> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/reference-and-developer-docs/graph-search/get-started-with-graph-search-queries.md).

# Get started with Graph Search queries

{% hint style="warning" %}

### Prerequisite

Graph Search requires **View** or **View/Edit** RBAC permissions for **Graph Search** under **Investigation & Response** → **Search**.
{% endhint %}

Before you start to search assets and findings by their relationships by building Graph Search queries, consider the following:

* **Understand your assets and findings data**: Graph Search queries are based on the current data that has been collected for assets and findings from the data sources configured and then sent to the Unified Asset Inventory (UAI), which is displayed in the **All Assets** page (**Inventory** → **Assets** → **All Assets**). The built-in query interface enables you to filter the parameter values by selecting the relevant data from your assets and findings. Ensure to familiarize yourself with this data to build your queries.
  * For more information on assets, see [All assets](/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/asset-management/all-assets.md).
  * For more information on findings, see [Findings and events](/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/case-concepts.md#UUID-7775a60a-1e6e-cd4a-55b9-da6c95fb7d82).
* **Learn more about the query structure using the built-in interface**: Although the Graph Search queries are built using a built-in interface, you should understand the query structure to ensure that you build the queries correctly. For more information, see [How to build Graph Search queries?](/cortex-xdr-5.x/reference-and-developer-docs/graph-search/how-to-build-graph-search-queries.md).
* **Understand the Graph Search query results**: Once your query is complete, you can search for the results. The results can be viewed in a graph or table format. For more information, [Understand Graph Search query results](/cortex-xdr-5.x/reference-and-developer-docs/graph-search/understand-graph-search-query-results.md).
* **Try out some examples**: To help you feel confident with building Graph Search queries, start by following our step-by-step examples and tailor them for your environment. For more information, see [Graph Search examples](/cortex-xdr-5.x/reference-and-developer-docs/graph-search/graph-search-examples.md).
* **Learn more about the Graph Search Query Library and run the built-in queries**: Graph Search contains a Query Library for saving and managing your own queries, queries shared with you, and built-in Graph Search queries provided by Palo Alto Networks. We recommend that you run these built-in queries as these examples provide common, important, and popular use cases. For more information, see [Manage the Graph Search Query Library](/cortex-xdr-5.x/reference-and-developer-docs/graph-search/manage-the-graph-search-query-library.md).


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/reference-and-developer-docs/graph-search/get-started-with-graph-search-queries.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.