> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/data-management/parsing-rules/create-parsing-rules.md).

# Create Parsing Rules

{% hint style="info" %}

### Note

Parsing Rules requires a Cortex XDR Pro per GB license and a user with Cortex Account Administrator or Instance Administrator permissions.
{% endhint %}

Cortex XDR provides a number of default Parsing Rules that you can easily override as required using XQL and additional custom syntax that is specific to creating Parsing Rules. Before creating your own Parsing Rules, we recommend you review the following:

* [Parsing Rules editor views](/cortex-xdr-3.x/cortex-xdr-3.x-documentation/data-management/parsing-rules/parsing-rules-editor-views.md)
* [Parsing Rules file structure and syntax](/cortex-xdr-3.x/cortex-xdr-3.x-documentation/data-management/parsing-rules/parsing-rules-file-structure-and-syntax.md)

{% hint style="info" %}

### Important

When creating Parsing Rules, the `_time` field is a mandatory field. If the field is null or invalid, the `_insert_time` field is used instead. This field can be automatically parsed depending on the type of data being ingested. For example, for CEF or LEEF logs, the parser first tries to ingest timestamps from these fields in the following order: `rt`, `start`, `end`, and `_insert_time`.
{% endhint %}

How to create Parsing Rules

1. In Cortex XDR , select **Settings** → **Configurations** → **Data** **Management** → **Parsing Rules**.
2. Select the Parsing Rules editor view for writing your Parsing Rules.

   You can select one of the following views.

   * **User Defined**: Leave the default view open and write your Parsing Rules directly in the editor.
   * **Default Rules**: Select this view to understand which parsing rules are provided by default with Cortex XDR in read-only mode.
   * **Both**: Select this view to see the Parsing Rules editor as well as the default rules as you write your Parsing Rules.
   * **Simulate**: Select this view to test your Parsing Rules on actual logs and validate their outputs as you write your Parsing Rules.
3. Write your Parsing Rules using XQL syntax and the syntax specific for Parsing Rules.
4. (Optional) Test your Parsing Rules on actual logs and validate their outputs using the **Simulate** view.

   <div data-gb-custom-block data-tag="hint" data-style="info" class="hint hint-info"><h3>Note</h3><p>You need Cortex XDR administrator or Instance Administrator permissions to access the <strong>Simulate</strong> view and perform these tests.</p></div>

   1\. Select the **Simulate** view.

   2. For the **User defined** rules that you want to test, select the logs from the **XQL Samples** listed that you want to use to simulate the rule. For each **Vendor** and **Product**, up to 5 different samples are available to choose from.
   3. **Simulate** the rules based on the logs selected.

      You can also pivot (right-click) any of the logs that you’ve selected to **Simulate** the rules.
   4. Review the results in the **Logs output** table to determine if your **User defined** rules are fine or need further changes.

      The **Logs output** table displays the following columns per dataset at the bottom of the window.

      * **Dataset**: Displays the applicable dataset name and a line number associated with this dataset in the **User defined** rules section.
      * **Vendor**: The vendor associated with this dataset.
      * **Product**: The product associated with this dataset.
      * **Output Logs**: Displays the available output log. When there is no output log to display, the text `Output logs is not available` with the corresponding error message is displayed. When there is no output due to a missing rule in the **User defined** rules section for the logs selected, the text **No output logs. You can change your parsing rules and try again** is displayed.
      * **Input Logs**: Displays the relevant input log with a right-click pivot to **Show diff** between the **Output Logs** and **Input Logs**.
   5. (Optional) Modify your **User defined** rules and repeat steps #2-4 until you are satisfied with the results.
5. (Optional) Override the default [Parsing Rules raw dataset](/cortex-xdr-3.x/cortex-xdr-3.x-documentation/data-management/parsing-rules/parsing-rules-raw-dataset.md).
6. Save your changes.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/data-management/parsing-rules/create-parsing-rules.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.