> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/xql-command-reference-guide/readme.md). # Cortex XQL Command Reference Cortex XQL (Extended Query Language) is a powerful query language used in the Cortex platform for threat hunting, investigation, and analytics across your security data. This reference provides comprehensive documentation for all XQL functions and pipeline stages. XQL queries are composed of **stages** connected in a pipeline, with **functions** used within those stages to transform, filter, and analyze data. This reference is organized into two main sections: * [**Functions**](/xql-command-reference-guide/readme/functions.md) – Built-in functions, indexes, and detailed reference pages. * [**Stages**](/xql-command-reference-guide/readme/stages.md) – Pipeline stages, indexes, and detailed reference pages. ## Functions | Function | Description | | ---------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------- | | [`acos`](/xql-command-reference-guide/readme/functions/acos.md) | Calculate the inverse cosine (arccosine) of a numerical expression | | [`add`](/xql-command-reference-guide/readme/functions/add.md) | | | [`approx_count`](/xql-command-reference-guide/readme/functions/approx_count.md) | | | [`approx_quantiles`](/xql-command-reference-guide/readme/functions/approx_quantiles.md) | | | [`approx_top`](/xql-command-reference-guide/readme/functions/approx_top.md) | | | [`asin`](/xql-command-reference-guide/readme/functions/asin.md) | Calculate the inverse sine (arcsine) of a numerical expression | | [`array_all`](/xql-command-reference-guide/readme/functions/array_all.md) | | | [`array_any`](/xql-command-reference-guide/readme/functions/array_any.md) | | | [`array_length`](/xql-command-reference-guide/readme/functions/array_length.md) | | | [`arrayconcat`](/xql-command-reference-guide/readme/functions/arrayconcat.md) | | | [`arraycreate`](/xql-command-reference-guide/readme/functions/arraycreate.md) | | | [`arraydistinct`](/xql-command-reference-guide/readme/functions/arraydistinct.md) | | | [`arrayfilter`](/xql-command-reference-guide/readme/functions/arrayfilter.md) | | | [`arrayindex`](/xql-command-reference-guide/readme/functions/arrayindex.md) | | | [`arrayindexof`](/xql-command-reference-guide/readme/functions/arrayindexof.md) | | | [`arraymap`](/xql-command-reference-guide/readme/functions/arraymap.md) | | | [`arraymerge`](/xql-command-reference-guide/readme/functions/arraymerge.md) | | | [`arrayrange`](/xql-command-reference-guide/readme/functions/arrayrange.md) | | | [`arraystring`](/xql-command-reference-guide/readme/functions/arraystring.md) | | | [`avg`](/xql-command-reference-guide/readme/functions/avg_with_comp_stage.md) | | | [`avg`](/xql-command-reference-guide/readme/functions/avg_with_windowcomp_stage.md) | | | [`bitwise_and`](/xql-command-reference-guide/readme/functions/bitwise_and.md) | Perform a bitwise AND operation between two integer values | | [`bitwise_or`](/xql-command-reference-guide/readme/functions/bitwise_or.md) | Perform a bitwise OR operation between two integer values | | [`bitwise_sleft`](/xql-command-reference-guide/readme/functions/bitwise_sleft.md) | Perform a bitwise left shift operation on an integer value | | [`bitwise_sright`](/xql-command-reference-guide/readme/functions/bitwise_sright.md) | Perform a bitwise right shift operation on an integer value | | [`bitwise_xor`](/xql-command-reference-guide/readme/functions/bitwise_xor.md) | Perform a bitwise exclusive OR (XOR) operation between two integer values | | [`cbrt`](/xql-command-reference-guide/readme/functions/cbrt.md) | Calculate the cube root of a numeric value | | [`ceil`](/xql-command-reference-guide/readme/functions/ceil.md) | Round a number up to the nearest integer | | [`coalesce`](/xql-command-reference-guide/readme/functions/coalesce.md) | | | [`concat`](/xql-command-reference-guide/readme/functions/concat.md) | | | [`convert_from_base_64`](/xql-command-reference-guide/readme/functions/convert_from_base_64.md) | | | [`convert_to_base_64`](/xql-command-reference-guide/readme/functions/convert_to_base_64.md) | | | [`cos`](/xql-command-reference-guide/readme/functions/cos.md) | Calculate the cosine of a numeric value specified in radians | | [`cosine_distance`](/xql-command-reference-guide/readme/functions/cosine_distance.md) | Calculate the cosine distance between two numeric vectors | | [`cot`](/xql-command-reference-guide/readme/functions/cot.md) | Calculate the cotangent of a numeric value specified in radians | | [`count`](/xql-command-reference-guide/readme/functions/count_with_comp_stage.md) | | | [`count`](/xql-command-reference-guide/readme/functions/count_with_windowcomp_stage.md) | | | [`count_distinct`](/xql-command-reference-guide/readme/functions/count_distinct.md) | | | [`csc`](/xql-command-reference-guide/readme/functions/csc.md) | Calculate the cosecant of a numeric value specified in radians | | [`current_time`](/xql-command-reference-guide/readme/functions/current_time.md) | | | [`date_floor`](/xql-command-reference-guide/readme/functions/date_floor.md) | | | [`divide`](/xql-command-reference-guide/readme/functions/divide.md) | | | [`earliest`](/xql-command-reference-guide/readme/functions/earliest.md) | | | [`euclidean_distance`](/xql-command-reference-guide/readme/functions/euclidean_distance.md) | Calculate the Euclidean distance between two numeric vectors | | [`exp`](/xql-command-reference-guide/readme/functions/exp.md) | Calculate the value of e raised to the power of a numeric value | | [`extract_time`](/xql-command-reference-guide/readme/functions/extract_time.md) | | | [`extract_url_host`](/xql-command-reference-guide/readme/functions/extract_url_host.md) | | | [`extract_url_pub_suffix`](/xql-command-reference-guide/readme/functions/extract_url_pub_suffix.md) | | | [`extract_url_registered_domain`](/xql-command-reference-guide/readme/functions/extract_url_registered_domain.md) | | | [`first`](/xql-command-reference-guide/readme/functions/first.md) | | | [`first_value`](/xql-command-reference-guide/readme/functions/first_value.md) | | | [`floor`](/xql-command-reference-guide/readme/functions/floor.md) | | | [`format_string`](/xql-command-reference-guide/readme/functions/format_string.md) | | | [`format_timestamp`](/xql-command-reference-guide/readme/functions/format_timestamp.md) | | | [`greatest`](/xql-command-reference-guide/readme/functions/greatest.md) | Return the largest value from a list of expressions | | [`if`](/xql-command-reference-guide/readme/functions/if.md) | | | [`incidr`](/xql-command-reference-guide/readme/functions/incidr.md) | | | [`incidr6`](/xql-command-reference-guide/readme/functions/incidr6.md) | | | [`incidrlist`](/xql-command-reference-guide/readme/functions/incidrlist.md) | | | [`int_to_ip`](/xql-command-reference-guide/readme/functions/int_to_ip.md) | | | [`ip_to_int`](/xql-command-reference-guide/readme/functions/ip_to_int.md) | | | [`is_ipv4`](/xql-command-reference-guide/readme/functions/is_ipv4.md) | | | [`is_ipv6`](/xql-command-reference-guide/readme/functions/is_ipv6.md) | | | [`is_known_private_ipv4`](/xql-command-reference-guide/readme/functions/is_known_private_ipv4.md) | | | [`is_known_private_ipv6`](/xql-command-reference-guide/readme/functions/is_known_private_ipv6.md) | | | [`json_extract`](/xql-command-reference-guide/readme/functions/json_extract.md) | | | [`json_extract_array`](/xql-command-reference-guide/readme/functions/json_extract_array.md) | | | [`json_extract_scalar`](/xql-command-reference-guide/readme/functions/json_extract_scalar.md) | | | [`json_extract_scalar_array`](/xql-command-reference-guide/readme/functions/json_extract_scalar_array.md) | | | [`json_path_extract`](/xql-command-reference-guide/readme/functions/json_path_extract.md) | | | [`json_functions_reference`](/xql-command-reference-guide/readme/functions/json_functions_reference.md) | A comprehensive guide to the four JSON extraction functions | | [`lag`](/xql-command-reference-guide/readme/functions/lag.md) | | | [`last`](/xql-command-reference-guide/readme/functions/last.md) | | | [`last_value`](/xql-command-reference-guide/readme/functions/last_value.md) | | | [`latest`](/xql-command-reference-guide/readme/functions/latest.md) | | | [`least`](/xql-command-reference-guide/readme/functions/least.md) | Return the smallest value from a list of expressions | | [`len`](/xql-command-reference-guide/readme/functions/len.md) | | | [`list (comp)`](/xql-command-reference-guide/readme/functions/list_with_comp_stage.md) | Collect all values of a field and return them as an array within the comp stage | | [`ln`](/xql-command-reference-guide/readme/functions/ln.md) | Calculate the natural logarithm (base e) of a numeric value | | [`log`](/xql-command-reference-guide/readme/functions/log.md) | Calculate the logarithm of a numeric value with a specified base | | [`log10`](/xql-command-reference-guide/readme/functions/log10.md) | Calculate the base-10 logarithm of a numeric value | | [`lowercase`](/xql-command-reference-guide/readme/functions/lowercase.md) | | | [`ltrim`](/xql-command-reference-guide/readme/functions/ltrim.md) | | | [`max (comp)`](/xql-command-reference-guide/readme/functions/max_with_comp_stage.md) | Return the maximum value of a field within the comp stage | | [`max (windowcomp)`](/xql-command-reference-guide/readme/functions/max_with_windowcomp_stage.md) | Compute the maximum value of a field over a window of rows within the windowcomp stage | | [`md5`](/xql-command-reference-guide/readme/functions/md5.md) | | | [`median (comp)`](/xql-command-reference-guide/readme/functions/median_with_comp_stage.md) | Return the median value of a numeric field within the comp stage | | [`median (windowcomp)`](/xql-command-reference-guide/readme/functions/median_with_windowcomp_stage.md) | Compute the median value of a numeric field over a window of rows within the windowcomp stage | | [`min (comp)`](/xql-command-reference-guide/readme/functions/min_with_comp_stage.md) | Return the minimum value of a field within the comp stage | | [`min (windowcomp)`](/xql-command-reference-guide/readme/functions/min_with_windowcomp_stage.md) | Compute the minimum value of a field over a window of rows within the windowcomp stage | | [`mod`](/xql-command-reference-guide/readme/functions/mod.md) | Calculate the remainder (modulus) of the division of two numeric values | | [`multiply`](/xql-command-reference-guide/readme/functions/multiply.md) | | | [`object_create`](/xql-command-reference-guide/readme/functions/object_create.md) | | | [`object_merge`](/xql-command-reference-guide/readme/functions/object_merge.md) | | | [`parse_epoch`](/xql-command-reference-guide/readme/functions/parse_epoch.md) | | | [`parse_timestamp`](/xql-command-reference-guide/readme/functions/parse_timestamp.md) | | | [`pow`](/xql-command-reference-guide/readme/functions/pow.md) | | | [`power`](/xql-command-reference-guide/readme/functions/power.md) | Raise a number to the power of another number (alias for pow) | | [`rand`](/xql-command-reference-guide/readme/functions/rand.md) | Generate a pseudo-random floating-point number between 0 and 1 | | [`range_bucket`](/xql-command-reference-guide/readme/functions/range_bucket.md) | Determine which bucket a numeric value falls into given an array of boundaries | | [`rank (windowcomp)`](/xql-command-reference-guide/readme/functions/rank_with_windowcomp_stage.md) | Assign a rank to each row within a partition in the windowcomp stage | | [`regexcapture`](/xql-command-reference-guide/readme/functions/regexcapture.md) | | | [`regextract`](/xql-command-reference-guide/readme/functions/regextract.md) | Extract a substring from a field value using a regular expression pattern | | [`replace`](/xql-command-reference-guide/readme/functions/replace.md) | | | [`replex`](/xql-command-reference-guide/readme/functions/replex.md) | | | [`round`](/xql-command-reference-guide/readme/functions/round.md) | | | [`row_number (windowcomp)`](/xql-command-reference-guide/readme/functions/row_number_with_windowcomp_stage.md) | Assign a unique sequential integer to each row within a partition in the windowcomp stage | | [`rtrim`](/xql-command-reference-guide/readme/functions/rtrim.md) | | | [`safe_add`](/xql-command-reference-guide/readme/functions/safe_add.md) | Perform addition with overflow protection, returning null on overflow | | [`safe_divide`](/xql-command-reference-guide/readme/functions/safe_divide.md) | Perform division with error protection, returning null on division by zero | | [`safe_multiply`](/xql-command-reference-guide/readme/functions/safe_multiply.md) | Perform multiplication with overflow protection, returning null on overflow | | [`safe_negate`](/xql-command-reference-guide/readme/functions/safe_negate.md) | Negate a numeric value with overflow protection, returning null on overflow | | [`safe_subtract`](/xql-command-reference-guide/readme/functions/safe_subtract.md) | Perform subtraction with overflow protection, returning null on overflow | | [`sec`](/xql-command-reference-guide/readme/functions/sec.md) | Calculate the secant of a numeric value specified in radians | | [`sha1`](/xql-command-reference-guide/readme/functions/sha1.md) | | | [`sha256`](/xql-command-reference-guide/readme/functions/sha256.md) | | | [`sha512`](/xql-command-reference-guide/readme/functions/sha512.md) | | | [`sign`](/xql-command-reference-guide/readme/functions/sign.md) | Determine the sign of a numeric value (-1, 0, or 1) | | [`sin`](/xql-command-reference-guide/readme/functions/sin.md) | Calculate the sine of a numeric value specified in radians | | [`split`](/xql-command-reference-guide/readme/functions/split.md) | | | [`sqrt`](/xql-command-reference-guide/readme/functions/sqrt.md) | Calculate the square root of a numeric value | | [`stddev_population (comp)`](/xql-command-reference-guide/readme/functions/stddev_population_with_comp_stage.md) | Compute the population standard deviation of a numeric field within the comp stage | | [`stddev_population (windowcomp)`](/xql-command-reference-guide/readme/functions/stddev_population_with_windowcomp_stage.md) | Compute the population standard deviation of a numeric field over a window of rows within the windowcomp stage | | [`stddev_sample (comp)`](/xql-command-reference-guide/readme/functions/stddev_sample_with_comp_stage.md) | Compute the sample standard deviation of a numeric field within the comp stage | | [`stddev_sample (windowcomp)`](/xql-command-reference-guide/readme/functions/stddev_sample_with_windowcomp_stage.md) | Compute the sample standard deviation of a numeric field over a window of rows within the windowcomp stage | | [`string_count`](/xql-command-reference-guide/readme/functions/string_count.md) | | | [`subtract`](/xql-command-reference-guide/readme/functions/subtract.md) | | | [`sum (comp)`](/xql-command-reference-guide/readme/functions/sum_with_comp_stage.md) | Compute the sum of a numeric field within the comp stage | | [`sum (windowcomp)`](/xql-command-reference-guide/readme/functions/sum_with_windowcomp_stage.md) | Compute the sum of a numeric field over a window of rows within the windowcomp stage | | [`tan`](/xql-command-reference-guide/readme/functions/tan.md) | Calculate the tangent of a numeric value specified in radians | | [`time_frame_end`](/xql-command-reference-guide/readme/functions/time_frame_end.md) | | | [`timestamp_diff`](/xql-command-reference-guide/readme/functions/timestamp_diff.md) | | | [`timestamp_seconds`](/xql-command-reference-guide/readme/functions/timestamp_seconds.md) | | | [`to_boolean`](/xql-command-reference-guide/readme/functions/to_boolean.md) | | | [`to_epoch`](/xql-command-reference-guide/readme/functions/to_epoch.md) | | | [`to_float`](/xql-command-reference-guide/readme/functions/to_float.md) | | | [`to_integer`](/xql-command-reference-guide/readme/functions/to_integer.md) | | | [`to_json_string`](/xql-command-reference-guide/readme/functions/to_json_string.md) | | | [`to_number`](/xql-command-reference-guide/readme/functions/to_number.md) | | | [`to_string`](/xql-command-reference-guide/readme/functions/to_string.md) | | | [`to_timestamp`](/xql-command-reference-guide/readme/functions/to_timestamp.md) | | | [`trim`](/xql-command-reference-guide/readme/functions/trim.md) | | | [`trunc`](/xql-command-reference-guide/readme/functions/trunc.md) | Truncate a numeric value to a specified number of decimal places | | [`uppercase`](/xql-command-reference-guide/readme/functions/uppercase.md) | | | [`values`](/xql-command-reference-guide/readme/functions/values.md) | Collect all distinct values of a field and return them as an array within the comp stage | | [`var`](/xql-command-reference-guide/readme/functions/var.md) | Compute the variance of a numeric field within the comp stage | | [`wildcard_match`](/xql-command-reference-guide/readme/functions/wildcard_match.md) | | ## Stages | Stage | Description | | -------------------------------------------------------------------------- | ----------- | | [`alter`](/xql-command-reference-guide/readme/stages/alter.md) | | | [`arrayexpand`](/xql-command-reference-guide/readme/stages/arrayexpand.md) | | | [`bin`](broken://pages/iXUj4a2EYoZsIh7IkQHw) | | | [`call`](/xql-command-reference-guide/readme/stages/call.md) | | | [`comp`](/xql-command-reference-guide/readme/stages/comp.md) | | | [`config`](/xql-command-reference-guide/readme/stages/config.md) | | | [`dataset`](/xql-command-reference-guide/readme/stages/dataset.md) | | | [`dedup`](/xql-command-reference-guide/readme/stages/dedup.md) | | | [`fields`](/xql-command-reference-guide/readme/stages/fields.md) | | | [`filter`](/xql-command-reference-guide/readme/stages/filter.md) | | | [`iploc`](/xql-command-reference-guide/readme/stages/iploc.md) | | | [`join`](/xql-command-reference-guide/readme/stages/join.md) | | | [`limit`](/xql-command-reference-guide/readme/stages/limit.md) | | | [`presets`](/xql-command-reference-guide/readme/stages/presets.md) | | | [`replacenull`](/xql-command-reference-guide/readme/stages/replacenull.md) | | | [`search`](/xql-command-reference-guide/readme/stages/search.md) | | | [`sort`](/xql-command-reference-guide/readme/stages/sort.md) | | | [`tag`](/xql-command-reference-guide/readme/stages/tag.md) | | | [`target`](/xql-command-reference-guide/readme/stages/target.md) | | | [`top`](/xql-command-reference-guide/readme/stages/top.md) | | | [`transaction`](/xql-command-reference-guide/readme/stages/transaction.md) | | | [`union`](/xql-command-reference-guide/readme/stages/union.md) | | | [`view`](/xql-command-reference-guide/readme/stages/view.md) | | | [`windowcomp`](/xql-command-reference-guide/readme/stages/windowcomp.md) | | --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://cortex-docs.paloaltonetworks.com/xql-command-reference-guide/readme.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.