> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/data-management/parsing-rules/parsing-rules-editor-views.md).

# Parsing Rules editor views

{% hint style="info" %}

### Note

Parsing Rules requires a Cortex XDR Pro per GB license and a user with Cortex Account Administrator or Instance Administrator permissions.
{% endhint %}

The Parsing Rules editor contains the following views:

* **User Defined** (default): Displays an editor for writing your own custom parsing rules that override the default rules and a **List of Errors** section to help you troubleshoot errors in your Parsing Rules.
* **Default Rules**: Displays the parsing rules that are provided by default with Cortex XDR in read-only mode and a **List of Errors** section to view any errors in your Parsing Rules.
* **Both**: Side-by-side view of both the **Default Rules** and **User Defined** rules, so you can easily view the different rules on one screen. In addition, the **List of Errors** section helps you troubleshoot any errors in your Parsing Rules.
* **Simulate**: Enables you to test your Parsing Rules on actual logs and validate their outputs, which helps minimize your errors when creating Parsing Rules. The editor includes the following sections.
  * **User defined**: A list of the current **User defined** rules on the left side of the window.
  * **XQL Samples**: A table of the existing Cortex Query Language (XQL) raw data samples on the right side of the window, which contain sample logs listing the **Vendor**, **Product**, **Raw Log**, and **Sample Time**. For each **Vendor** and **Product**, up to 5 different samples are available to choose from. From this list, you can select the logs used to simulate the rule.
  * **Logs Output**: Displays in a table format the following columns per dataset at the bottom of the window.
    * **Dataset**: Displays the applicable dataset name and a line number associated to this dataset in the **User defined** section.
    * **Vendor**: The vendor associated with this dataset.
    * **Product**: The product associated with this dataset.
    * **Logs Output**: Displays the output logs that are available based on your **User defined** rules and **XQL Samples** selected after simulating the results. When there is no output log to display, the text `Output logs is not available` with the corresponding error message is displayed. When there is no output due to a missing rule in the **User defined** section for the logs selected, the text **No output logs. You can change your parsing rules and try again** is displayed.
    * **Input Logs**: Displays the relevant input log with a right-click pivot to **Show diff** between the **Output Logs** and **Input Logs**.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/data-management/parsing-rules/parsing-rules-editor-views.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.