> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/learn-about-cortex-xsoar/day-to-day-tasks-in-cortex-xsoar/incident-management/create-a-search-query-for-incidents.md).

# Create a Search Query for Incidents

The default view of the Incidents page displays all open incidents from the last seven days. You can customize which incidents are displayed by creating and saving queries. You can also customize the information that is displayed for each incident by customizing the table summary layout and the Chart panel. This information is then saved as part of the query.

{% hint style="info" %}

### Note

The timezone for searches is UTC. The system timezone is not used.
{% endhint %}

1. In the query bar, type your search criteria.

   By default, the query is **`-status:closed -category:job`**, which searches for categories other than jobs and not those that have been closed. You can add fields like severity or type to narrow your search to critical issues or issues of a certain type.
2. From the dropdown list, select the date range for which you want to search.

   By default, it is the last 7 days.
3. If you want to customize the table summary view, click the gear icon above the table.
4. If you want to customize the chart panel, go to one of the charts and from the dropdown list select the chart as required.
5. To save the query do the following:

   1. Click **Add** to Saved queries.
   2. Type a name for the query.
   3. Click **Save**.

   When clicking **Saved queries** you can view all saved queries, mark them as default, or delete the queries. To edit an existing saved query, create a new query and save it with the exact name of the query you want to replace.

In this example, you need to search for all incidents according to the following criteria:

* Status is not closed
* category is not job
* type is phishing
* opened within the last 7 days

In addition, add the **Created** column to the table summary.

![query\_incidents\_example.png](/files/FItWRz0VOci7UVkkc68Z)

**Share Saved Queries**

Shared queries enable you to share your customized configurations with all users. For example, you can define queries for security analysts to help focus them on incidents relevant for them to analyze. The shared queries feature applies everywhere you define queries, including incidents, dashboards, indicators, and jobs.

Once you create and save a query, to share it with all users click **Saved queries** and then click ![shared-queries-icon.PNG](/files/Pn9w73HFp0EX1IHH2V6C) for that query.

![shared-queries-share-users.PNG](/files/XygUUQrynczYDe6hjRqo)

Hovering over the query name in the list of saved queries shows that the query is shared. The share icon also indicates you can remove the share.

![shared-queries-remove-share.PNG](/files/Bf0YmdiOE24qvkQjlbf3)

The shared query appears in the users’ Saved queries list. They see the query with a ![shared-queries-group-icon.PNG](/files/byFV1kx3hjwmRajaI4va)icon and the name of the shared query owner in parentheses after the query name.

![shared-queries-query-recipients.PNG](/files/WMh18kuIIKHPTIOhxHX8)

{% hint style="info" %}

### Note

* Edits made to shared queries are not saved. To save an edited version of the shared query, make a copy and then edit and save it.
* Copying the shared query or clicking **Mark Default** (to make the query the page default) keeps the shared query in the user’s **Saved queries** list even if the shared query owner removes the share. Otherwise, the query will disappear from the users’ **Saved queries** list if the query owner removes the share.
  {% endhint %}


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/learn-about-cortex-xsoar/day-to-day-tasks-in-cortex-xsoar/incident-management/create-a-search-query-for-incidents.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.