> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/agentic-assistant-chat/create-and-run-xql-queries-with-agentic-assistant-chat.md).

# Create and run XQL queries with Agentic Assistant chat

Use natural language in Cortex Agentic Assistant Chat to generate and run Cortex Query Language (XQL) queries in Cortex XDR.

With the Agentic Assistant Chat, security analysts can query system datasets without writing manual XQL code. By typing plain English prompts, the assistant translates your intent into valid XQL, executes the search, and previews the results directly in your chat interface.

### Core capabilities and actions

| Action                   | Description                                                                                                                                   |
| ------------------------ | --------------------------------------------------------------------------------------------------------------------------------------------- |
| `TextToXQL`              | Translates natural-language prompts into valid XQL syntax. This hidden system action cannot be removed or displayed in Agentic Assistant Hub. |
| `Cortex - Run XQL Query` | Runs an XQL query against your datasets and returns results.                                                                                  |

{% hint style="info" %}
System agents include `Cortex - Run XQL Query` by default. If you are using a custom agent, ensure the `Cortex - Run XQL Query` action is enabled; otherwise, the agent cannot run queries.
{% endhint %}

### Data access and permission requirements

* System datasets only: The `TextToXQL` action supports system datasets, but cannot create XQL queries for custom datasets. You can manually write a query for custom datasets and ask the agent to run the query.
* Role-Based Access Control (RBAC): The `TextToXQL` action can generate XQL queries for datasets that you do not have permission to access, but the Cortex - Run XQL Query action can only execute if you have the necessary permissions for the dataset.

### How to create and run XQL queries

{% stepper %}
{% step %}

#### Open Cortex Agentic Assistant Chat

Navigate to the Agentic Assistant Chat panel.
{% endstep %}

{% step %}

#### Prompt the assistant

Prompt the assistant using clear, intent-driven natural language.

Recommended prompts:

* *“Create an XQL query to…”*
* *“Build an XQL query for…”*
* *“Generate an XQL query that…”*

For example:

* “*Build an XQL query to find failed login attempts from the past 24 hours.”*
* *“Generate an XQL query for high-severity process executions on `Workstation-01`.”*
  {% endstep %}

{% step %}

#### Review and run

1. Automatic or Manual Execution: The agent displays the generated XQL query. Depending on your instructions, it will execute automatically or wait for manual confirmation.
2. Inspect Results: View result previews directly inside the chat window.
3. Pivot to Detailed Search: Click the query link to pivot directly to the dedicated XQL Query Builder page to analyze full dataset outputs, modify stages, or save the query.
   {% endstep %}
   {% endstepper %}

{% hint style="info" %}
Running XQL queries manually through an agent does not consume compute units. This includes multi-step plans that create and run queries.
{% endhint %}


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/agentic-assistant-chat/create-and-run-xql-queries-with-agentic-assistant-chat.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.