> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/data-management/dataset-management/lookup-datasets.md). # Lookup datasets Lookup datasets enable you to correlate data from a data source you provide with the events in your environment. For example, you can create a lookup with a list of high-value assets, terminated employees, or service accounts in your environment. Use lookups in your search, detection rules, and threat hunting. Lookups are stored as name-value pairs and are cached for optimal query performance and low latency. Lookup tables support low frequency changes of up to 1200 modifications per day. Changes are implemented whenever a lookup dataset is edited, where only one person or user can edit the file at a given time. Concurrent users editing the file is not supported.
Use case scenarios * Investigate threats and respond to incidents quickly with the rapid import of IP addresses, file hashes, and other data from CSV files. After you import the data, use lookup name-value pairs for joins and filters in threat hunting and general queries. * Import business data as a lookup. For example, import user lists with privileged system access, or terminated employees. Then, use the lookup to create allowlists and blocklists to detect or prevent those users from logging in to the network. * Create allowlists to suppress alerts from a group of users, such as users from authorized IP addresses that perform tasks that would normally trigger the alert. Prevent benign events from becoming alerts. * Enrich event data. Use lookups to enrich your event data with name-value combinations derived from external data sources.
How are lookup datasets created? You can import or create a lookup dataset, and then reference the values for a certain key, run queries and take action. Lookup datasets are created by any of the following methods: * Manual upload from a CSV, TSV, or JSON file to Cortex XDR from the **Dataset Management** page. For more information, see [Import a lookup dataset](/cortex-xdr-3.x/cortex-xdr-3.x-documentation/data-management/dataset-management/lookup-datasets/import-a-lookup-dataset.md). * Automatic upload by the Files and Folders Collector. * Query results are saved to a lookup dataset. If saved using the **`target`** stage, the **Type** can be either **User** or **Lookup**. For more information, see the [target](/cortex-xdr-3.x/cortex-xdr-3.x-documentation/cortex-xdr-xql/stages/target.md) stage.

Important

When you create or add data to a lookup dataset using the target stage, the _time field won't be included by default unless you explicitly add it with the fields stage.

After a lookup a dataset is imported, you can always edit the dataset to update the data manually by right-clicking the dataset and selecting **Edit**. {% hint style="info" %} ### Note A lookup dataset can only be deleted if there are no other dependencies. For example, if a Correlation Rule is based on a lookup dataset, you wouldn't be able to delete the lookup dataset until you removed the dataset from the XQL query of the Correlation Rule. {% endhint %}
--- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/data-management/dataset-management/lookup-datasets.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.