> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/reference-and-developer-docs/graph-search/create-graph-search-query.md). # Create Graph Search query {% hint style="warning" %} ### Prerequisite Graph Search requires **View** or **View/Edit** RBAC permissions for **Graph Search** under **Investigation & Response** → **Search**. {% endhint %} Review the following topics: * [Get started with Graph Search queries](/cortex-xdr-5.x/reference-and-developer-docs/graph-search/get-started-with-graph-search-queries.md) * [How to build Graph Search queries?](/cortex-xdr-5.x/reference-and-developer-docs/graph-search/how-to-build-graph-search-queries.md) * [Understand Graph Search query results](/cortex-xdr-5.x/reference-and-developer-docs/graph-search/understand-graph-search-query-results.md) * [Graph Search examples](/cortex-xdr-5.x/reference-and-developer-docs/graph-search/graph-search-examples.md) * [Manage the Graph Search Query Library](/cortex-xdr-5.x/reference-and-developer-docs/graph-search/manage-the-graph-search-query-library.md) Build Graph Search queries to search your assets and findings by their relationship types and map them out in a unified and understandable view. You can build Graph Search queries using the built-in query interface embedded in the Query Builder. 1. Select **Investigation & Response** → **Search** → **Query Builder** → **Graph Search**. 2. From inside the Graph Search query interface at the top of the **Graph Search** page, click **Select** to open the entity picker dialog box. 3. Choose the assets and findings nodes that you want to query. Keep in mind that multiple nodes are defined with an `OR` relationship between them. The top level node selection acts as the root of the query. 4. To apply a condition to the assets or findings nodes that you've selected, click **WHERE**. Otherwise, skip to the next step. Select the applicable field (termed node attribute), operator, and value for the condition you want to define. The operators and values change according to the node attribute (field) that you select. At each level of the query, the relationship between node attribute conditions is `AND`. No other logical operator is available. 5. To define a relationship between the assets or findings nodes already selected and a new node, click **+**. 6. Define the **THAT** statement by selecting the new assets and findings nodes that you want to relate to the other nodes. 7. To apply a condition to the new asset and findings nodes that you've selected, repeat step **#4**. 8. Repeat steps **#5** to **#7** until you've finished building your query logic. 9. When your query is complete, or at any time that you want to view the query results, click **Search**. The Graph Search results are displayed in a graph format by default. You can toggle to **Table** to view the results in a table format. In addition, you can export the graph results using the icon at the top of the page to a PNG, SVG, or TSV file.

Tip

10. You can save your query to the Query Library by clicking **Save Query**. 1. Set these parameters: * **Query Name**: Specify a unique name for the Graph Search query. Query names must be unique in both private and shared lists, which includes other people’s queries. * **Query Description** (Optional): Specify a descriptive name for your Graph Search query. * **Labels** (Optional): Specify a label that is associated with your Graph Search query. You can add a label and then select **Create Label**, or select a label from the list, if any exist from a previous query. Adding a label to your Graph Search query enables you to search for queries using this label in the Query Library. * **Share with others**: You can either set the Graph Search query to be private and only accessible by you (default) or move the toggle to **Share with others** the query, so that other users using the same tenant can access the query in their Query Library. 2. Click **Save**. A notification appears confirming that the query was saved successfully to the library, and closes on its own after a few seconds. The Graph Search query that you added is now listed as the first entry in the **Query Library**.

Note

For more information about the Query Library, see Manage the Graph Search Query Library.

--- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/reference-and-developer-docs/graph-search/create-graph-search-query.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.