> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-xql/build-xql-queries/xql-query-entities.md). # XQL query entities With Query Builder, you can build complex queries for entities and entity attributes so that you can surface and identify connections between them. Cortex Cloud provides Cortex Query Language (XQL) queries for different types of entities in the Query Builder that search predefined datasets. The Query Builder searches the raw data and logs stored in Cortex Cloud tenant and for the entities and attributes you specify, it returns up to 1,000,000 results. The **Query Builder** provides queries for the following types of entities: * **Process**: Search on process execution and injection by process name, hash, path, command line arguments, and more. See [Create process query](/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/build-xql-queries/legacy-query-builder/create-process-query.md). * **File**: Search on file creation and modification activity by file name and path. See [Create file query](/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/build-xql-queries/legacy-query-builder/create-file-query.md). * **Network**: Search network activity by IP address, port, host name, protocol, and more. See [Create network query](/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/build-xql-queries/legacy-query-builder/create-network-query.md). * **Image Load**: Search on module load into process events by module IDs and more. See [Create image load query](/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/build-xql-queries/legacy-query-builder/create-image-load-query.md). * **Registry**: Search on registry creation and modification activity by key, key value, path, and data. See [Create registry query](/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/build-xql-queries/legacy-query-builder/create-registry-query.md). * **Event Log**: Search Windows event logs and Linux system authentication logs by username, log event ID (Windows only), log level, and message. See [Create event log query](/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/build-xql-queries/legacy-query-builder/create-event-log-query.md). * **Network Connections**: Search security event logs by firewall logs, endpoint raw data over your network. See [Create network connections query](/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/build-xql-queries/legacy-query-builder/create-network-connections-query.md). * **Authentications**: Search on authentication events by identity, target outcome, and more. See [Create authentication query](/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/build-xql-queries/legacy-query-builder/create-authentication-query.md). * **All Actions**: Search across all network, registry, file, and process activity by endpoint or process. See [Query across all entities](/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/build-xql-queries/legacy-query-builder/query-across-all-entities.md). The **Query Builder** also provides flexibility for both on-demand query generation and scheduled queries. **Create authentication query** From the Query Builder, you can investigate authentication activity across all ingested authentication logs and data. Some examples of authentication queries you can run include: * Authentication logs by severity * Authentication logs by the event message * Authentication logs for a specific source IP address How to build an authentication query 1. From Cortex Cloud , select **Investigation & Response** → **Search** → **Query Builder**. 2. Select **AUTHENTICATION**. 3. Enter the search criteria for the authentication query. By default, Cortex Cloud will return the activity that matches all the criteria you specify. To exclude a value, toggle the **`=`** option to **`=!`**. 4. Choose when to run the query. Select the calendar icon to schedule a query to run on or before a specific date or Run to run the query immediately and view the results in the Query Center. While the query is running, you can always navigate away from the page and a notification is sent when the query completes. You can also **Cancel** the query or run a new query, where you have the option to **Run only new query (cancel previous)** or **Run both queries**. 5. When you are ready, view the results of the query. For more information, see [Review XQL query results](/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/build-xql-queries/how-to-build-xql-queries/review-xql-query-results.md). **Create event log query** From the **Query Builder** you can search Windows and Linux event log attributes and investigate event logs across endpoints with a Cortex XDR agent installed. Some examples of event log queries you can run include: * Critical level messages on specific endpoints. * Message descriptions with specific keywords on specific endpoints. How to build an event log query 1. From Cortex Cloud , select **Investigation & Response** → **Search** → **Query Builder**. 2. Select **EVENT LOG**. 3. Enter the search criteria for your Windows or Linux event log query. Define any event attributes for which you want to search. By default, Cortex XDR will return the events that match the attribute you specify. To exclude an attribute value, toggle the **`=`** option to **`=!`**. Attributes are: * **PROVIDER NAME**: The provider of the event log. * **USERNAME**: The username associated with the event. * **EVENT ID**: The unique ID of the event. * **LEVEL**: The event severity level. * **MESSAGE**: The description of the event. To specify an additional exception (match this value except), click the **+** to the right of the value and specify the exception value. 4. (*Optional*) Limit the scope to an endpoint or endpoint attributes: Specify one or more of the following attributes: Use a pipe (**|**) to separate multiple values. Use an asterisk (**\***) to match any string of characters. * **HOST**: **HOST NAME**, **HOST IP** address, **HOST OS**, **HOST MAC ADDRESS**, or **INSTALLATION TYPE**. * **INSTALLATION TYPE** can be either Cortex XDR agent or Data Collector. * **PROCESS**: **NAME**, **PATH**, **CMD**, **MD5**, **SHA256**, **USER NAME**, **SIGNATURE**, or **PID**. 5. Specify the time period for which you want to search for events. Options are **Last 24H** (hours), **Last 7D** (days), **Last 1M** (month), or select a **Custom** time period. 6. Choose when to run the query. Select the calendar icon to schedule a query to run on or before a specific date or **Run** to run the query immediately and view the results in the **Query Center**. While the query is running, you can always navigate away from the page, and a notification is sent when the query completes. You can also **Cancel** the query or run a new query, where you have the option to **Run only new query (cancel previous)** or **Run both queries**. 7. When you are ready, view the results of the query. For more information, see [Review XQL query results](/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/build-xql-queries/how-to-build-xql-queries/review-xql-query-results.md). **Create file query** From the **Query Builder** you can investigate connections between file activity and endpoints. The Query Builder searches your logs and endpoint data for the file activity that you specify. To search for files on endpoints instead of file-related activity, build an XQL query. For more information, see [How to build XQL queries](/cortex-cloud-runtime-security/cortex-cloud-xql/build-xql-queries/how-to-build-xql-queries.md). Some examples of file queries you can run include: * Files modified on specific endpoints. * Files related to process activity that exist on specific endpoints. How to build a file query 1. From Cortex Cloud, select **Investigation & Response** → **Search** → **Query Builder**. 2. Select **FILE**. 3. Enter the search criteria for the file events query. * File activity: Select the type or types of file activity you want to search: **All**, **Create**, **Read**, **Rename**, **Delete**, or **Write**. * File attributes: Define any additional process attributes for which you want to search. Use a pipe (**`|`**) to separate multiple values (for example **`notepad.exe|chrome.exe`**). By default, Cortex Cloud will return the events that match the attribute you specify. To exclude an attribute value, toggle the **`=`** option to **`=!`**. Attributes are: * **NAME**: File name. * **PATH**: Path of the file. * **PREVIOUS NAME**: Previous name of a file. * **PREVIOUS PATH**: Previous path of the file. * **MD5**: MD5 hash value of the file. * **SHA256**: SHA256 hash value of the file. * **ACTION\_DISK\_DRIVER\_NAME**: The driver where the file was created. * **FILE\_SYSTEM\_TYPE**: Operating system type where the file was run. * **ACTION\_IS\_VFS**: Denotes if the file is on a virtual file system on the disk. This is relevant only for files that are written to disk. * **DEVICE TYPE**: Type of device used to run the file: Unknown, Fixed, Removable Media, CD-ROM. * **DEVICE SERIAL NUMBER**: Serial number of the device type used to run the file. To specify an additional exception (match this value except), click the **+** to the right of the value and specify the exception value. 4. (Optional) Limit the scope to a specific acting process: Select **+PROCESS** and specify one or more of the following attributes for the acting (parent) process. Use a pipe (**|**) to separate multiple values. Use an asterisk (**\***) to match any string of characters. * **NAME**: Name of the parent process. * **PATH**: Path to the parent process. * **CMD**: Command-line used to initiate the process, including any arguments, up to 128 characters. * **MD5**: MD5 hash value of the process. * **SHA256**: SHA256 hash value of the process. * **USER NAME**: User who executed the process. * **SIGNATURE**: Signing status of the parent process: Signature Unavailable, Signed, Invalid Signature, Unsigned, Revoked, Signature Fail. * **SIGNER**: Entity that signed the certificate of the parent process. * **PID**: Process ID of the parent process. * **Run search for process, Causality, and OS actors**—The causality actor—also referred to as the causality group owner (CGO)—is the parent process in the execution chain that the Cortex XDR agent identified as being responsible for initiating the process tree. The OS actor is the parent process that creates an OS process on behalf of a different indicator. By default, this option is enabled to apply the same search criteria to initiating processes. To configure different attributes for the parent or initiate the process, clear this option. 5. (*Optional*) Limit the scope to an endpoint or endpoint attributes: Select **+Host** and specify one or more of the following attributes: * **HOST**: **HOST NAME**, **HOST IP** address, **HOST OS**, **HOST MAC ADDRESS**, or **INSTALLATION TYPE**. **INSTALLATION TYPE** can be either Cortex XDR agent or Data Collector. * **PROCESS**: **NAME**, **PATH**, **CMD**, **MD5**, **SHA256**, **USER NAME**, **SIGNATURE**, or **PID**. Use a pipe (**|**) to separate multiple values. Use an asterisk (**\***) to match any string of characters. 6. Specify the time period for which you want to search for events. Options are **Last 24H** (hours), **Last 7D** (days), **Last 1M** (month), or select a **Custom** time period. 7. Choose when to run the query. Select the calendar icon to schedule a query to run on or before a specific date or **Run** to run the query immediately and view the results in the **Query Center**. While the query is running, you can always navigate away from the page and a notification is sent when the query completes. You can also **Cancel** the query or run a new query, where you have the option to **Run only new query (cancel previous)** or **Run both queries**. 8. When you are ready, view the results of the query. For more information, see [Review XQL query results](/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/build-xql-queries/how-to-build-xql-queries/review-xql-query-results.md). **Create image load query** From the Query Builder, you can investigate connections between image load activity, acting processes, and endpoints. Some examples of image load queries you can run include: * Module load into process events by module path or hash. How to build an image load query 1. From Cortex Cloud , select **Investigation & Response** → **Search** → **Query Builder**. 2. Select **IMAGE LOAD**. 3. Enter the search criteria for the image load activity query. * Type of image activity: **All**, **Image Load**, or **Change Page Protection**. * Identifying information about the image module: Full **Module Path**, **Module MD5**, or **Module SHA256**. By default, Cortex Cloud will return the activity that matches all the criteria you specify. To exclude a value, toggle the **`=`** option to **`=!`**. 4. (Optional) To limit the scope to a specific source, click the **+** to the right of the value and specify the exception value. Specify one or more attributes for the source. Use a pipe (**|**) to separate multiple values. Use an asterisk (**\***) to match any string of characters. * **NAME**: Name of the parent process. * **PATH**: Path to the parent process. * **CMD**: Command-line used to initiate the process, including any arguments, up to 128 characters. * **MD5**: MD5 hash value of the process. * **SHA256**: SHA256 hash value of the process. * **USER NAME**: User who executed the process. * **SIGNATURE**: Signing status of the parent process: Signature Unavailable, Signed, Invalid Signature, Unsigned, Revoked, Signature Fail. * **SIGNER**: Entity that signed the certificate of the parent process. * **PID**: Process ID of the parent process. **Run search for both the process and the Causality actor**: The causality actor—also referred to as the causality group owner (CGO)—is the parent process in the execution chain that the app identified as being responsible for initiating the process tree. Select this option if you want to apply the same search criteria to the causality actor. If you clear this option, you can then configure different attributes for the causality actor. 5. (*Optional*) Limit the scope to an endpoint or endpoint attributes: Specify one or more of the following attributes: Use a pipe (**|**) to separate multiple values. Use an asterisk (**\***) to match any string of characters. * **HOST**: **HOST NAME**, **HOST IP** address, **HOST OS**, **HOST MAC ADDRESS**, or **INSTALLATION TYPE**. **INSTALLATION TYPE** can be either Cortex XDR agent or Data Collector. * **PROCESS**: **NAME**, **PATH**, **CMD**, **MD5**, **SHA256**, **USER NAME**, **SIGNATURE**, or **PID**. 6. Specify the time period for which you want to search for events. Options are **Last 24H** (hours), **Last 7D** (days), **Last 1M** (month), or select a **Custom** time period. 7. Choose when to run the query. Select the calendar icon to schedule a query to run on or before a specific date or **Run** to run the query immediately and view the results in the **Query Center**. While the query is running, you can always navigate away from the page and a notification is sent when the query completes. You can also **Cancel** the query or run a new query, where you have the option to **Run only new query (cancel previous)** or **Run both queries**. 8. When you are ready, view the results of the query. For more information, see [Review XQL query results](/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/build-xql-queries/how-to-build-xql-queries/review-xql-query-results.md). **Create network connections query** From the Query Builder, you can investigate network events stitched across endpoints and the Palo Alto Networks Next-Generation Firewall logs. Some examples of a network query you can run include: * Source and destination of a process. * Network connections that included a specific App ID * Processes that created network connections. * Network connections between specific endpoints. How to build a network connection query 1. From Cortex Cloud , select **Investigation & Response** → **Search** → **Query Builder**. 2. Select **NETWORK CONNECTIONS**. 3. Enter the search criteria for the network events query. * Network attributes: Define any additional process attributes for which you want to search. Use a pipe (**`|`**) to separate multiple values (for example **`80|8080`**). By default, Cortex Cloud will return the events that match the attribute you specify. To exclude an attribute value, toggle the **`=`** option to **`=!`**. Options are: * **APP ID**: App ID of the network. * **PROTOCOL**: Network transport protocol over which the traffic was sent. * **SESSION STATUS** * **FW DEVICE NAME**: Firewall device name. * **FW RULE**: Firewall rule. * **FW SERIAL ID**: Firewall serial ID. * **PRODUCT** * **VENDOR** To specify an additional exception (match this value except), click the **+** to the right of the value and specify the exception value. 4. (Optional) To limit the scope to a specific source, click the **+** to the right of the value and specify the exception value. Specify one or more attributes for the source. Use a pipe (**|**) to separate multiple values. Use an asterisk (**\***) to match any string of characters. * **HOST NAME**: Name of the source. * **HOST IP**: IP address of the source. * **HOST OS**: Operating system of the source. * **PROCESS NAME**: Name of the process. * **PROCESS PATH**: Path to the process. * **CMD**: Command-line used to initiate the process, including any arguments, up to 128 characters. * **MD5**: MD5 hash value of the process. * **SHA256**: SHA256 hash value of the process. * **PROCESS USER NAME**: User who executed the process. * **SIGNATURE**: Signing status of the parent process: Signature Unavailable, Signed, Invalid Signature, Unsigned, Revoked, Signature Fail. * **PID**: Process ID of the parent process. * **IP**: IP address of the process. * **PORT**: Port number of the process. * **USER ID**: ID of the user who executed the process. * **Run search for both the process and the Causality actor**: The causality actor—also referred to as the causality group owner (CGO)—is the parent process in the execution chain that the app identified as being responsible for initiating the process tree. Select this option if you want to apply the same search criteria to the causality actor. If you clear this option, you can then configure different attributes for the causality actor. 5. (Optional) Limit the scope to a destination. Use a pipe (**|**) to separate multiple values. Use an asterisk (**\***) to match any string of characters. Specify one or more of the following attributes: * **REMOTE IP**: IP address of the destination. * **COUNTRY**: Country of the destination. * Destination **TARGET HOST**,**NAME**, **PORT**, **HOST NAME**, **PROCESS USER NAME**, **HOST IP**, **CMD**, **HOST OS**, **MD5**, **PROCESS PATH**, **USER ID**, **SHA256**, **SIGNATURE**, or **PID** 6. Specify the time period for which you want to search for events. Options are **Last 24H** (hours), **Last 7D** (days), **Last 1M** (month), or select a **Custom** time period. 7. Choose when to run the query. Select the calendar icon to schedule a query to run on or before a specific date or **Run** to run the query immediately and view the results in the **Query Center**. While the query is running, you can always navigate away from the page and a notification is sent when the query completes. You can also **Cancel** the query or run a new query, where you have the option to **Run only new query (cancel previous)** or **Run both queries**. 8. When you are ready, view the results of the query. For more information, see [Review XQL query results](/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/build-xql-queries/how-to-build-xql-queries/review-xql-query-results.md). **Create network query** From the Query Builder, you can investigate connections between network activity, acting processes, and endpoints. Some examples of a network query you can run include: * Network connections to or from a specific IP address and port number. * Processes that created network connections. * Network connections between specific endpoints. How to build a network query 1. From Cortex Cloud , select **Investigation & Response** → **Search** → **Query Builder**. 2. Select **NETWORK**. 3. Enter the search criteria for the network events query. * Network traffic type: Select the type or types of network traffic issues you want to search: **Incoming**, **Outgoing**, or **Failed**. * Network attributes: Define any additional process attributes for which you want to search. Use a pipe (**`|`**) to separate multiple values (for example **`80|8080`**). By default, Cortex Cloud will return the events that match the attribute you specify. To exclude an attribute value, toggle the **`=`** option to **`=!`**. Options are: * **REMOTE COUNTRY**: Country from which the remote IP address originated. * **REMOTE IP**: Remote IP address related to the communication.

Note

When you run the query, depending on the outcome of the results, the value specified in this field might be displayed in the dst_ip field in the query results. This occurs if an RDP event is recorded whereby a user connected from the source IP to the destination IP.

* **REMOTE PORT**: Remote port used to make the connection. * **LOCAL IP**: Local IP address related to the communication. Matches can return additional data if a machine has more than one NIC. * **LOCAL PORT**: Local port used to make the connection. * **PROTOCOL**: Network transport protocol over which the traffic was sent. To specify an additional exception (match this value except), click the **+** to the right of the value and specify the exception value. 4. (Optional) To limit the scope to a specific source, click the **+** to the right of the value and specify the exception value. Specify one or more attributes for the source. Use a pipe (**|**) to separate multiple values. Use an asterisk (**\***) to match any string of characters. * **NAME**: Name of the parent process. * **PATH**: Path to the parent process. * **CMD**: Command-line used to initiate the process, including any arguments, up to 128 characters. * **MD5**: MD5 hash value of the process. * **SHA256**: SHA256 hash value of the process. * **USER NAME**: User who executed the process. * **SIGNATURE**: Signing status of the parent process: Signature Unavailable, Signed, Invalid Signature, Unsigned, Revoked, Signature Fail. * **SIGNER**: Entity that signed the certificate of the parent process. * **PID**: Process ID of the parent process. * **Run search for process, Causality, and OS actors**: The causality actor—also referred to as the causality group owner (CGO)—is the parent process in the execution chain that the Cortex XDR agent identified as being responsible for initiating the process tree. The OS actor is the parent process that creates an OS process on behalf of a different indicator. By default, this option is enabled to apply the same search criteria to initiating processes. To configure different attributes for the parent or initiate the process, clear this option. 5. (*Optional*) Limit the scope to an endpoint or endpoint attributes: Specify one or more of the following attributes: Use a pipe (**|**) to separate multiple values. Use an asterisk (**\***) to match any string of characters. * **HOST**: **HOST NAME**, **HOST IP** address, **HOST OS**, **HOST MAC ADDRESS**, or **INSTALLATION TYPE**. * **INSTALLATION TYPE** can be either Cortex XDR agent or Data Collector. * **PROCESS**: **NAME**, **PATH**, **CMD**, **MD5**, **SHA256**, **USER NAME**, **SIGNATURE**, or **PID**. 6. Specify the time period for which you want to search for events. Options are **Last 24H** (hours), **Last 7D** (days), **Last 1M** (month), or select a **Custom** time period. 7. Choose when to run the query. Select the calendar icon to schedule a query to run on or before a specific date or **Run** to run the query immediately and view the results in the **Query Center**. While the query is running, you can always navigate away from the page and a notification is sent when the query completes. You can also **Cancel** the query or run a new query, where you have the option to **Run only new query (cancel previous)** or **Run both queries**. 8. When you are ready, view the results of the query. For more information, see [Review XQL query results](/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/build-xql-queries/how-to-build-xql-queries/review-xql-query-results.md). **Create process query** From the **Query Builder** you can investigate connections between processes, child processes, and endpoints. For example, you can create a process query to search for processes executed on a specific endpoint. How to build a process query 1. From Cortex Cloud , select **Investigation & Response** → **Search** → **Query Builder**. 2. Select **PROCESS**. 3. Enter the search criteria for the process query. * Process action: Select the type of process action you want to search: On process **Execution** or **Injection** into another process. * Process attributes—Define any additional process attributes for which you want to search. Use a pipe (**`|`**) to separate multiple values. Use an asterisk (**`*`**) to match any string of characters. By default, Cortex Cloud will return results that match the attribute you specify. To exclude an attribute value, toggle the operator from **`=`** to **`!=`**. Attributes are: * **NAME**: Name of the process. For example, `notepad.exe`. * **PATH**: Path to the process. For example, `C:\windows\system32\notepad.exe`. * **CMD**: Command-line used to initiate the process including any arguments, up to 128 characters. * **MD5**: MD5 hash value of the process. * **SHA256**: SHA256 hash value of the process. * **USER NAME**: User who executed the process. * **SIGNATURE**: Signing status of the process: Signature Unavailable, Signed, Invalid Signature, Unsigned, Revoked, Signature Fail. * **SIGNER**: Signer of the process. * **PID**: Process ID. * **PROCESS\_FILE\_INFO**: Metadata of the process file, including file property details, file entropy, company name, encryption status, and version number. * **PROCESS\_SCHEDULED\_TASK\_NAME**: Name of the task scheduled by the process to run in the Task Scheduler. * **PROCESS\_TOKEN\_INFORMATION**: Bitwise token of the process privileges. * **DEVICE TYPE**: Type of device used to run the process: Unknown, Fixed, Removable Media, CD-ROM. * **DEVICE SERIAL NUMBER**: Serial number of the device type used to run the process. To specify an additional exception (match this value except), click the **+** to the right of the value and specify the exception value. 4. (Optional) Limit the scope to a specific acting process: Select **+PROCESS** and specify one or more of the following attributes for the acting (parent) process. * **NAME**: Name of the parent process. * **PATH**: Path to the parent process. * **CMD**: Command-line used to initiate the parent process including any arguments, up to 128 characters. * **MD5**: MD5 hash value of the parent process. * **SHA256**: SHA256 hash value of the process. * **USER NAME**: User who executed the process. * **SIGNATURE**: Signing status of the parent process: Signed, Unsigned, N/A, Invalid Signature, Weak Hash * **SIGNER**: Entity that signed the certificate of the parent process. * **PID**: Process ID of the parent process. * **Run search on process, Causality and OS actors**: The causality actor—also referred to as the causality group owner (CGO)—is the parent process in the execution chain that the Cortex XDR agent identified as being responsible for initiating the process tree. The OS actor is the parent process that creates an OS process on behalf of a different initiator. By default, this option is enabled to apply the same search criteria to initiating processes. To configure different attributes for the parent or initiate a process, 5. (Optional) Limit the scope to an endpoint or endpoint attributes: Select **+HOST** and specify one or more of the following attributes: * **HOST**: **HOST NAME**, **HOST IP** address, **HOST OS**, **HOST MAC ADDRESS**, or **INSTALLATION TYPE**. **INSTALLATION TYPE** can be Cortex XDR agent. * **PROCESS**: **NAME**, **PATH**, **CMD**, **MD5**, **SHA256**, **USER NAME**, **SIGNATURE**, or **PID**. 6. Specify the time period for which you want to search for events. Options are **Last 24H** (hours), **Last 7D** (days), **Last 1M** (month), or select a **Custom** time period. 7. Choose when to run the query. Select the calendar icon to schedule a query to run on or before a specific date or **Run** to run the query immediately and view the results in the **Query Center**. While the query is running, you can always navigate away from the page and a notification is sent when the query completes. You can also **Cancel** the query or run a new query, where you have the option to **Run only new query (cancel previous)** or **Run both queries**. 8. When you are ready, view the results of the query. For more information, see [Review XQL query results](/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/build-xql-queries/how-to-build-xql-queries/review-xql-query-results.md). **Create registry query** From the Query Builder you can investigate connections between registry activity, processes, and endpoints. Some examples of a registry query you can run include: * Modified registry keys on specific endpoints. * Registry keys related to process activity that exist on specific endpoints. How to build a registry query 1. From Cortex Cloud , select **Investigation & Response** → **Search** → **Query Builder**. 2. Select **REGISTRY**. 3. Enter the search criteria for the registry events query. * Registry action: Select the type or types of registry actions you want to search: **Key Create**, **Key Delete**, **Key Rename**, **Value Set**, or **Value Delete**. * Registry attributes: Define any additional registry attributes for which you want to search. By default, Cortex Cloud will return the events that match the attribute you specify. To exclude an attribute value, toggle the **`=`** option to **`=!`**. Attributes are: * **KEY NAME**: Registry key name.

Important

Ensure the KEY NAME is entered as a real registry key name, and not as a symbolic link. Otherwise, the query will not retrieve results.

Example 195.

Instead of HKEY_LOCAL_MACHINE\System\CurrentControlSet, which is a symbolic link, use KEY_LOCAL_MACHINE\System\ControlSet001.

Example 196.

Instead of HKEY_CURRENT_USER, use HKEY_USERS\<SID>, where SID is either a SID of the current user or an asterisk (*) to represent any SID.

* **DATA**: Registry key data value. * **KEY PREVIOUS NAME**: Name of the registry key before modification. * **VALUE NAME**: Registry value name. To specify an additional exception (match this value except), click the **+** to the right of the value and specify the exception value. 4. (Optional) To limit the scope to a specific source, click the **+** to the right of the value and specify the exception value. Specify one or more attributes for the source. Use a pipe (**|**) to separate multiple values. Use an asterisk (**\***) to match any string of characters. * **NAME**: Name of the parent process. * **PATH**: Path to the parent process. * **CMD**: Command-line used to initiate the process including any arguments, up to 128 characters. * **MD5**: MD5 hash value of the process. * **SHA256**: SHA256 hash value of the process. * **USER NAME**: User who executed the process. * **SIGNATURE**: Signing status of the parent process: Signature Unavailable, Signed, Invalid Signature, Unsigned, Revoked, Signature Fail. * **SIGNER**: Entity that signed the certificate of the parent process. * **PID**: Process ID of the parent process. * **Run search for process, Causality, and OS actors**: The causality actor—also referred to as the causality group owner (CGO)—is the parent process in the execution chain that the Cortex XDR agent identified as being responsible for initiating the process tree. The OS actor is the parent process that creates an OS process on behalf of a different indicator. By default, this option is enabled to apply the same search criteria to initiating processes. To configure different attributes for the parent or initiate the process, clear this option. 5. (*Optional*) Limit the scope to an endpoint or endpoint attributes: Specify one or more of the following attributes: Use a pipe (**|**) to separate multiple values. Use an asterisk (**\***) to match any string of characters. * **HOST**: **HOST NAME**, **HOST IP** address, **HOST OS**, **HOST MAC ADDRESS**, or **INSTALLATION TYPE**. * **INSTALLATION TYPE** can be either Cortex XDR agent or Data Collector. * **PROCESS**: **NAME**, **PATH**, **CMD**, **MD5**, **SHA256**, **USER NAME**, **SIGNATURE**, or **PID**. 6. Specify the time period for which you want to search for events. Options are **Last 24H** (hours), **Last 7D** (days), **Last 1M** (month), or select a **Custom** time period. 7. Choose when to run the query. Select the calendar icon to schedule a query to run on or before a specific date or **Run** to run the query immediately and view the results in the **Query Center**. While the query is running, you can always navigate away from the page and a notification is sent when the query completes. You can also **Cancel** the query or run a new query, where you have the option to **Run only new query (cancel previous)** or **Run both queries**. 8. When you are ready, view the results of the query. For more information, see [Review XQL query results](/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/build-xql-queries/how-to-build-xql-queries/review-xql-query-results.md). **Query across all entities** From the **Query Builder** you can perform a simple search for hosts and processes across all file events, network events, registry events, process events, event logs for Windows, and system authentication logs for Linux. Some examples of queries you can run across all entities include: * All activities on a host * All activities initiated by a process on a host How to build a query 1. From Cortex Cloud , select **Investigation & Response** → **Search** → **Query Builder**. 2. Select **ALL ACTIONS**. 3. (Optional) Limit the scope to a specific acting process: Select Add Process to your search, and specify one or more of the following attributes for the acting (parent) process. Use a pipe (|) to separate multiple values. Use an asterisk (\*) to match any string of characters. | Field | Description | | ---------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | NAME | Name of the parent process. | | PATH | Path to the parent process. | | CMD | Command line used to initiate the parent process including any arguments, up to 128 characters. | | MD5 | MD5 hash value of the parent process. | | SHA256 | SHA256 hash value of the process. | | USER NAME | User who executed the process. | | SIGNATURE | Signing status of the parent process: Signed, Unsigned, N/A, Invalid Signature, Weak Hash. | | SIGNER | Entity that signed the certificate of the parent process. | | PID | Process ID of the parent process. | | Run search on process, Causality and OS actors | The causality actor, also referred to as the causality group owner (CGO), is the parent process in the execution chain that the agent identified as being responsible for initiating the process tree. The OS actor is the parent process that creates an OS process on behalf of a different initiator. By default, this option is enabled to apply the same search criteria to initiating processes. To configure different attributes for the parent or initiating process, clear this option. | 4. (Optional) Limit the scope to an endpoint or endpoint attributes: Select Add Host to your search and specify one or more of the following attributes: * HOST: HOST NAME, HOST IP address, HOST OS, HOST ADDRESS, or INSTALLATION TYPE. * INSTALLATION TYPE can be either an agent, or data collector. * PROCESS: NAME , PATH , CMD , MD5 , SHA256 , USER NAME , SIGNATURE, or PID. Use a pipe (|) to separate multiple values. Use an asterisk (\*) to match any string of characters. 5. Specify the time period for which you want to search for events. Options are Last 24H (hours), Last7D (days), Last1M (month), or select a Custom time period. 6. Choose when to run the query. Select the calendar icon to schedule a query to run on or before a specific date or Run the query immediately and view the results in the Query Center. While the query is running, you can always navigate away from the page and a notification is sent when the query completes. You can also **Cancel** the query or run a new query, where you have the option to **Run only new query (cancel previous)** or **Run both queries**. 7. When ready, view the results in a query. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-xql/build-xql-queries/xql-query-entities.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.