Signature, Unsigned, Revoked, Signature Fail.
   • SIGNER: Entity that signed the certificate of the parent process.
   • PID: Process ID of the parent process.
   • Run search for process, Causality, and OS actors—The causality actor—also referred to as the causality group owner (CGO)—is the parent process in the execution chain that the Cortex XDR agent identified as being responsible for initiating the process tree. The OS actor is the parent process that creates an OS process on behalf of a different indicator. By default, this option is enabled to apply the same search criteria to initiating processes. To configure different attributes for the parent or initiate the process, clear this option.
5. (Optional) Limit the scope to an endpoint or endpoint attributes:

   Select +Host and specify one or more of the following attributes:

   • HOST: HOST NAME, HOST IP address, HOST OS, HOST MAC ADDRESS, or INSTALLATION TYPE.

     INSTALLATION TYPE can be either Cortex XDR agent or Data Collector.
   • PROCESS: NAME, PATH, CMD, MD5, SHA256, USER NAME, SIGNATURE, or PID.

   Use a pipe (|) to separate multiple values. Use an asterisk (*) to match any string of characters.
6. Specify the time period for which you want to search for events.

   Options are Last 24H (hours), Last 7D (days), Last 1M (month), or select a Custom time period.
7. Choose when to run the query.

   Select the calendar icon to schedule a query to run on or before a specific date or Run to run the query immediately and view the results in the Query Center.

   While the query is running, you can always navigate away from the page and a notification is sent when the query completes. You can also Cancel the query or run a new query, where you have the option to Run only new query (cancel previous) or Run both queries.
8. When you are ready, view the results of the query. For more information, see Review XQL query results.

Create image load query

From the Query Builder, you can investigate connections between image load activity, acting processes, and endpoints.

Some examples of image load queries you can run include:

• Module load into process events by module path or hash.

How to build an image load query

1. From Cortex Cloud , select Investigation & Response → Search → Query Builder.
2. Select IMAGE LOAD.
3. Enter the search criteria for the image load activity query.

   • Type of image activity: All, Image Load, or Change Page Protection.
   • Identifying information about the image module: Full Module Path, Module MD5, or Module SHA256.

   By default, Cortex Cloud will return the activity that matches all the criteria you specify. To exclude a value, toggle the = option to =!.
4. (Optional) To limit the scope to a specific source, click the + to the right of the value and specify the exception value.

   Specify one or more attributes for the source.

   Use a pipe (|) to separate multiple values. Use an asterisk (*) to match any string of characters.

   • NAME: Name of the parent process.
   • PATH: Path to the parent process.
   • CMD: Command-line used to initiate the process, including any arguments, up to 128 characters.
   • MD5: MD5 hash value of the process.
   • SHA256: SHA256 hash value of the process.
   • USER NAME: User who executed the process.
   • SIGNATURE: Signing status of the parent process: Signature Unavailable, Signed, Invalid Signature, Unsigned, Revoked, Signature Fail.
   • SIGNER: Entity that signed the certificate of the parent process.
   • PID: Process ID of the parent process.

   Run search for both the process and the Causality actor: The causality actor—also referred to as the causality group owner (CGO)—is the parent process in the execution chain that the app identified as being responsible for initiating the process tree. Select this option if you want to apply the same search criteria to the causality actor. If you clear this option, you can then configure different attributes for the causality actor.
5. (Optional) Limit the scope to an endpoint or endpoint attributes:

   Specify one or more of the following attributes: Use a pipe (|) to separate multiple values.

   Use an asterisk (*) to match any string of characters.

   • HOST: HOST NAME, HOST IP address, HOST OS, HOST MAC ADDRESS, or INSTALLATION TYPE.

     INSTALLATION TYPE can be either Cortex XDR agent or Data Collector.
   • PROCESS: NAME, PATH, CMD, MD5, SHA256, USER NAME, SIGNATURE, or PID.
6. Specify the time period for which you want to search for events.

   Options are Last 24H (hours), Last 7D (days), Last 1M (month), or select a Custom time period.
7. Choose when to run the query.

   Select the calendar icon to schedule a query to run on or before a specific date or Run to run the query immediately and view the results in the Query Center.

   While the query is running, you can always navigate away from the page and a notification is sent when the query completes. You can also Cancel the query or run a new query, where you have the option to Run only new query (cancel previous) or Run both queries.
8. When you are ready, view the results of the query. For more information, see Review XQL query results.

Create network connections query

From the Query Builder, you can investigate network events stitched across endpoints and the Palo Alto Networks Next-Generation Firewall logs.

Some examples of a network query you can run include:

• Source and destination of a process.
• Network connections that included a specific App ID
• Processes that created network connections.
• Network connections between specific endpoints.

How to build a network connection query

1. From Cortex Cloud , select Investigation & Response → Search → Query Builder.
2. Select NETWORK CONNECTIONS.
3. Enter the search criteria for the network events query.

   • Network attributes: Define any additional process attributes for which you want to search. Use a pipe (|) to separate multiple values (for example 80|8080). By default, Cortex Cloud will return the events that match the attribute you specify. To exclude an attribute value, toggle the = option to =!. Options are:

     • APP ID: App ID of the network.
     • PROTOCOL: Network transport protocol over which the traffic was sent.
     • SESSION STATUS
     • FW DEVICE NAME: Firewall device name.
     • FW RULE: Firewall rule.
     • FW SERIAL ID: Firewall serial ID.
     • PRODUCT
     • VENDOR

     To specify an additional exception (match this value except), click the + to the right of the value and specify the exception value.
4. (Optional) To limit the scope to a specific source, click the + to the right of the value and specify the exception value.

   Specify one or more attributes for the source.

   Use a pipe (|) to separate multiple values. Use an asterisk (*) to match any string of characters.

   • HOST NAME: Name of the source.
   • HOST IP: IP address of the source.
   • HOST OS: Operating system of the source.
   • PROCESS NAME: Name of the process.
   • PROCESS PATH: Path to the process.
   • CMD: Command-line used to initiate the process, including any arguments, up to 128 characters.
   • MD5: MD5 hash value of the process.
   • SHA256: SHA256 hash value of the process.
   • PROCESS USER NAME: User who executed the process.
   • SIGNATURE: Signing status of the parent process: Signature Unavailable, Signed, Invalid Signature, Unsigned, Revoked, Signature Fail.
   • PID: Process ID of the parent process.
   • IP: IP address of the process.
   • PORT: Port number of the process.
   • USER ID: ID of the user who executed the process.
   • Run search for both the process and the Causality actor: The causality actor—also referred to as the causality group owner (CGO)—is the parent process in the execution chain that the app identified as being responsible for initiating the process tree. Select this option if you want to apply the same search criteria to the causality actor. If you clear this option, you can then configure different attributes for the causality actor.
5. (Optional) Limit the scope to a destination.

   Use a pipe (|) to separate multiple values. Use an asterisk (*) to match any string of characters.

   Specify one or more of the following attributes:

   • REMOTE IP: IP address of the destination.
   • COUNTRY: Country of the destination.
   • Destination TARGET HOST,NAME, PORT, HOST NAME, PROCESS USER NAME, HOST IP, CMD, HOST OS, MD5, PROCESS PATH, USER ID, SHA256, SIGNATURE, or PID
6. Specify the time period for which you want to search for events.

   Options are Last 24H (hours), Last 7D (days), Last 1M (month), or select a Custom time period.
7. Choose when to run the query.

   Select the calendar icon to schedule a query to run on or before a specific date or Run to run the query immediately and view the results in the Query Center.

   While the query is running, you can always navigate away from the page and a notification is sent when the query completes. You can also Cancel the query or run a new query, where you have the option to Run only new query (cancel previous) or Run both queries.
8. When you are ready, view the results of the query. For more information, see Review XQL query results.

Create network query

From the Query Builder, you can investigate connections between network activity, acting processes, and endpoints.

Some examples of a network query you can run include:

• Network connections to or from a specific IP address and port number.
• Processes that created network connections.
• Network connections between specific endpoints.

How to build a network query

1. From Cortex Cloud , select Investigation & Response → Search → Query Builder.
2. Select NETWORK.
3. Enter the search criteria for the network events query.

   • Network traffic type: Select the type or types of network traffic issues you want to search: Incoming, Outgoing, or Failed.
   • Network attributes: Define any additional process attributes for which you want to search. Use a pipe (|) to separate multiple values (for example 80|8080). By default, Cortex Cloud will return the events that match the attribute you specify. To exclude an attribute value, toggle the = option to =!. Options are:

     • REMOTE COUNTRY: Country from which the remote IP address originated.
     • REMOTE IP: Remote IP address related to the communication.

       Note

       When you run the query, depending on the outcome of the results, the value specified in this field might be displayed in the dst_ip field in the query results. This occurs if an RDP event is recorded whereby a user connected from the source IP to the destination IP.
     • REMOTE PORT: Remote port used to make the connection.
     • LOCAL IP: Local IP address related to the communication. Matches can return additional data if a machine has more than one NIC.
     • LOCAL PORT: Local port used to make the connection.
     • PROTOCOL: Network transport protocol over which the traffic was sent.

     To specify an additional exception (match this value except), click the + to the right of the value and specify the exception value.
4. (Optional) To limit the scope to a specific source, click the + to the right of the value and specify the exception value.

   Specify one or more attributes for the source.

   Use a pipe (|) to separate multiple values. Use an asterisk (*) to match any string of characters.

   • NAME: Name of the parent process.
   • PATH: Path to the parent process.
   • CMD: Command-line used to initiate the process, including any arguments, up to 128 characters.
   • MD5: MD5 hash value of the process.
   • SHA256: SHA256 hash value of the process.
   • USER NAME: User who executed the process.
   • SIGNATURE: Signing status of the parent process: Signature Unavailable, Signed, Invalid Signature, Unsigned, Revoked, Signature Fail.
   • SIGNER: Entity that signed the certificate of the parent process.
   • PID: Process ID of the parent process.
   • Run search for process, Causality, and OS actors: The causality actor—also referred to as the causality group owner (CGO)—is the parent process in the execution chain that the Cortex XDR agent identified as being responsible for initiating the process tree. The OS actor is the parent process that creates an OS process on behalf of a different indicator. By default, this option is enabled to apply the same search criteria to initiating processes. To configure different attributes for the parent or initiate the process, clear this option.
5. (Optional) Limit the scope to an endpoint or endpoint attributes:

   Specify one or more of the following attributes: Use a pipe (|) to separate multiple values.

   Use an asterisk (*) to match any string of characters.

   • HOST: HOST NAME, HOST IP address, HOST OS, HOST MAC ADDRESS, or INSTALLATION TYPE.
   • INSTALLATION TYPE can be either Cortex XDR agent or Data Collector.
   • PROCESS: NAME, PATH, CMD, MD5, SHA256, USER NAME, SIGNATURE, or PID.
6. Specify the time period for which you want to search for events.

   Options are Last 24H (hours), Last 7D (days), Last 1M (month), or select a Custom time period.
7. Choose when to run the query.

   Select the calendar icon to schedule a query to run on or before a specific date or Run to run the query immediately and view the results in the Query Center.

   While the query is running, you can always navigate away from the page and a notification is sent when the query completes. You can also Cancel the query or run a new query, where you have the option to Run only new query (cancel previous) or Run both queries.
8. When you are ready, view the results of the query. For more information, see Review XQL query results.

Create process query

From the Query Builder you can investigate connections between processes, child processes, and endpoints.

For example, you can create a process query to search for processes executed on a specific endpoint.

How to build a process query

1. From Cortex Cloud , select Investigation & Response → Search → Query Builder.
2. Select PROCESS.
3. Enter the search criteria for the process query.

   • Process action: Select the type of process action you want to search: On process Execution or Injection into another process.
   • Process attributes—Define any additional process attributes for which you want to search.

     Use a pipe (|) to separate multiple values. Use an asterisk (*) to match any string of characters.

     By default, Cortex Cloud will return results that match the attribute you specify. To exclude an attribute value, toggle the operator from = to !=. Attributes are:

     • NAME: Name of the process. For example, notepad.exe.
     • PATH: Path to the process. For example, C:\windows\system32\notepad.exe.
     • CMD: Command-line used to initiate the process including any arguments, up to 128 characters.
     • MD5: MD5 hash value of the process.
     • SHA256: SHA256 hash value of the process.
     • USER NAME: User who executed the process.
     • SIGNATURE: Signing status of the process: Signature Unavailable, Signed, Invalid Signature, Unsigned, Revoked, Signature Fail.
     • SIGNER: Signer of the process.
     • PID: Process ID.
     • PROCESS_FILE_INFO: Metadata of the process file, including file property details, file entropy, company name, encryption status, and version number.
     • PROCESS_SCHEDULED_TASK_NAME: Name of the task scheduled by the process to run in the Task Scheduler.
     • PROCESS_TOKEN_INFORMATION: Bitwise token of the process privileges.
     • DEVICE TYPE: Type of device used to run the process: Unknown, Fixed, Removable Media, CD-ROM.
     • DEVICE SERIAL NUMBER: Serial number of the device type used to run the process.

     To specify an additional exception (match this value except), click the + to the right of the value and specify the exception value.
4. (Optional) Limit the scope to a specific acting process:

   Select +PROCESS and specify one or more of the following attributes for the acting (parent) process.

   • NAME: Name of the parent process.
   • PATH: Path to the parent process.
   • CMD: Command-line used to initiate the parent process including any arguments, up to 128 characters.
   • MD5: MD5 hash value of the parent process.
   • SHA256: SHA256 hash value of the process.
   • USER NAME: User who executed the process.
   • SIGNATURE: Signing status of the parent process: Signed, Unsigned, N/A, Invalid Signature, Weak Hash
   • SIGNER: Entity that signed the certificate of the parent process.
   • PID: Process ID of the parent process.
   • Run search on process, Causality and OS actors: The causality actor—also referred to as the causality group owner (CGO)—is the parent process in the execution chain that the Cortex XDR agent identified as being responsible for initiating the process tree. The OS actor is the parent process that creates an OS process on behalf of a different initiator. By default, this option is enabled to apply the same search criteria to initiating processes. To configure different attributes for the parent or initiate a process,
5. (Optional) Limit the scope to an endpoint or endpoint attributes:

   Select +HOST and specify one or more of the following attributes:

   • HOST: HOST NAME, HOST IP address, HOST OS, HOST MAC ADDRESS, or INSTALLATION TYPE.

     INSTALLATION TYPE can be Cortex XDR agent.
   • PROCESS: NAME, PATH, CMD, MD5, SHA256, USER NAME, SIGNATURE, or PID.
6. Specify the time period for which you want to search for events.

   Options are Last 24H (hours), Last 7D (days), Last 1M (month), or select a Custom time period.
7. Choose when to run the query.

   Select the calendar icon to schedule a query to run on or before a specific date or Run to run the query immediately and view the results in the Query Center.

   While the query is running, you can always navigate away from the page and a notification is sent when the query completes. You can also Cancel the query or run a new query, where you have the option to Run only new query (cancel previous) or Run both queries.
8. When you are ready, view the results of the query. For more information, see Review XQL query results.

Create registry query

From the Query Builder you can investigate connections between registry activity, processes, and endpoints.

Some examples of a registry query you can run include:

• Modified registry keys on specific endpoints.
• Registry keys related to process activity that exist on specific endpoints.

How to build a registry query

1. From Cortex Cloud , select Investigation & Response → Search → Query Builder.
2. Select REGISTRY.
3. Enter the search criteria for the registry events query.

   • Registry action: Select the type or types of registry actions you want to search: Key Create, Key Delete, Key Rename, Value Set, or Value Delete.
   • Registry attributes: Define any additional registry attributes for which you want to search. By default, Cortex Cloud will return the events that match the attribute you specify. To exclude an attribute value, toggle the = option to =!. Attributes are:

     • KEY NAME: Registry key name.

       Important

       Ensure the KEY NAME is entered as a real registry key name, and not as a symbolic link. Otherwise, the query will not retrieve results.

       Example 195.

       Instead of HKEY_LOCAL_MACHINE\System\CurrentControlSet, which is a symbolic link, use KEY_LOCAL_MACHINE\System\ControlSet001.

       Example 196.

       Instead of HKEY_CURRENT_USER, use HKEY_USERS\<SID>, where SID is either a SID of the current user or an asterisk (*) to represent any SID.
     • DATA: Registry key data value.
     • KEY PREVIOUS NAME: Name of the registry key before modification.
     • VALUE NAME: Registry value name.

     To specify an additional exception (match this value except), click the + to the right of the value and specify the exception value.
4. (Optional) To limit the scope to a specific source, click the + to the right of the value and specify the exception value.

   Specify one or more attributes for the source.

   Use a pipe (|) to separate multiple values. Use an asterisk (*) to match any string of characters.

   • NAME: Name of the parent process.
   • PATH: Path to the parent process.
   • CMD: Command-line used to initiate the process including any arguments, up to 128 characters.
   • MD5: MD5 hash value of the process.
   • SHA256: SHA256 hash value of the process.
   • USER NAME: User who executed the process.
   • SIGNATURE: Signing status of the parent process: Signature Unavailable, Signed, Invalid Signature, Unsigned, Revoked, Signature Fail.
   • SIGNER: Entity that signed the certificate of the parent process.
   • PID: Process ID of the parent process.
   • Run search for process, Causality, and OS actors: The causality actor—also referred to as the causality group owner (CGO)—is the parent process in the execution chain that the Cortex XDR agent identified as being responsible for initiating the process tree. The OS actor is the parent process that creates an OS process on behalf of a different indicator. By default, this option is enabled to apply the same search criteria to initiating processes. To configure different attributes for the parent or initiate the process, clear this option.
5. (Optional) Limit the scope to an endpoint or endpoint attributes:

   Specify one or more of the following attributes: Use a pipe (|) to separate multiple values.

   Use an asterisk (*) to match any string of characters.

   • HOST: HOST NAME, HOST IP address, HOST OS, HOST MAC ADDRESS, or INSTALLATION TYPE.
   • INSTALLATION TYPE can be either Cortex XDR agent or Data Collector.
   • PROCESS: NAME, PATH, CMD, MD5, SHA256, USER NAME, SIGNATURE, or PID.
6. Specify the time period for which you want to search for events.

   Options are Last 24H (hours), Last 7D (days), Last 1M (month), or select a Custom time period.
7. Choose when to run the query.

   Select the calendar icon to schedule a query to run on or before a specific date or Run to run the query immediately and view the results in the Query Center.

   While the query is running, you can always navigate away from the page and a notification is sent when the query completes. You can also Cancel the query or run a new query, where you have the option to Run only new query (cancel previous) or Run both queries.
8. When you are ready, view the results of the query. For more information, see Review XQL query results.

Query across all entities

From the Query Builder you can perform a simple search for hosts and processes across all file events, network events, registry events, process events, event logs for Windows, and system authentication logs for Linux.

Some examples of queries you can run across all entities include:

• All activities on a host
• All activities initiated by a process on a host

How to build a query

1. From Cortex Cloud , select Investigation & Response → Search → Query Builder.
2. Select ALL ACTIONS.
3. (Optional) Limit the scope to a specific acting process:

   Select Add Process to your search, and specify one or more of the following attributes for the acting (parent) process. Use a pipe (|) to separate multiple values. Use an asterisk (*) to match any string of characters.

   Field	Description
   NAME	Name of the parent process.
   PATH	Path to the parent process.
   CMD	Command line used to initiate the parent process including any arguments, up to 128 characters.
   MD5	MD5 hash value of the parent process.
   SHA256	SHA256 hash value of the process.
   USER NAME	User who executed the process.
   SIGNATURE	Signing status of the parent process: Signed, Unsigned, N/A, Invalid Signature, Weak Hash.
   SIGNER	Entity that signed the certificate of the parent process.
   PID	Process ID of the parent process.
   Run search on process, Causality and OS actors	The causality actor, also referred to as the causality group owner (CGO), is the parent process in the execution chain that the agent identified as being responsible for initiating the process tree. The OS actor is the parent process that creates an OS process on behalf of a different initiator. By default, this option is enabled to apply the same search criteria to initiating processes. To configure different attributes for the parent or initiating process, clear this option.

4. (Optional) Limit the scope to an endpoint or endpoint attributes:

   Select Add Host to your search and specify one or more of the following attributes:

   • HOST: HOST NAME, HOST IP address, HOST OS, HOST ADDRESS, or INSTALLATION TYPE.
   • INSTALLATION TYPE can be either an agent, or data collector.
   • PROCESS: NAME , PATH , CMD , MD5 , SHA256 , USER NAME , SIGNATURE, or PID.

     Use a pipe (|) to separate multiple values. Use an asterisk (*) to match any string of characters.
5. Specify the time period for which you want to search for events.

   Options are Last 24H (hours), Last7D (days), Last1M (month), or select a Custom time period.
6. Choose when to run the query.

   Select the calendar icon to schedule a query to run on or before a specific date or Run the query immediately and view the results in the Query Center.

   While the query is running, you can always navigate away from the page and a notification is sent when the query completes. You can also Cancel the query or run a new query, where you have the option to Run only new query (cancel previous) or Run both queries.
7. When ready, view the results in a query.