About examples

Learn more about the Cortex Query Language (XQL) examples provided.

The examples included in topics are intended to illustrate the behavior or usage of a particular stage or function. While these examples can be based on real data that you could use on real-world queries, you may need to tweak these queries to perform investigations or otherwise solve real world problems.

For examples of queries that illustrate useful investigative queries, see the example Query Library that is available from the product user interface:

Incident Response → Investigation → Query Builder → XQL Search → Query Library