> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/data-management/parsing-rules/parsing-rules-file-structure-and-syntax/extend.md).

# EXTEND

{% hint style="warning" %}

### Prerequisite

Parsing Rules requires **View/Edit** RBAC permissions for **Data Management** (under **Configurations** → **Data Management**), which are the same permissions required for Dataset Management, Data Model Rules, and Event Forwarding.
{% endhint %}

An `EXTEND` section is used to chain your Parsing Rules logic to extend your existing default `RULE` sections, which are added by a Content Package you installed from [Marketplace](/cortex-xsiam/configure-cortex-xsiam/marketplace.md). While optional to configure, an `EXTEND` section runs immediately after the default `RULE` section that it extends, and enables data manipulation without overriding or interfering with the existing vendor Parsing Rules. For more information on the `RULE` section in Parsing Rules, see [RULE](/cortex-xsiam/configure-cortex-xsiam/data-management/parsing-rules/parsing-rules-file-structure-and-syntax/rule.md).

`EXTEND` syntax is derived from Cortex Query Language (XQL) with a few modifications as explained in the [Parsing Rules file structure and syntax](/cortex-xsiam/configure-cortex-xsiam/data-management/parsing-rules/parsing-rules-file-structure-and-syntax.md) section. You can have multiple XQL statements, separated by a semicolon (;). Each statement creates a different extension.

{% hint style="info" %}

### Note

For more information on the XQL syntax, see [Get started with XQL](/cortex-xsiam/reference-and-developer-docs/cortex-agentix-xql/get-started-with-xql.md).
{% endhint %}

A few more points to keep in mind when writing `EXTEND` sections:

* You can only extend a default rule that is not overridden in the `RULE` sections.
* A rule can only be extended once.
* A `CONST` section that is defined in **Default Rules** cannot be used in the **User Defined Rules** when configuring an `EXTEND` section.
* An `EXTEND` section must specify the full header of the rule it is extending. When you extend a rule that was added by a Content Package installed from Marketplace, the `EXTEND` section uses the format `[EXTEND:<rule name> content_id = "<pack id>"]`, where the `content_id` comes from the Content Package that the extended rule belongs to.

  Example 47.

  You can see here the `EXTEND` section in **User Defined Rules** uses the full header of the `RULE` it’s extending from **Default Rules**.

  Default Rules:

  ```programlisting
  [RULE:parse_ngfw_hipmatch content_id = "IronNet"]
  alter _time = time_generated
  | call extract_common_ngfw_fields
  | call extract_hipmatch_only_fields
  | call common_post_processing;
  ```

  User Defined Rules:

  ```programlisting
  [EXTEND:parse_ngfw_hipmatch content_id = "IronNet"]
  alter source = json_extract_scalar(source, "$.string")
  | filter __firewall_type = "firewall.hipmatch";
  ```

  When this rule is run, the default `RULE` section runs, and is immediately followed by the `EXTEND` section. This is equivalent to running one single `RULE` section as follows:

  ```programlisting
  [RULE:parse_ngfw_hipmatch content_id = "IronNet"]
  alter _time = time_generated
  | call extract_common_ngfw_fields
  | call extract_hipmatch_only_fields
  | call common_post_processing
  | alter source = json_extract_scalar(source, "$.string")
  | filter __firewall_type = "firewall.hipmatch";
  ```


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/data-management/parsing-rules/parsing-rules-file-structure-and-syntax/extend.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.