> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/agentic-assistant-chat/create-and-run-xql-queries-with-agentic-assistant-chat.md).

# Create and run XQL queries with Agentic Assistant chat

Use natural language in Cortex Agentic Assistant Chat to automatically generate and execute Cortex Query Language (XQL) queries in Cortex XSIAM.

With the Agentic Assistant Chat, security analysts can query system datasets without writing manual XQL code. By typing plain English prompts, the assistant translates your intent into valid XQL, executes the search, and previews the results directly in your chat interface.

### Core capabilities and actions

The Cortex Agentic Assistant relies on the following actions to handle XQL requests:

| Action                   | Description                                                                                                                                                                                                                                                       |
| ------------------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `TextToXQL`              | <p>Translates natural language prompts into valid XQL syntax. </p><div data-gb-custom-block data-tag="hint" data-style="info" class="hint hint-info"><p>This is a hidden system action and cannot be removed or displayed in the Agentic Assistant Hub.</p></div> |
| `Cortex - Run XQL Query` | Executes an XQL query against your datasets and returns the results.                                                                                                                                                                                              |

{% hint style="info" %}
System agents include `Cortex - Run XQL Query` by default. If you are using a custom agent, ensure the `Cortex - Run XQL Query` action is enabled; otherwise, the agent cannot run queries.
{% endhint %}

### **Data access and permission requirements**

* System datasets only: The `TextToXQL` action supports system datasets, but cannot create XQL queries for custom datasets. You can manually write a query for custom datasets and ask the agent to run the query.
* Role-Based Access Control (RBAC): The `TextToXQL` action can generate XQL queries for datasets that you do not have permission to access, but the Cortex - Run XQL Query action can only execute if you have the necessary permissions for the dataset.

### How to create and run XQL Queries

{% stepper %}
{% step %}

#### Open Cortex Agentic Assistant Chat

Navigate to the Agentic Assistant Chat panel.
{% endstep %}

{% step %}

#### Prompt the Assistant

Prompt the assistant using clear, intent-driven natural language.

Recommended prompt phrases

* *"Create an XQL query to..."*
* *"Build an XQL query for..."*
* *"Generate an XQL query that..."*

Example prompts:

* *"Build an XQL query to search for all failed login attempts in the past 24 hours."*
* "Generate an XQL query that filters for high-severity process execution events on host `Workstation-01`."
  {% endstep %}

{% step %}

#### Review and run

1. Automatic or Manual Execution: The agent displays the generated XQL query. Depending on your instructions, it will execute automatically or wait for manual confirmation.
2. Inspect Results: View result previews directly inside the chat window.
3. Pivot to Detailed Search: Click the query link to pivot directly to the dedicated XQL Query Builder page to analyze full dataset outputs, modify stages, or save the query.
   {% endstep %}
   {% endstepper %}

{% hint style="info" %}
Running XQL queries manually through an agent does not consume compute units. This includes scenarios where you prompt the agent to create and execute a multi-step plan.
{% endhint %}


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/agentic-assistant-chat/create-and-run-xql-queries-with-agentic-assistant-chat.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.