Build XQL queries

Build XQL queries with Query Builder for investigation and analysis in Cortex XSIAM.

To support investigation and analysis in Cortex XSIAM, you can search your data by creating queries in the Query Builder. You can create queries with the Cortex Query Language (XQL) or by using the Query Builder templates.

If you have Cortex Agentic Assistant, you can use natural language prompts to create and run XQL queries within the chat interface. For more information, see Create and run XQL queries with Agentic Assistant chat.