> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/graph-search/how-to-build-graph-search-queries.md).
# How to build Graph Search queries?
{% hint style="warning" %}
### Prerequisite
Graph Search requires **View** or **View/Edit** RBAC permissions for **Graph Search** under **Investigation & Response** → **Search**.
{% endhint %}
You can build Graph Search queries using the built-in query interface embedded in the Query Builder. Graph queries are composed of assets, findings, and relationship types that connect them. These data objects are represented by nodes and edges, and the paths are found based on the contextual data. Every query is structured to use a certain pattern and includes these default data objects that you define by selecting the available assets and findings that you want to query in the graph. The output is provided by default in a Graph format, but you can also view the results as a Table format. The resulting graph provides an illustration of the nodes, node attributes, and edges that can connect two nodes based on your selections in the query.
To support multi-cloud and hybrid environments efficiently and intuitively, Graph Search queries use a normalized data model that attempts to optimize finding categories of assets and findings. A subset of assets and finding types, referred to as nodes and edges, is supported. For more information, see [Supported assets and findings](/cortex-cloud-runtime-security/graph-search/supported-assets-and-findings.md).
You submit Graph Search queries using the **Investigation & Response** → **Search** → **Query Builder** → **Graph Search** built-in query interface.
Show me around the Graph Search built-in query interface
Keywords in the query interface
There are different key words that are included in the Graph Search query interface, which, as you select them, guide you through the query-building process:
* **FIND**: Defines the start of any Graph Search query, which is followed by the relevant node (entity) types.
* **Select** (mandatory): Opens the node picker dialog box, where you can select the different node types. Multiple nodes are defined with an `OR` relationship between them. The top-level node selection acts as the root of the query. There are two different types of nodes, where each node has its own unique shape, icon, and color:
* **Asset nodes**: Each asset node is depicted as a circle in the resulting graph, where the color and icon displayed is dependent on the asset category and class types selected. There are multiple class types available for each asset node category selected. Once a class type is selected in the node picker dialog box, and you hover over it, all the available asset types are listed. For more information, see [All assets](/cortex-cloud-runtime-security/asset-managment/all-assets.md).
* **Finding nodes**: Each finding node is depicted as a diamond in the resulting graph, where the color and icon displayed is dependent on the finding type selected. There is only one category type available for each finding selected.
* **WHERE**: List of conditions that apply to the node types that were selected following the `FIND`/`THAT` statements. The conditions are based on node attributes and their values. At each level of the query, the relationship between node attribute conditions is `AND`. No other logical operator is available.
For each attribute type, there is a defined behavior for filtering data:
* Array values with `OR` relationship.
* Multi-selection (`OR` relationship) from a predefined ENUM.
* Multi-selection (`OR` relationship) from a list of data objects that exist in the Graph Search database. For example, the scope of cloud accounts enables you to choose from the available cloud account object that exists in the database.
The attribute operators are used to define the standard operators, such as `Contains` and `Greater than`. Depending on the attribute selected, different attribute operators are available.
* **THAT**: Defines the relationship between nodes as every `THAT` marks an edge to the next node type. The possible edges are selected based on the graph schema. You can add a **THAT** statement to a Graph Search query by clicking the **+** icon available on each line of the query interface.
Providing feedback
Use the **Have Feedback?** link in the Graph Search query interface to provide valuable feedback about the feature and any improvements you'd recommend.
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/graph-search/how-to-build-graph-search-queries.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.