> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/onboard-cortex-xsiam/post-deployment/manage-user-roles-and-access-management/manage-access-to-objects/manage-access-to-saved-queries.md). # Manage access to saved queries Review the following: * [Manage access to objects](/cortex-xsiam/onboard-cortex-xsiam/post-deployment/manage-user-roles-and-access-management/manage-access-to-objects.md) The Query Library serves as the central repository for your team's investigation logic. By using object-level access, you can ensure that specific Cortex Query Language (XQL) queries, such as those used for sensitive internal investigations or executive reporting, are only accessible to authorized users, user groups, and API keys. {% hint style="warning" %} ### Prerequisite **Configure tenant-level settings**: An administrator must first establish the sharing framework under **Settings** → **Configurations** → **Access Management** → **Objects**. The configuration of these settings defines the authorized sharing workflows for saved queries in the Query Library, including the options that appear to users when clicking the three dot, vertical ellipsis (⋮) for a query in the Query Library: * **Enable "Owners can Share objects they created"**: Grants owners the ability to share saved queries with specific users, user groups, and API keys to the query's access list. In the Query Library, this enables the **Share** option. * **Disable "Owners can Share objects they created"**: Restricts owners to managing only **General access** (**Public** vs. **Restricted**). In the Query Library, this replaces the **Share** option with the **Manage Access** option. For more information on these tenant-level configurations, see [Manage access to objects](#UUID-ff05f1c8-e516-ea74-9dff-ea8b26692754). {% endhint %}
How access impacts the Query Builder The permissions assigned to your role, combined with the ownership of specific objects, directly change the tools available to you while working in the Query Builder: * **Restricted versus Public visibility**: Your Query Library view is personalized. You will only see queries where you are the Owner, queries that have been explicitly shared with you (or your user group or API key), or queries marked as **Public**. * **Context-sensitive functionality**: The permissions assigned to your role, combined with the ownership of specific objects, directly change the tools available to you while working in the Query Builder and the Query Library. UI elements like the **Save as** menu or the **Share** action only appear if you have the required functional capabilities.
How to configure access to saved queries Setting up access involves a two-part process: enabling the user interface (UI) elements in the role settings, and then defining the audience for individual saved query objects. **Step 1: Define role capabilities** Role-level permissions act as the "master switch" for Query Builder functionality and determine what actions a user can take. 1. Select **Settings** → **Configurations** → **Access Management** → **Roles**. 2. Right-click the relevant user role, and select **Edit Role**. 3. Under **Components**, expand **Investigation & Response**. 4. Ensure **Query Library** is set to **Enabled**. 5. Define functional capabilities to control the UI: * **Create Queries**: Selecting this enables the **Save as** drop-down menu in the Query Builder. This allows users to select **Save as** → **Query to Library** or **Save as** → **Widget to Library**. The user who performs this action becomes the Owner of the object and is granted the inherent right to edit, delete, and manage sharing for that specific object.. * **Edit Public Queries**: This allows a user to modify queries marked as **Public** by others.

Note

If the role of a user is set to Edit Public Queries but not Create Queries, they can update existing public queries, but the Save as drop-down menu will be hidden, preventing them from creating new Query Library entries.

Keep in mind the following: * If a custom query does not have an assigned **Owner**, an Administrator can use the **Change Owner** action to assign one. **Step 2: Manage sharing for a specific query** Once a query exists in the Query Library, the Owner (or an authorized Editor) can define who has permission to view (and run) or edit it. 1. Select **Investigation & Response** → **Search** → **Query Builder** → **XQL**. 2. Under the **Query Library** tab, locate the query that you want to share in the table. 3. Click the three dot, vertical ellipsis (⋮) and select the available action: * **Share**: This option appears when **Owners can Share objects they created** is enabled in tenant-level settings. It allows you to manage both **General access** and specific principals (users, user groups, and API keys). * **Manage Access**: This option appears when **Owners can Share objects they created** is disabled. It only allows you to change the **General access** state. 4. (If sharing is enabled) To share with specific entities (for **Restricted** queries): * Search for the User, User Group, or API Key. * Assign the access level: **Viewer** (can run/view) or **Editor** (can modify and, if permitted by tenant-level settings, share). 5. Set the **General access** drop-down menu (if authorized by tenant-level settings): * **Restricted**: The query is private. It is only visible to the Owner and the specific principals added to the list. * **Public**: The query is visible to every user who has the Query Library enabled in their role.

Note

When the tenant-level setting Owners and editors can change the general access is unselected, the drop-down is disabled and only an administrator can configure this option.

6. Click **Save**.
Sharing icons in the Query Library The following icons in the Query Library table help you identify the security access of your queries: * ![unshared-query-icon.png](/files/9PxebGZhhIBX5E0W53qX): A **Restricted** query you created that is not shared with anyone else. * ![query-created-by-me-shared-icon.png](/files/PRleNrzBY5qPgRAxcWNv): A query you created that is currently shared with other users, user groups, or API keys. * ![query-created-by-someone-else-shared.png](/files/ZBMQH2O9k6ls1Xk1p6yH): A query created by another user that has been shared with you. * ![PANW\_Query.png](/files/oGslyMI95swQGxYzf2q0): A standard system query provided by Palo Alto Networks. These are always **Public** and can't be deleted, or have their ownership transferred.
--- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://cortex-docs.paloaltonetworks.com/cortex-xsiam/onboard-cortex-xsiam/post-deployment/manage-user-roles-and-access-management/manage-access-to-objects/manage-access-to-saved-queries.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.