> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/cortex-agentix-xql/build-xql-queries/legacy-query-builder.md).

# Legacy Query Builder

{% hint style="info" %}
We recommend using the Query Builder in **New mode** to take advantage of the Query Builder templates and the ability to search the full Cortex Data Model (XDM).

In **Legacy mode**, the Query Builder searches predefined datasets only. To search the full XDM, switch to New mode or select XQL Search.
{% endhint %}

The **Legacy Query Builder** provides queries for the following types of entities:

* **Process**: Search on process execution and injection by process name, hash, path, command line arguments, and more. See [Create process query](/cortex-xsiam/reference-and-developer-docs/cortex-agentix-xql/build-xql-queries/legacy-query-builder/create-authentication-query.md).
* **File**: Search on file creation and modification activity by file name and path. See [Create file query](/cortex-xsiam/reference-and-developer-docs/cortex-agentix-xql/build-xql-queries/legacy-query-builder/create-event-log-query.md).
* **Network**: Search network activity by IP address, port, host name, protocol, and more. See [Create network query](/cortex-xsiam/reference-and-developer-docs/cortex-agentix-xql/build-xql-queries/legacy-query-builder/create-file-query.md).
* **Image Load**: Search on module load into process events by module IDs and more. See [Create image load query](/cortex-xsiam/reference-and-developer-docs/cortex-agentix-xql/build-xql-queries/legacy-query-builder/create-image-load-query.md).
* **Registry**: Search on registry creation and modification activity by key, key value, path, and data. See [Create registry query](/cortex-xsiam/reference-and-developer-docs/cortex-agentix-xql/build-xql-queries/legacy-query-builder/create-network-connections-query.md).
* **Event Log**: Search Windows event logs and Linux system authentication logs by username, log event ID (Windows only), log level, and message. See [Create event log query](/cortex-xsiam/reference-and-developer-docs/cortex-agentix-xql/build-xql-queries/legacy-query-builder/create-network-query.md).
* **Network Connections**: Search security event logs by firewall logs, endpoint raw data over your network. See [Create network connections query](/cortex-xsiam/reference-and-developer-docs/cortex-agentix-xql/build-xql-queries/legacy-query-builder/create-process-query.md).
* **Authentications**: Search on authentication events by identity, target outcome, and more. See [Create authentication query](/cortex-xsiam/reference-and-developer-docs/cortex-agentix-xql/build-xql-queries/legacy-query-builder/create-registry-query.md).
* **All Actions**: Search across all network, registry, file, and process activity by endpoint or process. See [Query across all entities](/cortex-xsiam/reference-and-developer-docs/cortex-agentix-xql/build-xql-queries/legacy-query-builder/query-across-all-entities.md).

The **Query Builder** also provides flexibility for both on-demand query generation and scheduled queries.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/cortex-agentix-xql/build-xql-queries/legacy-query-builder.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.