> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/data-security-documentation/advanced-tools/xql-query-language.md). # XQL query language The Cortex Query Language (XQL) lets you build advanced queries against the data collected across your environment, so you can investigate and analyze beyond what the standard interface provides. You build queries in the Query Builder, run ad hoc investigations, save and schedule reusable queries, and power custom dashboards and widgets. {% hint style="info" icon="note-sticky" %} **Note:** For more information, see the [Cortex Cloud XQL documentation](/cortex-cloud-runtime-security/cortex-cloud-xql/get-started-with-xql.md). {% endhint %} The following sections provide examples of how you can use XQL queries across the main capabilities of Cortex Data Security. ## Data Security Posture Management (DSPM) DSPM queries help identify where sensitive data resides and the risks associated with it, such as public exposure or the presence of malware on sensitive assets. See the following examples as starting points for building your queries:
Publicly Accessible Files Containing PII Identifies files that are both open to the public internet and contain patterns classified as Personally Identifiable Information (PII). ```xql dataset = dspm_asset_file_inventory | arrayexpand file_data_patterns | alter profile = json_extract_scalar(file_data_patterns, "$.data_profile") | filter file_is_open_to_world = true and profile = "PII" | fields file_id ```
Assets with Malware and Sensitive Data Identifies assets that have both malware findings and sensitive data findings by performing a join on the asset ID across different discovery types. ```xql dataset = findings | filter xdm.finding.type_id = 80000002 | join(dataset = findings) as malware xdm.finding.asset_id = malware.xdm.finding.asset_id | fields xdm.finding.asset_id as asset_id ```
Malware Detections by Rule Targets the specific DSPM malware detection rule (Rule ID: DSPM\_1010). ```xql dataset = issues | filter xdm.issue.owner = "DSPM" and xdm.issue.detection.rule_id = "DSPM_1010" | fields xdm.issue.name as Name, xdm.issue.severity as Severity, xdm.issue.observation_time as Observation_Time, xdm.issue.category as Category, xdm.issue.description as Description, xdm.issue.status.progress as Status ```
Shadow Backups Finds unmanaged database dumps or copies in unstructured storage. ```xql dataset = dspm_asset_file_inventory | filter file_is_shadow_backup = true and file_is_deleted = false | fields file_name, file_folder as Folder, file_extension_category as File_Type, file_last_modification_time as Last_Modified, file_data_patterns as Data_Patterns, last_classification_time as Last_Classified_Time ```
## AI Security Posture Management (AISPM) AISPM helps organizations monitor their AI footprint and the security posture of AI model endpoints, ensuring models are accounted for and protected from common LLM vulnerabilities. See the following examples as starting points for building your queries:
Public Model Endpoints Lacking Prompt Attack Protection Cross-references public endpoint findings with a lack of prompt injection protection, highlighting critical security gaps in AI deployments. ```xql dataset = findings | filter xdm.finding.type_id = 110000002 | join( dataset = findings | filter xdm.finding.type_id = 110000004 ) as public_endpoint xdm.finding.asset_id = public_endpoint.xdm.finding.asset_id | fields xdm.finding.asset_id as asset_id ```
Sensitive AI Assets Surfaces AI assets that carry data-security risk—datasets containing sensitive data, models trained on sensitive data, or model endpoints using sensitive inference data—by joining the AI asset inventory with the sensitive-data finding type. ```xql dataset = asset_inventory | filter xdm.asset.type.class = "AI" | join ( dataset = findings | filter xdm.finding.type_id = 110000001 ) as sensitive_AI sensitive_ai.xdm.finding.asset_id = xdm.asset.id | fields xdm.asset.name as Asset_Name, xdm.asset.type.category as Asset_Type, xdm.asset.provider as Cloud, xdm.finding.normalized_fields as Sensitive_Data ```
AI Datasets Containing PII Pinpoints AI training datasets that contain PII by joining the sensitive-data finding with the data-classification profile definitions, so you can govern sensitive data feeding your models. To check for a different data class (for example PCI), change the `classification_mgmt_data_profile` filter from `name = "PII"` to `name = "PCI"`. ```xql dataset = asset_inventory | filter xdm.asset.type.class = "AI" and xdm.asset.type.category = "Dataset" | join( dataset = findings | filter xdm.finding.type_id = 110000001 | filter xdm.finding.is_active = TRUE | alter data_profile = json_extract_scalar_array(xdm.finding.normalized_fields, "$['xdm.data.data_profile']") | arrayexpand data_profile ) as sensitive_AI sensitive_ai.xdm.finding.asset_id = xdm.asset.id | join( dataset = classification_mgmt_data_profile | filter name = "PII" and enabled = True ) as data_profile_def data_profile_def.id = to_integer(data_profile) | fields name as data_type, xdm.asset.name as dataset_name, xdm.asset.strong_id as dataset_full_path, xdm.asset.provider as dataset_provider, xdm.asset.realm as dataset_realm, xdm.asset.type.name as dataset_type, xdm.finding.description as description ```
## Data Access Governance Data access governance queries use identity context to surface which identities can reach your sensitive data stores and where that access is risky—helping you enforce least privilege and govern who can access your data. See the following examples as starting points for building your queries:
Users Without MFA Holding Sensitive Storage Permissions Identifies AWS users who can configure sensitive S3 and EC2 resources yet do not have MFA enabled—an elevated-risk path to your data stores. ```xql dataset = ciem_permissions_with_last_access | filter source_cloud_type = "aws" and source_cloud_resource_type = "user" and action_access_level contains "Config" and dest_cloud_service_name in ("s3", "ec2") | join (dataset = asset_inventory) as assets source_cloud_resource_uai = assets.xdm.asset.id | filter lowercase(json_extract_scalar(xdm.asset.normalized_fields, "$['xdm.identity.has_mfa']")) = "false" ```
Compute Instances with Write Access to Blob Storage Identifies Azure virtual machines that hold configure or write permissions over blob storage data stores at the subscription level, surfacing non-human identities that can modify sensitive data. ```xql dataset = ciem_permissions_with_last_access | filter source_cloud_type = "azure" and source_cloud_resource_type = "virtualMachines" and (lowercase(action_access_level) contains "config" or lowercase(action_access_level) contains "write") and dest_cloud_resource_type ~= "^storageAccounts/blobServices" and grantedby_level_type = "AZURE_SUBSCRIPTION" ```
## Asset and Inventory Insights Asset and inventory insights help you establish a clear picture of your data footprint by tracking the volume of sensitive records, surfacing where data is stored, and monitoring asset tagging across your cloud providers. See the following examples as starting points for building your queries:
Sensitive Record Totals Summarizes the total volume of sensitive data (PII, PCI, etc.) across the environment. ```xql dataset = dspm_asset_data_patterns | comp sum(record_count) as Records by kind | fields kind, Records ```
Tag-Based Discovery Shows how to filter data assets based on cloud tags (for example, finding all buckets tagged as "Production"). ```xql dataset = asset_inventory | filter xdm.asset.type.class = "Data" | alter tag_key = xdm.asset.tags -> ["Environment"], tag_val = xdm.asset.tags -> ["Production"] | filter tag_key = "Production" ```
--- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://cortex-docs.paloaltonetworks.com/data-security-documentation/advanced-tools/xql-query-language.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.