> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-commands-guide/xql-commands.md).
# XQL Commands
* [getXQLQueryResults](#getxqlqueryresults)
* [getXQLQuota](#getxqlquota)
* [runXQLDNSQuery](#runxqldnsquery)
* [runXQLDllModuleQuery](#runxqldllmodulequery)
* [runXQLEventLogQuery](#runxqleventlogquery)
* [runXQLFileDropperQuery](#runxqlfiledropperquery)
* [runXQLFileEventQuery](#runxqlfileeventquery)
* [runXQLNetworkConnectionQuery](#runxqlnetworkconnectionquery)
* [runXQLProcessCausalityNetworkActivityQuery](#runxqlprocesscausalitynetworkactivityquery)
* [runXQLProcessEventQuery](#runxqlprocesseventquery)
* [runXQLProcessInstanceNetworkActivityQuery](#runxqlprocessinstancenetworkactivityquery)
* [runXQLQuery](#runxqlquery)
* [runXQLRegistryQuery](#runxqlregistryquery)
#### getXQLQueryResults
***
Returns the results of a previously executed XQL query using its execution ID.
Note: This is a polling command.
Arguments
| Argument Name | Description | Required |
| --------------------- | ------------------------------------------------------------------------------------------------------------------------------------- | -------- |
| query\_id | The execution ID returned when starting an XQL query. | Required |
| query\_name | An optional display label for the query results. When provided, it overrides the server-derived execution name in the output context. | Optional |
| interval\_in\_seconds | The polling interval in seconds between each query-status check. Default is 30. | Optional |
| timeout\_in\_seconds | The total polling timeout in seconds. Default is 600. | Optional |
Outputs
**GenericXQLQuery.execution\_id** *string*
An integer representing the unique ID of the XQL query execution.
**GenericXQLQuery.status** *string*
String representing the status of the Query; SUCCESS, FAIL, or PENDING.
**GenericXQLQuery.error\_details** *string*
Error information in case of a failed query.
**GenericXQLQuery.query\_url** *string*
URL to view the complete query results in the Query Center.
**GenericXQLQuery.number\_of\_results** *number*
Integer representing the number of results returned.
**GenericXQLQuery.results** *unknown*
The results returned by the query.
**GenericXQLQuery.query\_limit\_modified** *string*
Contains a message if the query's LIMIT clauses were automatically reduced to the maximum supported limit.
**GenericXQLQuery.widget\_name** *string*
The name of the widget to display the query results.
**GenericXQLQuery.widget\_description** *string*
A description of the widget associated with the query results.
**GenericXQLQuery.query\_name** *string*
The name of the query, used for identification purposes.
**GenericXQLQuery.timeframe** *unknown*
The timeframe used for the query execution.
**GenericXQLQuery.view\_def** *unknown*
The view definition data for the query graph.
**GenericXQLQuery.graph\_data** *unknown*
The graph data for the query visualization.
#### getXQLQuota
***
Returns the XQL query quota allocated to and used by the tenant.
**Arguments**
There are no input arguments for this command.
Outputs
**PaloAltoNetworksXQL.Quota.additional\_purchased\_quota** *number*
Amount of query quota purchased.
**PaloAltoNetworksXQL.Quota.current\_concurrent\_active\_queries\_count** *number*
Amount of currently active concurrent queries.
**PaloAltoNetworksXQL.Quota.daily\_used\_quota** *number*
Amount of query quota used over the past 24 hours.
**PaloAltoNetworksXQL.Quota.eval\_quota** *number*
Amount of evaluation query quota.
**PaloAltoNetworksXQL.Quota.license\_quota** *number*
Amount of daily quota allocated to the tenant based on license type and size.
**PaloAltoNetworksXQL.Quota.max\_daily\_concurrent\_active\_query\_count** *number*
Maximum number of daily concurrent active queries.
**PaloAltoNetworksXQL.Quota.total\_daily\_concurrent\_rejected\_queries** *number*
Total number of daily concurrent rejected queries.
**PaloAltoNetworksXQL.Quota.total\_daily\_running\_queries** *number*
Total number of daily running queries.
**PaloAltoNetworksXQL.Quota.used\_quota** *number*
Amount of query quota used over the past 24 hours.
#### runXQLDNSQuery
***
Query by DNS query or domain name.
Note: This is a polling command.
Arguments
| Argument Name | Description | Required |
| --------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------- |
| external\_domain | A comma-separated list of external domain names to query by. | Optional |
| dns\_query | A comma-separated list of DNS queries to query by. | Optional |
| endpoint\_id | A comma-separated list of endpoint IDs to run the query on. The default is all endpoints. | Optional |
| extra\_fields | A comma-separated list of extra fields to add to the query results. | Optional |
| query\_name | An optional display label for the query results. When provided, it overrides the server-derived execution name in the output context. | Optional |
| timeframe | Time in relative date or range format (for example: "1 day", "3 weeks ago", "between 2021-01-01 12:34:56 +02:00 and 2021-02-01 12:34:56 +02:00"). The default is the last 7 days. Default is 7 days. | Optional |
| limit | The maximum number of results to return. Default is 100. | Optional |
| interval\_in\_seconds | The polling interval in seconds between each query-status check. Default is 30. | Optional |
| timeout\_in\_seconds | The total polling timeout in seconds. Default is 600. | Optional |
| tenant\_id | A comma-separated list of tenant IDs used for running APIs on local and Managed Security tenants. For a single tenant (local tenant) query, provide a single tenant ID; an empty value (default) runs on the local tenant. For multi-tenant investigations (a Managed Security parent investigating children and/or local), provide multiple tenant IDs, which can include the parent, children, or both. | Optional |
Outputs
**PaloAltoNetworksXQL.DNS.query\_name** *string*
The given name of the query.
**PaloAltoNetworksXQL.DNS.execution\_id** *string*
A unique ID of the XQL query execution.
**PaloAltoNetworksXQL.DNS.status** *string*
String representing the status of the query; SUCCESS, FAIL, or PENDING.
**PaloAltoNetworksXQL.DNS.number\_of\_results** *number*
Integer representing the number of results returned.
**PaloAltoNetworksXQL.DNS.results.agent\_hostname** *string*
The agent host name.
**PaloAltoNetworksXQL.DNS.results.agent\_ip\_addresses** *unknown*
The agent IP addresses.
**PaloAltoNetworksXQL.DNS.results.agent\_id** *string*
Endpoint ID.
**PaloAltoNetworksXQL.DNS.results.agent\_os\_type** *string*
Host operating system.
**PaloAltoNetworksXQL.DNS.results.agent\_os\_sub\_type** *string*
Agent operating system subtype.
**PaloAltoNetworksXQL.DNS.results.action\_local\_ip** *string*
Local IP address.
**PaloAltoNetworksXQL.DNS.results.action\_remote\_ip** *string*
Remote IP address.
**PaloAltoNetworksXQL.DNS.results.action\_remote\_port** *string*
Remote port.
**PaloAltoNetworksXQL.DNS.results.dst\_action\_external\_hostname** *string*
External hostname.
**PaloAltoNetworksXQL.DNS.results.dns\_query\_name** *string*
DNS query name.
**PaloAltoNetworksXQL.DNS.results.action\_app\_id\_transitions** *unknown*
List of application IDs action. Actual activities that took place and recorded by the agent.
**PaloAltoNetworksXQL.DNS.results.action\_total\_download** *string*
Total downloads.
**PaloAltoNetworksXQL.DNS.results.action\_total\_upload** *string*
Total uploads.
**PaloAltoNetworksXQL.DNS.results.action\_country** *string*
Action country.
**PaloAltoNetworksXQL.DNS.results.action\_as\_data** *string*
The action as data.
**PaloAltoNetworksXQL.DNS.results.os\_actor\_process\_image\_path** *string*
Operating system parent path.
**PaloAltoNetworksXQL.DNS.results.os\_actor\_process\_command\_line** *string*
Command line arguments of the operating system parent.
**PaloAltoNetworksXQL.DNS.results.os\_actor\_process\_instance\_id** *string*
Initiator instance ID.
**PaloAltoNetworksXQL.DNS.results.os\_actor\_process\_causality\_id** *string*
Initiator causality ID.
**PaloAltoNetworksXQL.DNS.results.\_vendor** *string*
The result vendor.
**PaloAltoNetworksXQL.DNS.results.\_time** *string*
Result time.
**PaloAltoNetworksXQL.DNS.results.insert\_timestamp** *string*
Result insert timestamp.
**PaloAltoNetworksXQL.DNS.results.\_product** *string*
The result product.
#### runXQLDllModuleQuery
***
Returns DLL module load events filtered by SHA256 module hash using a built-in XQL query.
Note: This is a polling command.
Arguments
| Argument Name | Description | Required |
| ---------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------- |
| loaded\_module\_sha256 | A comma-separated list of SHA256 loaded-module hashes to filter on. | Required |
| endpoint\_id | A comma-separated list of endpoint IDs to run the query on. The default is all endpoints. | Optional |
| extra\_fields | A comma-separated list of extra fields to add to the query results. | Optional |
| query\_name | An optional display label for the query results. When provided, it overrides the server-derived execution name in the output context. | Optional |
| timeframe | Time in relative date or range format (for example: "1 day", "3 weeks ago", "between 2021-01-01 12:34:56 +02:00 and 2021-02-01 12:34:56 +02:00"). The default is the last 7 days. Default is 7 days. | Optional |
| limit | The maximum number of results to return. Default is 100. | Optional |
| interval\_in\_seconds | The polling interval in seconds between each query-status check. Default is 30. | Optional |
| timeout\_in\_seconds | The total polling timeout in seconds. Default is 600. | Optional |
| tenant\_id | A comma-separated list of tenant IDs used for running APIs on local and Managed Security tenants. For a single tenant (local tenant) query, provide a single tenant ID; an empty value (default) runs on the local tenant. For multi-tenant investigations (a Managed Security parent investigating children and/or local), provide multiple tenant IDs, which can include the parent, children, or both. | Optional |
Outputs
**PaloAltoNetworksXQL.DllModule.execution\_id** *string*
An integer representing the unique ID of the XQL query execution.
**PaloAltoNetworksXQL.DllModule.status** *string*
String representing the status of the Query; SUCCESS, FAIL, or PENDING.
**PaloAltoNetworksXQL.DllModule.error\_details** *string*
Error information in case of a failed query.
**PaloAltoNetworksXQL.DllModule.query\_url** *string*
URL to view the complete query results in the Query Center.
**PaloAltoNetworksXQL.DllModule.number\_of\_results** *number*
Integer representing the number of results returned.
**PaloAltoNetworksXQL.DllModule.results** *unknown*
The results returned by the query.
**PaloAltoNetworksXQL.DllModule.query\_limit\_modified** *string*
Contains a message if the query's LIMIT clauses were automatically reduced to the maximum supported limit.
**PaloAltoNetworksXQL.DllModule.widget\_name** *string*
The name of the widget to display the query results.
**PaloAltoNetworksXQL.DllModule.widget\_description** *string*
A description of the widget associated with the query results.
**PaloAltoNetworksXQL.DllModule.query\_name** *string*
The name of the query, used for identification purposes.
**PaloAltoNetworksXQL.DllModule.timeframe** *unknown*
The timeframe used for the query execution.
**PaloAltoNetworksXQL.DllModule.view\_def** *unknown*
The view definition data for the query graph.
**PaloAltoNetworksXQL.DllModule.graph\_data** *unknown*
The graph data for the query visualization.
#### runXQLEventLogQuery
***
Query event logs by event ID.
Note: This is a polling command.
Arguments
| Argument Name | Description | Required |
| --------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------- |
| event\_id | A comma-separated list of numeric event log IDs to search. | Required |
| endpoint\_id | A comma-separated list of endpoint IDs to run the query on. The default is all endpoints. | Optional |
| extra\_fields | A comma-separated list of extra fields to add to the query results. | Optional |
| query\_name | An optional display label for the query results. When provided, it overrides the server-derived execution name in the output context. | Optional |
| timeframe | Time in relative date or range format (for example: "1 day", "3 weeks ago", "between 2021-01-01 12:34:56 +02:00 and 2021-02-01 12:34:56 +02:00"). The default is the last 7 days. Default is 7 days. | Optional |
| limit | The maximum number of results to return. Default is 100. | Optional |
| interval\_in\_seconds | The polling interval in seconds between each query-status check. Default is 30. | Optional |
| timeout\_in\_seconds | The total polling timeout in seconds. Default is 600. | Optional |
| tenant\_id | A comma-separated list of tenant IDs used for running APIs on local and Managed Security tenants. For a single tenant (local tenant) query, provide a single tenant ID; an empty value (default) runs on the local tenant. For multi-tenant investigations (a Managed Security parent investigating children and/or local), provide multiple tenant IDs, which can include the parent, children, or both. | Optional |
Outputs
**PaloAltoNetworksXQL.EventLog.query\_name** *string*
The given name of the query.
**PaloAltoNetworksXQL.EventLog.execution\_id** *string*
A unique ID of the XQL query execution.
**PaloAltoNetworksXQL.EventLog.status** *string*
String representing the status of the query; SUCCESS, FAIL, or PENDING.
**PaloAltoNetworksXQL.EventLog.number\_of\_results** *number*
Integer representing the number of results returned.
**PaloAltoNetworksXQL.EventLog.results.agent\_hostname** *string*
The agent host name.
**PaloAltoNetworksXQL.EventLog.results.agent\_ip\_addresses** *unknown*
The agent IP addresses.
**PaloAltoNetworksXQL.EventLog.results.agent\_id** *string*
Endpoint ID.
**PaloAltoNetworksXQL.EventLog.results.agent\_os\_type** *string*
Host operating system.
**PaloAltoNetworksXQL.EventLog.results.agent\_os\_sub\_type** *string*
Agent operating system subtype.
**PaloAltoNetworksXQL.EventLog.results.action\_evtlog\_event\_id** *string*
Event log ID.
**PaloAltoNetworksXQL.EventLog.results.event\_type** *string*
Event type.
**PaloAltoNetworksXQL.EventLog.results.event\_sub\_type** *string*
Event subtype.
**PaloAltoNetworksXQL.EventLog.results.action\_evtlog\_message** *string*
Event log message.
**PaloAltoNetworksXQL.EventLog.results.action\_evtlog\_provider\_name** *string*
Event log provider name.
**PaloAltoNetworksXQL.EventLog.results.\_vendor** *string*
The result vendor.
**PaloAltoNetworksXQL.EventLog.results.\_time** *string*
Result time.
**PaloAltoNetworksXQL.EventLog.results.insert\_timestamp** *string*
Result insert timestamp.
**PaloAltoNetworksXQL.EventLog.results.\_product** *string*
The result product.
#### runXQLFileDropperQuery
***
Returns file dropper events filtered by file path and/or SHA256 file hash using a built-in XQL query.
Note: This is a polling command.
Arguments
| Argument Name | Description | Required |
| --------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------- |
| file\_path | A comma-separated list of file paths to filter on. At least one of 'file\_path' or 'file\_sha256' is required. | Optional |
| file\_sha256 | A comma-separated list of SHA256 file hashes to filter on. At least one of 'file\_path' or 'file\_sha256' is required. | Optional |
| endpoint\_id | A comma-separated list of endpoint IDs to run the query on. The default is all endpoints. | Optional |
| extra\_fields | A comma-separated list of extra fields to add to the query results. | Optional |
| query\_name | An optional display label for the query results. When provided, it overrides the server-derived execution name in the output context. | Optional |
| timeframe | Time in relative date or range format (for example: "1 day", "3 weeks ago", "between 2021-01-01 12:34:56 +02:00 and 2021-02-01 12:34:56 +02:00"). The default is the last 7 days. Default is 7 days. | Optional |
| limit | The maximum number of results to return. Default is 100. | Optional |
| interval\_in\_seconds | The polling interval in seconds between each query-status check. Default is 30. | Optional |
| timeout\_in\_seconds | The total polling timeout in seconds. Default is 600. | Optional |
| tenant\_id | A comma-separated list of tenant IDs used for running APIs on local and Managed Security tenants. For a single tenant (local tenant) query, provide a single tenant ID; an empty value (default) runs on the local tenant. For multi-tenant investigations (a Managed Security parent investigating children and/or local), provide multiple tenant IDs, which can include the parent, children, or both. | Optional |
Outputs
**PaloAltoNetworksXQL.FileDropper.execution\_id** *string*
An integer representing the unique ID of the XQL query execution.
**PaloAltoNetworksXQL.FileDropper.status** *string*
String representing the status of the Query; SUCCESS, FAIL, or PENDING.
**PaloAltoNetworksXQL.FileDropper.error\_details** *string*
Error information in case of a failed query.
**PaloAltoNetworksXQL.FileDropper.query\_url** *string*
URL to view the complete query results in the Query Center.
**PaloAltoNetworksXQL.FileDropper.number\_of\_results** *number*
Integer representing the number of results returned.
**PaloAltoNetworksXQL.FileDropper.results** *unknown*
The results returned by the query.
**PaloAltoNetworksXQL.FileDropper.query\_limit\_modified** *string*
Contains a message if the query's LIMIT clauses were automatically reduced to the maximum supported limit.
**PaloAltoNetworksXQL.FileDropper.widget\_name** *string*
The name of the widget to display the query results.
**PaloAltoNetworksXQL.FileDropper.widget\_description** *string*
A description of the widget associated with the query results.
**PaloAltoNetworksXQL.FileDropper.query\_name** *string*
The name of the query, used for identification purposes.
**PaloAltoNetworksXQL.FileDropper.timeframe** *unknown*
The timeframe used for the query execution.
**PaloAltoNetworksXQL.FileDropper.view\_def** *unknown*
The view definition data for the query graph.
**PaloAltoNetworksXQL.FileDropper.graph\_data** *unknown*
The graph data for the query visualization.
#### runXQLFileEventQuery
***
Returns file events filtered by SHA256 file hash using a built-in XQL query.
Note: This is a polling command.
Arguments
| Argument Name | Description | Required |
| --------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------- |
| file\_sha256 | A comma-separated list of SHA256 file hashes to filter on. | Required |
| endpoint\_id | A comma-separated list of endpoint IDs to run the query on. The default is all endpoints. | Optional |
| extra\_fields | A comma-separated list of extra fields to add to the query results. | Optional |
| query\_name | An optional display label for the query results. When provided, it overrides the server-derived execution name in the output context. | Optional |
| timeframe | Time in relative date or range format (for example: "1 day", "3 weeks ago", "between 2021-01-01 12:34:56 +02:00 and 2021-02-01 12:34:56 +02:00"). The default is the last 7 days. Default is 7 days. | Optional |
| limit | The maximum number of results to return. Default is 100. | Optional |
| interval\_in\_seconds | The polling interval in seconds between each query-status check. Default is 30. | Optional |
| timeout\_in\_seconds | The total polling timeout in seconds. Default is 600. | Optional |
| tenant\_id | A comma-separated list of tenant IDs used for running APIs on local and Managed Security tenants. For a single tenant (local tenant) query, provide a single tenant ID; an empty value (default) runs on the local tenant. For multi-tenant investigations (a Managed Security parent investigating children and/or local), provide multiple tenant IDs, which can include the parent, children, or both. | Optional |
Outputs
**PaloAltoNetworksXQL.FileEvent.execution\_id** *string*
An integer representing the unique ID of the XQL query execution.
**PaloAltoNetworksXQL.FileEvent.status** *string*
String representing the status of the Query; SUCCESS, FAIL, or PENDING.
**PaloAltoNetworksXQL.FileEvent.error\_details** *string*
Error information in case of a failed query.
**PaloAltoNetworksXQL.FileEvent.query\_url** *string*
URL to view the complete query results in the Query Center.
**PaloAltoNetworksXQL.FileEvent.number\_of\_results** *number*
Integer representing the number of results returned.
**PaloAltoNetworksXQL.FileEvent.results** *unknown*
The results returned by the query.
**PaloAltoNetworksXQL.FileEvent.query\_limit\_modified** *string*
Contains a message if the query's LIMIT clauses were automatically reduced to the maximum supported limit.
**PaloAltoNetworksXQL.FileEvent.widget\_name** *string*
The name of the widget to display the query results.
**PaloAltoNetworksXQL.FileEvent.widget\_description** *string*
A description of the widget associated with the query results.
**PaloAltoNetworksXQL.FileEvent.query\_name** *string*
The name of the query, used for identification purposes.
**PaloAltoNetworksXQL.FileEvent.timeframe** *unknown*
The timeframe used for the query execution.
**PaloAltoNetworksXQL.FileEvent.view\_def** *unknown*
The view definition data for the query graph.
**PaloAltoNetworksXQL.FileEvent.graph\_data** *unknown*
The graph data for the query visualization.
#### runXQLNetworkConnectionQuery
***
Query network connections between a source IP, destination IP and port.
Note: This is a polling command.
Arguments
| Argument Name | Description | Required |
| --------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------- |
| remote\_ip | A comma-separated list of destination IPs of the network connection query. | Required |
| local\_ip | A comma-separated list of source IPs of the network connection query. | Optional |
| port | A comma-separated list of destination ports of the network connection query. | Optional |
| endpoint\_id | A comma-separated list of endpoint IDs to run the query on. The default is all endpoints. | Optional |
| extra\_fields | A comma-separated list of extra fields to add to the query results. | Optional |
| query\_name | An optional display label for the query results. When provided, it overrides the server-derived execution name in the output context. | Optional |
| timeframe | Time in relative date or range format (for example: "1 day", "3 weeks ago", "between 2021-01-01 12:34:56 +02:00 and 2021-02-01 12:34:56 +02:00"). The default is the last 7 days. Default is 7 days. | Optional |
| limit | The maximum number of results to return. Default is 100. | Optional |
| interval\_in\_seconds | The polling interval in seconds between each query-status check. Default is 30. | Optional |
| timeout\_in\_seconds | The total polling timeout in seconds. Default is 600. | Optional |
| tenant\_id | A comma-separated list of tenant IDs used for running APIs on local and Managed Security tenants. For a single tenant (local tenant) query, provide a single tenant ID; an empty value (default) runs on the local tenant. For multi-tenant investigations (a Managed Security parent investigating children and/or local), provide multiple tenant IDs, which can include the parent, children, or both. | Optional |
Outputs
**PaloAltoNetworksXQL.NetworkConnection.query\_name** *string*
The given name of the query.
**PaloAltoNetworksXQL.NetworkConnection.execution\_id** *string*
A unique ID of the XQL query execution.
**PaloAltoNetworksXQL.NetworkConnection.status** *string*
String representing the status of the query; SUCCESS, FAIL, or PENDING.
**PaloAltoNetworksXQL.NetworkConnection.number\_of\_results** *number*
Integer representing the number of results returned.
**PaloAltoNetworksXQL.NetworkConnection.results.agent\_hostname** *string*
The agent host name.
**PaloAltoNetworksXQL.NetworkConnection.results.agent\_ip\_addresses** *unknown*
The agent IP addresses.
**PaloAltoNetworksXQL.NetworkConnection.results.agent\_id** *string*
Endpoint ID.
**PaloAltoNetworksXQL.NetworkConnection.results.actor\_effective\_username** *string*
Parent user name.
**PaloAltoNetworksXQL.NetworkConnection.results.action\_local\_ip** *string*
Local IP address.
**PaloAltoNetworksXQL.NetworkConnection.results.action\_remote\_ip** *string*
Remote IP address.
**PaloAltoNetworksXQL.NetworkConnection.results.action\_remote\_port** *string*
Remote port.
**PaloAltoNetworksXQL.NetworkConnection.results.dst\_action\_external\_hostname** *string*
External hostname.
**PaloAltoNetworksXQL.NetworkConnection.results.action\_country** *string*
Action country.
**PaloAltoNetworksXQL.NetworkConnection.results.actor\_process\_image\_name** *string*
The name of the process that initiated the activity.
**PaloAltoNetworksXQL.NetworkConnection.results.actor\_process\_image\_path** *string*
Path of the initiating process.
**PaloAltoNetworksXQL.NetworkConnection.results.actor\_process\_command\_line** *string*
Command line arguments of the initiator.
**PaloAltoNetworksXQL.NetworkConnection.results.actor\_process\_image\_sha256** *string*
The SHA256 value of the initiator.
**PaloAltoNetworksXQL.NetworkConnection.results.actor\_process\_instance\_id** *string*
Initiator instance ID.
**PaloAltoNetworksXQL.NetworkConnection.results.actor\_process\_causality\_id** *string*
Initiator causality ID.
**PaloAltoNetworksXQL.NetworkConnection.results.\_vendor** *string*
The result vendor.
**PaloAltoNetworksXQL.NetworkConnection.results.\_time** *string*
Result time.
**PaloAltoNetworksXQL.NetworkConnection.results.insert\_timestamp** *string*
Result insert timestamp.
**PaloAltoNetworksXQL.NetworkConnection.results.\_product** *string*
The result product.
#### runXQLProcessCausalityNetworkActivityQuery
***
Search for network connection created by a given process causality ID.
Note: This is a polling command.
Arguments
| Argument Name | Description | Required |
| ---------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------- |
| process\_causality\_id | A comma-separated list of process causality IDs to search on the XDR dataset. | Required |
| endpoint\_id | A comma-separated list of endpoint IDs to run the query on. The default is all endpoints. | Optional |
| extra\_fields | A comma-separated list of extra fields to add to the query results. | Optional |
| query\_name | An optional display label for the query results. When provided, it overrides the server-derived execution name in the output context. | Optional |
| timeframe | Time in relative date or range format (for example: "1 day", "3 weeks ago", "between 2021-01-01 12:34:56 +02:00 and 2021-02-01 12:34:56 +02:00"). The default is the last 7 days. Default is 7 days. | Optional |
| limit | The maximum number of results to return. Default is 100. | Optional |
| interval\_in\_seconds | The polling interval in seconds between each query-status check. Default is 30. | Optional |
| timeout\_in\_seconds | The total polling timeout in seconds. Default is 600. | Optional |
| tenant\_id | A comma-separated list of tenant IDs used for running APIs on local and Managed Security tenants. For a single tenant (local tenant) query, provide a single tenant ID; an empty value (default) runs on the local tenant. For multi-tenant investigations (a Managed Security parent investigating children and/or local), provide multiple tenant IDs, which can include the parent, children, or both. | Optional |
Outputs
**PaloAltoNetworksXQL.ProcessCausalityNetworkActivity.query\_name** *string*
The given name of the query.
**PaloAltoNetworksXQL.ProcessCausalityNetworkActivity.execution\_id** *string*
A unique ID of the XQL query execution.
**PaloAltoNetworksXQL.ProcessCausalityNetworkActivity.status** *string*
String representing the status of the query; SUCCESS, FAIL, or PENDING.
**PaloAltoNetworksXQL.ProcessCausalityNetworkActivity.number\_of\_results** *number*
Integer representing the number of results returned.
**PaloAltoNetworksXQL.ProcessCausalityNetworkActivity.results.agent\_hostname** *string*
The agent host name.
**PaloAltoNetworksXQL.ProcessCausalityNetworkActivity.results.agent\_ip\_addresses** *unknown*
The agent IP addresses.
**PaloAltoNetworksXQL.ProcessCausalityNetworkActivity.results.agent\_id** *string*
Endpoint ID.
**PaloAltoNetworksXQL.ProcessCausalityNetworkActivity.results.action\_local\_ip** *string*
Local IP address.
**PaloAltoNetworksXQL.ProcessCausalityNetworkActivity.results.action\_remote\_ip** *string*
Remote IP address.
**PaloAltoNetworksXQL.ProcessCausalityNetworkActivity.results.action\_remote\_port** *string*
Remote port.
**PaloAltoNetworksXQL.ProcessCausalityNetworkActivity.results.dst\_action\_external\_hostname** *string*
External hostname.
**PaloAltoNetworksXQL.ProcessCausalityNetworkActivity.results.dns\_query\_name** *string*
DNS query name.
**PaloAltoNetworksXQL.ProcessCausalityNetworkActivity.results.action\_app\_id\_transitions** *unknown*
List of application IDs action. Actual activities that took place and recorded by the agent.
**PaloAltoNetworksXQL.ProcessCausalityNetworkActivity.results.action\_total\_download** *string*
Total downloads.
**PaloAltoNetworksXQL.ProcessCausalityNetworkActivity.results.action\_total\_upload** *string*
Total uploads.
**PaloAltoNetworksXQL.ProcessCausalityNetworkActivity.results.action\_country** *string*
Action country.
**PaloAltoNetworksXQL.ProcessCausalityNetworkActivity.results.action\_as\_data** *string*
The action as data.
**PaloAltoNetworksXQL.ProcessCausalityNetworkActivity.results.actor\_process\_image\_sha256** *string*
The SHA256 value of the initiator.
**PaloAltoNetworksXQL.ProcessCausalityNetworkActivity.results.actor\_process\_image\_name** *string*
The name of the process that initiated the activity.
**PaloAltoNetworksXQL.ProcessCausalityNetworkActivity.results.actor\_process\_image\_path** *string*
Path of the initiating process.
**PaloAltoNetworksXQL.ProcessCausalityNetworkActivity.results.actor\_process\_signature\_vendor** *string*
Initiator signer.
**PaloAltoNetworksXQL.ProcessCausalityNetworkActivity.results.actor\_process\_signature\_product** *string*
Initiator product.
**PaloAltoNetworksXQL.ProcessCausalityNetworkActivity.results.actor\_causality\_id** *string*
Causality identifier (CID).
**PaloAltoNetworksXQL.ProcessCausalityNetworkActivity.results.actor\_process\_image\_command\_line** *string*
Image command line.
**PaloAltoNetworksXQL.ProcessCausalityNetworkActivity.results.actor\_process\_instance\_id** *string*
Initiator instance ID.
**PaloAltoNetworksXQL.ProcessCausalityNetworkActivity.results.\_vendor** *string*
The result vendor.
**PaloAltoNetworksXQL.ProcessCausalityNetworkActivity.results.\_time** *string*
Result time.
**PaloAltoNetworksXQL.ProcessCausalityNetworkActivity.results.insert\_timestamp** *string*
Result insert timestamp.
**PaloAltoNetworksXQL.ProcessCausalityNetworkActivity.results.\_product** *string*
The result product.
#### runXQLProcessEventQuery
***
Returns process events filtered by SHA256 process image hash using a built-in XQL query.
Note: This is a polling command.
Arguments
| Argument Name | Description | Required |
| --------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------- |
| process\_sha256 | A comma-separated list of SHA256 process image hashes to filter on. | Required |
| endpoint\_id | A comma-separated list of endpoint IDs to run the query on. The default is all endpoints. | Optional |
| extra\_fields | A comma-separated list of extra fields to add to the query results. | Optional |
| query\_name | An optional display label for the query results. When provided, it overrides the server-derived execution name in the output context. | Optional |
| timeframe | Time in relative date or range format (for example: "1 day", "3 weeks ago", "between 2021-01-01 12:34:56 +02:00 and 2021-02-01 12:34:56 +02:00"). The default is the last 7 days. Default is 7 days. | Optional |
| limit | The maximum number of results to return. Default is 100. | Optional |
| interval\_in\_seconds | The polling interval in seconds between each query-status check. Default is 30. | Optional |
| timeout\_in\_seconds | The total polling timeout in seconds. Default is 600. | Optional |
| tenant\_id | A comma-separated list of tenant IDs used for running APIs on local and Managed Security tenants. For a single tenant (local tenant) query, provide a single tenant ID; an empty value (default) runs on the local tenant. For multi-tenant investigations (a Managed Security parent investigating children and/or local), provide multiple tenant IDs, which can include the parent, children, or both. | Optional |
Outputs
**PaloAltoNetworksXQL.ProcessEvent.execution\_id** *string*
An integer representing the unique ID of the XQL query execution.
**PaloAltoNetworksXQL.ProcessEvent.status** *string*
String representing the status of the Query; SUCCESS, FAIL, or PENDING.
**PaloAltoNetworksXQL.ProcessEvent.error\_details** *string*
Error information in case of a failed query.
**PaloAltoNetworksXQL.ProcessEvent.query\_url** *string*
URL to view the complete query results in the Query Center.
**PaloAltoNetworksXQL.ProcessEvent.number\_of\_results** *number*
Integer representing the number of results returned.
**PaloAltoNetworksXQL.ProcessEvent.results** *unknown*
The results returned by the query.
**PaloAltoNetworksXQL.ProcessEvent.query\_limit\_modified** *string*
Contains a message if the query's LIMIT clauses were automatically reduced to the maximum supported limit.
**PaloAltoNetworksXQL.ProcessEvent.widget\_name** *string*
The name of the widget to display the query results.
**PaloAltoNetworksXQL.ProcessEvent.widget\_description** *string*
A description of the widget associated with the query results.
**PaloAltoNetworksXQL.ProcessEvent.query\_name** *string*
The name of the query, used for identification purposes.
**PaloAltoNetworksXQL.ProcessEvent.timeframe** *unknown*
The timeframe used for the query execution.
**PaloAltoNetworksXQL.ProcessEvent.view\_def** *unknown*
The view definition data for the query graph.
**PaloAltoNetworksXQL.ProcessEvent.graph\_data** *unknown*
The graph data for the query visualization.
#### runXQLProcessInstanceNetworkActivityQuery
***
Search for network connection created by a given process instance ID.
Note: This is a polling command.
Arguments
| Argument Name | Description | Required |
| --------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------- |
| process\_instance\_id | A comma-separated list of process instance IDs to search on the XDR dataset. | Required |
| endpoint\_id | A comma-separated list of endpoint IDs to run the query on. The default is all endpoints. | Optional |
| extra\_fields | A comma-separated list of extra fields to add to the query results. | Optional |
| query\_name | An optional display label for the query results. When provided, it overrides the server-derived execution name in the output context. | Optional |
| timeframe | Time in relative date or range format (for example: "1 day", "3 weeks ago", "between 2021-01-01 12:34:56 +02:00 and 2021-02-01 12:34:56 +02:00"). The default is the last 7 days. Default is 7 days. | Optional |
| limit | The maximum number of results to return. Default is 100. | Optional |
| interval\_in\_seconds | The polling interval in seconds between each query-status check. Default is 30. | Optional |
| timeout\_in\_seconds | The total polling timeout in seconds. Default is 600. | Optional |
| tenant\_id | A comma-separated list of tenant IDs used for running APIs on local and Managed Security tenants. For a single tenant (local tenant) query, provide a single tenant ID; an empty value (default) runs on the local tenant. For multi-tenant investigations (a Managed Security parent investigating children and/or local), provide multiple tenant IDs, which can include the parent, children, or both. | Optional |
Outputs
**PaloAltoNetworksXQL.ProcessInstanceNetworkActivity.query\_name** *string*
The given name of the query.
**PaloAltoNetworksXQL.ProcessInstanceNetworkActivity.execution\_id** *string*
A unique ID of the XQL query execution.
**PaloAltoNetworksXQL.ProcessInstanceNetworkActivity.status** *string*
String representing the status of the query; SUCCESS, FAIL, or PENDING.
**PaloAltoNetworksXQL.ProcessInstanceNetworkActivity.number\_of\_results** *number*
Integer representing the number of results returned.
**PaloAltoNetworksXQL.ProcessInstanceNetworkActivity.results.agent\_hostname** *string*
The agent host name.
**PaloAltoNetworksXQL.ProcessInstanceNetworkActivity.results.agent\_ip\_addresses** *unknown*
The agent IP addresses.
**PaloAltoNetworksXQL.ProcessInstanceNetworkActivity.results.agent\_id** *string*
Endpoint ID.
**PaloAltoNetworksXQL.ProcessInstanceNetworkActivity.results.action\_local\_ip** *string*
Local IP address.
**PaloAltoNetworksXQL.ProcessInstanceNetworkActivity.results.action\_remote\_ip** *string*
Remote IP address.
**PaloAltoNetworksXQL.ProcessInstanceNetworkActivity.results.action\_remote\_port** *string*
Remote port.
**PaloAltoNetworksXQL.ProcessInstanceNetworkActivity.results.dst\_action\_external\_hostname** *string*
External hostname.
**PaloAltoNetworksXQL.ProcessInstanceNetworkActivity.results.dns\_query\_name** *string*
DNS query name.
**PaloAltoNetworksXQL.ProcessInstanceNetworkActivity.results.action\_app\_id\_transitions** *unknown*
List of application IDs action. Actual activities that took place and recorded by the agent.
**PaloAltoNetworksXQL.ProcessInstanceNetworkActivity.results.action\_total\_download** *string*
Total downloads.
**PaloAltoNetworksXQL.ProcessInstanceNetworkActivity.results.action\_total\_upload** *string*
Total uploads.
**PaloAltoNetworksXQL.ProcessInstanceNetworkActivity.results.action\_country** *string*
Action country.
**PaloAltoNetworksXQL.ProcessInstanceNetworkActivity.results.action\_as\_data** *string*
The action as data.
**PaloAltoNetworksXQL.ProcessInstanceNetworkActivity.results.actor\_process\_image\_sha256** *string*
The SHA256 value of the initiator.
**PaloAltoNetworksXQL.ProcessInstanceNetworkActivity.results.actor\_process\_image\_name** *string*
The name of the process that initiated the activity.
**PaloAltoNetworksXQL.ProcessInstanceNetworkActivity.results.actor\_process\_image\_path** *string*
Path of the initiating process.
**PaloAltoNetworksXQL.ProcessInstanceNetworkActivity.results.actor\_process\_signature\_vendor** *string*
Initiator signer.
**PaloAltoNetworksXQL.ProcessInstanceNetworkActivity.results.actor\_process\_signature\_product** *string*
Initiator product.
**PaloAltoNetworksXQL.ProcessInstanceNetworkActivity.results.actor\_causality\_id** *string*
Causality identifier (CID).
**PaloAltoNetworksXQL.ProcessInstanceNetworkActivity.results.actor\_process\_image\_command\_line** *string*
Image command line.
**PaloAltoNetworksXQL.ProcessInstanceNetworkActivity.results.actor\_process\_instance\_id** *string*
Initiator instance ID.
**PaloAltoNetworksXQL.ProcessInstanceNetworkActivity.results.\_vendor** *string*
The result vendor.
**PaloAltoNetworksXQL.ProcessInstanceNetworkActivity.results.\_time** *string*
Result time.
**PaloAltoNetworksXQL.ProcessInstanceNetworkActivity.results.insert\_timestamp** *string*
Result insert timestamp.
**PaloAltoNetworksXQL.ProcessInstanceNetworkActivity.results.\_product** *string*
The result product.
#### runXQLQuery
***
Executes an XQL query. Write operations (e.g., queries containing a 'target' clause) are not supported.
Note: This is a polling command.
Arguments
| Argument Name | Description | Required |
| --------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------- |
| query | The XQL query to execute. | Required |
| query\_name | A name for the query, used to identify it in the results. When omitted, the auto-generated execution name is used. | Optional |
| widget\_name | The name of the widget that will display the query results. Default is XQL Query Results. | Optional |
| widget\_description | A description of the widget associated with the query results. Default is Widget displaying XQL query results. | Optional |
| timeframe | Time in relative date or range format (for example: "1 day", "3 weeks ago", "between 2021-01-01 12:34:56 +02:00 and 2021-02-01 12:34:56 +02:00"). The default is the last 7 days. Default is 7 days. | Optional |
| wait\_for\_results | If true, polls for and returns the full query results. Otherwise, only starts the query and returns the execution ID. Possible values are: true, false. Default is true. | Optional |
| interval\_in\_seconds | Interval in seconds between each poll when waiting for results. The default is 2 seconds. Default is 2. | Optional |
| timeout\_in\_seconds | Polling timeout in seconds when waiting for results. The default is 180 seconds. Default is 180. | Optional |
| execution\_id | The ID of a previous query execution to fetch results from. If provided, the 'query' and 'timeframe' arguments are ignored. | Optional |
Outputs
**GenericXQLQuery.execution\_id** *string*
An integer representing the unique ID of the XQL query execution.
**GenericXQLQuery.status** *string*
String representing the status of the Query; SUCCESS, FAIL, or PENDING.
**GenericXQLQuery.error\_details** *string*
Error information in case of a failed query.
**GenericXQLQuery.query\_url** *string*
URL to view the complete query results in the Query Center.
**GenericXQLQuery.number\_of\_results** *number*
Integer representing the number of results returned.
**GenericXQLQuery.results** *unknown*
The results returned by the query.
**GenericXQLQuery.query\_limit\_modified** *string*
Contains a message if the query's LIMIT clauses were automatically reduced to the maximum supported limit.
**GenericXQLQuery.widget\_name** *string*
The name of the widget to display the query results.
**GenericXQLQuery.widget\_description** *string*
A description of the widget associated with the query results.
**GenericXQLQuery.query\_name** *string*
The name of the query, used for identification purposes.
**GenericXQLQuery.timeframe** *unknown*
The timeframe used for the query execution.
**GenericXQLQuery.view\_def** *unknown*
The view definition data for the query graph.
**GenericXQLQuery.graph\_data** *unknown*
The graph data for the query visualization.
#### runXQLRegistryQuery
***
Query Windows registry by registry key name.
Note: This is a polling command.
Arguments
| Argument Name | Description | Required |
| --------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------- |
| reg\_key\_name | A comma-separated list of registry key names to search. | Required |
| endpoint\_id | A comma-separated list of endpoint IDs to run the query on. The default is all endpoints. | Optional |
| extra\_fields | A comma-separated list of extra fields to add to the query results. | Optional |
| query\_name | An optional display label for the query results. When provided, it overrides the server-derived execution name in the output context. | Optional |
| timeframe | Time in relative date or range format (for example: "1 day", "3 weeks ago", "between 2021-01-01 12:34:56 +02:00 and 2021-02-01 12:34:56 +02:00"). The default is the last 7 days. Default is 7 days. | Optional |
| limit | The maximum number of results to return. Default is 100. | Optional |
| interval\_in\_seconds | The polling interval in seconds between each query-status check. Default is 30. | Optional |
| timeout\_in\_seconds | The total polling timeout in seconds. Default is 600. | Optional |
| tenant\_id | A comma-separated list of tenant IDs used for running APIs on local and Managed Security tenants. For a single tenant (local tenant) query, provide a single tenant ID; an empty value (default) runs on the local tenant. For multi-tenant investigations (a Managed Security parent investigating children and/or local), provide multiple tenant IDs, which can include the parent, children, or both. | Optional |
Outputs
**PaloAltoNetworksXQL.Registry.query\_name** *string*
The given name of the query.
**PaloAltoNetworksXQL.Registry.execution\_id** *string*
A unique ID of the XQL query execution.
**PaloAltoNetworksXQL.Registry.status** *string*
String representing the status of the query; SUCCESS, FAIL, or PENDING.
**PaloAltoNetworksXQL.Registry.number\_of\_results** *number*
Integer representing the number of results returned.
**PaloAltoNetworksXQL.Registry.results.agent\_hostname** *string*
The agent host name.
**PaloAltoNetworksXQL.Registry.results.agent\_id** *string*
Endpoint ID.
**PaloAltoNetworksXQL.Registry.results.agent\_ip\_addresses** *unknown*
The agent IP addresses.
**PaloAltoNetworksXQL.Registry.results.agent\_os\_type** *string*
Host operating system.
**PaloAltoNetworksXQL.Registry.results.agent\_os\_sub\_type** *string*
Agent operating system subtype.
**PaloAltoNetworksXQL.Registry.results.event\_type** *string*
Event type.
**PaloAltoNetworksXQL.Registry.results.event\_sub\_type** *string*
Event subtype.
**PaloAltoNetworksXQL.Registry.results.action\_registry\_key\_name** *string*
Registry key name.
**PaloAltoNetworksXQL.Registry.results.action\_registry\_value\_name** *string*
Registry value name.
**PaloAltoNetworksXQL.Registry.results.action\_registry\_data** *string*
Registry data.
**PaloAltoNetworksXQL.Registry.results.\_vendor** *string*
The result vendor.
**PaloAltoNetworksXQL.Registry.results.\_time** *string*
Result time.
**PaloAltoNetworksXQL.Registry.results.insert\_timestamp** *string*
Result insert timestamp.
**PaloAltoNetworksXQL.Registry.results.\_product** *string*
The result product.
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://cortex-docs.paloaltonetworks.com/cortex-commands-guide/xql-commands.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.