> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/build-xql-queries/query-builder-templates/considerations-for-using-query-builder-templates.md).

# Considerations for using Query Builder templates

The following sections provide information and considerations for using Query Builder templates.

The following sections provide information and considerations for using Query Builder templates.

<details>

<summary>General considerations</summary>

The following general considerations apply to Query Builder templates:

* The templates run on the following datasets by default:

  * **Basic**, **Identity**, **Endpoint**, and **Network** templates: `xdr_data`
  * **Cloud** template: `cloud_audit_logs`

  It is also possible to run the templates on all datasets.
* The query uses an AND operator between the filtering fields.
* Separate multiple values with pipes and do not add spaces between the value and the pipe.
* Some of the filtering fields are aliases and therefore search all fields that are associated with the alias.
* Fields with dropdown options support ENUMs and free text values.
* In IP address fields, you can also specify subnets.
* The asterisk (`*`) wildcard is supported, except in subnet values.
* You cannot remove the predefined fields, but you can leave them blank.
* When filtering integer and float fields, you can only specify two operators from the four available options.

</details>

<details>

<summary>= (equal to) and != (not equal to) operators</summary>

Filtering fields support the `=` (equal to) and `!=` (not equal to) operators, and you can specify both operators for the same field. The following conditions apply to these operators:

* If you specify multiple values for a field with the `=` operator, the OR operator is applied. For example, `User Name = aaa|bbb` searches for instances of user name equal to aaa OR bbb.
* If you specify multiple values for a field with the `!=` operator, the AND operator is applied. For example, `User Name != aaa|bbb` searches for instances of user name not equal to aaa AND bbb.
* If you specify both operators (`=` and `!=`) for the same field, the AND operator is applied. For example, `COUNTRY = Empty values AND COUNTRY != USA`.

</details>

<details>

<summary>\>= (greater than and equal) and \&#x3C;= (less than and equal) operators</summary>

Filtering fields support the `>=` (greater than and equal) and `<=` (less than and equal) operators, and you can specify both operators for the same field. The following conditions apply to these operators:

* Cortex XSIAM supports using these operators for integer and float fields.
* Empty values are not supported with these operators.

</details>

<details>

<summary>Include and exclude empty values</summary>

You can use the **Empty values** field to include or exclude fields with empty values and strings. In the search results, some fields might return empty values. This occurs if no data is mapped to a field. The following conditions apply to the **Empty values** field:

* If you specify **=** and select **Empty values**, the query includes fields with empty values with an OR operator.

  For example, `_vendor = aaa OR _vendor = Empty values` searches the `_vendor` field for any instances of aaa or empty values.
* If you specify **!=** and select **Empty values**, the query excludes fields with empty values with an AND operator.

  For example, `_vendor != aaa AND _vendor != Empty values` searches the `_vendor` field for values that are not equal to aaa AND do not contain empty values.
* If you specify **!=** and select **Empty values** for an alias, you might not receive any results. The query searches all of the fields associated with the alias for non-empty values. If any of the associated fields contain empty values, no results are returned.

  For example, `User Name != aaa AND User Name != Empty values` searches the User Name alias fields for values that are not equal to aaa AND empty values. If the query finds either aaa or empty values in any of the alias fields, no results are returned.

</details>


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/build-xql-queries/query-builder-templates/considerations-for-using-query-builder-templates.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.