XQL query language

The Cortex Query Language (XQL) lets you build advanced queries against the data collected across your environment, so you can investigate and analyze beyond what the standard interface provides. You build queries in the Query Builder, run ad hoc investigations, save and schedule reusable queries, and power custom dashboards and widgets.

Note: For more information, see the Cortex Cloud XQL documentation.

The following sections provide examples of how you can use XQL queries across the main capabilities of Cortex Data Security.

Data Security Posture Management (DSPM)

DSPM queries help identify where sensitive data resides and the risks associated with it, such as public exposure or the presence of malware on sensitive assets. See the following examples as starting points for building your queries:

Publicly Accessible Files Containing PII

Identifies files that are both open to the public internet and contain patterns classified as Personally Identifiable Information (PII).

dataset = dspm_asset_file_inventory 
| arrayexpand file_data_patterns 
| alter profile = json_extract_scalar(file_data_patterns, "$.data_profile") 
| filter file_is_open_to_world = true and profile = "PII" 
| fields file_id

Assets with Malware and Sensitive Data

Identifies assets that have both malware findings and sensitive data findings by performing a join on the asset ID across different discovery types.

dataset = findings 
| filter xdm.finding.type_id = 80000002 
| join(dataset = findings) as malware xdm.finding.asset_id = malware.xdm.finding.asset_id 
| fields xdm.finding.asset_id as asset_id

Malware Detections by Rule

Targets the specific DSPM malware detection rule (Rule ID: DSPM_1010).

dataset = issues
| filter xdm.issue.owner = "DSPM" and xdm.issue.detection.rule_id = "DSPM_1010"
| fields xdm.issue.name as Name, xdm.issue.severity as Severity, xdm.issue.observation_time as Observation_Time, xdm.issue.category as Category, xdm.issue.description as Description, xdm.issue.status.progress as Status

Shadow Backups

Finds unmanaged database dumps or copies in unstructured storage.

dataset = dspm_asset_file_inventory
| filter file_is_shadow_backup = true and file_is_deleted = false
| fields file_name, file_folder as Folder, file_extension_category as File_Type, file_last_modification_time as Last_Modified, file_data_patterns as Data_Patterns, last_classification_time as Last_Classified_Time

AI Security Posture Management (AISPM)

AISPM helps organizations monitor their AI footprint and the security posture of AI model endpoints, ensuring models are accounted for and protected from common LLM vulnerabilities. See the following examples as starting points for building your queries:

Public Model Endpoints Lacking Prompt Attack Protection

Cross-references public endpoint findings with a lack of prompt injection protection, highlighting critical security gaps in AI deployments.

dataset = findings
| filter xdm.finding.type_id = 110000002
| join(
    dataset = findings
    | filter xdm.finding.type_id = 110000004
) as public_endpoint xdm.finding.asset_id = public_endpoint.xdm.finding.asset_id
| fields xdm.finding.asset_id as asset_id

Sensitive AI Assets

Surfaces AI assets that carry data-security risk—datasets containing sensitive data, models trained on sensitive data, or model endpoints using sensitive inference data—by joining the AI asset inventory with the sensitive-data finding type.

dataset = asset_inventory
| filter xdm.asset.type.class = "AI"
| join (
    dataset = findings
    | filter xdm.finding.type_id = 110000001
) as sensitive_AI sensitive_ai.xdm.finding.asset_id = xdm.asset.id
| fields
    xdm.asset.name as Asset_Name,
    xdm.asset.type.category as Asset_Type,
    xdm.asset.provider as Cloud,
    xdm.finding.normalized_fields as Sensitive_Data

AI Datasets Containing PII

Pinpoints AI training datasets that contain PII by joining the sensitive-data finding with the data-classification profile definitions, so you can govern sensitive data feeding your models. To check for a different data class (for example PCI), change the classification_mgmt_data_profile filter from name = "PII" to name = "PCI".

dataset = asset_inventory
| filter xdm.asset.type.class = "AI" and xdm.asset.type.category = "Dataset"
| join(
    dataset = findings
    | filter xdm.finding.type_id = 110000001
    | filter xdm.finding.is_active = TRUE
    | alter data_profile = json_extract_scalar_array(xdm.finding.normalized_fields, "$['xdm.data.data_profile']")
    | arrayexpand data_profile
) as sensitive_AI sensitive_ai.xdm.finding.asset_id = xdm.asset.id
| join(
    dataset = classification_mgmt_data_profile
    | filter name = "PII" and enabled = True
) as data_profile_def data_profile_def.id = to_integer(data_profile)
| fields name as data_type, xdm.asset.name as dataset_name, xdm.asset.strong_id as dataset_full_path, xdm.asset.provider as dataset_provider, xdm.asset.realm as dataset_realm, xdm.asset.type.name as dataset_type, xdm.finding.description as description

Data Access Governance

Data access governance queries use identity context to surface which identities can reach your sensitive data stores and where that access is risky—helping you enforce least privilege and govern who can access your data. See the following examples as starting points for building your queries:

Users Without MFA Holding Sensitive Storage Permissions

Identifies AWS users who can configure sensitive S3 and EC2 resources yet do not have MFA enabled—an elevated-risk path to your data stores.

dataset =  ciem_permissions_with_last_access
| filter source_cloud_type = "aws" and source_cloud_resource_type = "user" and action_access_level contains "Config" and dest_cloud_service_name in ("s3", "ec2")
| join (dataset = asset_inventory) as assets source_cloud_resource_uai = assets.xdm.asset.id
| filter lowercase(json_extract_scalar(xdm.asset.normalized_fields, "$['xdm.identity.has_mfa']")) = "false"

Compute Instances with Write Access to Blob Storage

Identifies Azure virtual machines that hold configure or write permissions over blob storage data stores at the subscription level, surfacing non-human identities that can modify sensitive data.

dataset = ciem_permissions_with_last_access
 | filter source_cloud_type = "azure" and source_cloud_resource_type = "virtualMachines" and (lowercase(action_access_level) contains "config" or lowercase(action_access_level) contains "write") and dest_cloud_resource_type ~= "^storageAccounts/blobServices" and grantedby_level_type = "AZURE_SUBSCRIPTION"

Asset and Inventory Insights

Asset and inventory insights help you establish a clear picture of your data footprint by tracking the volume of sensitive records, surfacing where data is stored, and monitoring asset tagging across your cloud providers. See the following examples as starting points for building your queries:

Sensitive Record Totals

Summarizes the total volume of sensitive data (PII, PCI, etc.) across the environment.

dataset = dspm_asset_data_patterns
| comp sum(record_count) as Records by kind
| fields kind, Records

Tag-Based Discovery

Shows how to filter data assets based on cloud tags (for example, finding all buckets tagged as "Production").

dataset = asset_inventory
| filter xdm.asset.type.class = "Data"
| alter tag_key = xdm.asset.tags -> ["Environment"], tag_val = xdm.asset.tags -> ["Production"]
| filter tag_key = "Production"