> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/graph-search/graph-search-examples.md).

# Graph Search examples

{% hint style="info" %}

### Notice

This feature is included with a Cortex XSIAM Premium license. It is also included with any other Cortex XSIAM license that has the Cloud Posture Security or Cloud Runtime Security add-on.
{% endhint %}

{% hint style="warning" %}

### Prerequisite

Graph Search requires **View** or **View/Edit** RBAC permissions for **Graph Search** under **Investigation & Response** → **Search**.
{% endhint %}

Review the following topics:

* [Get started with Graph Search queries](/cortex-xsiam/reference-and-developer-docs/graph-search/get-started-with-graph-search-queries.md)
* [How to build Graph Search queries?](/cortex-xsiam/reference-and-developer-docs/graph-search/how-to-build-graph-search-queries.md)
* [Understand Graph Search query results](/cortex-xsiam/reference-and-developer-docs/graph-search/understand-graph-search-query-results.md)
* [Create Graph Search query](/cortex-xsiam/reference-and-developer-docs/graph-search/create-graph-search-query.md)

The best way to learn how to create Graph Search queries is to try out a few examples. The examples below provide a good guide to creating Graph Search queries. One thing to keep in mind if you try these queries in your own environment, the search results can differ according to your collected data.

This example takes you through building a query with asset nodes. The query looks at the virtual machines (VMs) in your network that are connected to the Internet, attached to a Network Interface, are contained in a subnet, and are part of a virtual private cloud (VPC).

**Step 1: Search for all VMs on your network**

* Select **Compute** → **Virtual Machine**, and click **Search**.

**Graph Search results:** A graph displaying all the virtual machines in your network, where some are connected to the internet, and some are not connected to the internet.

**Step 2: Filter the VMs to only display the ones connected to the Internet**

1. Click **Edit Query**, and define the following **WHERE** statement:
   * **Select field** = **Internet Exposed**
   * Leave the equal (**=**) operator.
   * **Select values** = **true**.
2. Click **Search**.

**Graph Search results:** A graph displaying all the virtual machines in your network that are connected to the Internet.

**Step 3. Display the VM connected to the Internet with an attachment to a Network Interface**

1. Click **Edit Query** and then **+**.
2. Define the **THAT** statement by selecting **Network** → **Network Interface**.
3. Click **Search**.

**Graph Search results:** A graph displaying all the virtual machines in your network that are connected to the Internet with a network interface attached.

**Step 4. Display the VM connected to the Internet with an attachment to a Network Interface and is contained in a subnet**

1. Click **Edit Query** and then **+**.
2. Define the **THAT** statement by selecting **Network** → **Subnet**.
3. Click **Search**.

**Graph Search results:** A graph displaying all the virtual machines in your network that are connected to the internet with a network interface attached, and are contained in a subnet.

**Step 5. Display the VM connected to the Internet with an attachment to a Network Interface, is contained in a subnet, and is part of a VPC**

1. Click **Edit Query** and then **+**.
2. Define the **THAT** statement by selecting **Network** → **VPC**.
3. Click **Search**.

**Graph Search results:** A graph displaying all the virtual machines in your network that are connected to the internet with a network interface attached, are contained in a subnet, and are part of a VPC.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/graph-search/graph-search-examples.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.