> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/agentic-assistant-chat/create-and-run-xql-queries-with-agentic-assistant-chat.md).

# Create and run XQL queries with Agentic Assistant chat

You can use natural language prompts to generate and run XQL queries through the Cortex Agentic Assistant chat. This allows you to access and analyze datasets without requiring prior knowledge of XQL syntax.

This capability is provided through two actions. The first is a built-in TextToXQL action available for all agents, that takes natural language prompts and translates them into XQL queries. The second is the Cortex - Run XQL Query action, which is included with all system agents and can be added to custom agents. If a custom agent does not have the Cortex - Run XQL Query action, it cannot execute XQL queries.

| Action                 | Description                                                                                                                                                                                                                                                                                                                                                                                                                  |
| ---------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| TextToXQL              | <p>Translates your natural language request into a valid XQL query. This action is built-in to all agents. It does not display in the list of actions for an agent and it cannot be removed.</p><div data-gb-custom-block data-tag="hint" data-style="info" class="hint hint-info"><p><strong>Note</strong></p><p>The TextToXQL action is a hidden system action and does not appear in the Agentic Assistant Hub.</p></div> |
| Cortex - Run XQL Query | Executes an XQL query and returns the data.                                                                                                                                                                                                                                                                                                                                                                                  |

**Data access and permissions**

The TextToXQL action is designed for system datasets. It cannot create XQL queries for custom datasets. You can manually write a query for custom datasets and ask the agent to run the query.

The TextToXQL action can generate XQL queries for datasets that you do not have permission to access, but the Cortex - Run XQL Query action can only execute if you have the necessary permissions for the dataset.

**Best practices for prompting**

We recommend using clear specific language to request that the agent create and execute XQL queries. Use terminology such as:

* Create an XQL query to...
* Build an XQL query for...
* Generate an XQL query that...

You can have the agent automatically run the query or you can manually run it yourself.

**Results**

When a query runs, the agent provides a preview of the results and you can also see the full dataset by pivoting directly to the XQL page.

{% hint style="info" %}

### Note

Running XQL queries manually through an agent does not consume compute units. This includes scenarios where you prompt the agent to create and execute a multi-step plan.
{% endhint %}


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/agentic-assistant-chat/create-and-run-xql-queries-with-agentic-assistant-chat.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.