Scheduled Queries reference information - Descriptions of the fields in the Scheduled Queries table. - Administrator Guide - Cortex XDR - Cortex

Scheduled Queries reference information - Descriptions of the fields in the Scheduled Queries table. - Administrator Guide - Cortex XDR - Cortex - Security Operations

Cortex XDR 5.x Documentation

Product

Cortex XDR

License

XDR + Cloud

Creation date

2025-07-13

Last date published

2026-06-11

Note

Certain fields are exposed and hidden by default. An asterisk (*) is beside every field that is exposed by default.

Field	Description
BQL	Whether the query was created by the native search. Native search has been deprecated, this field allows you to view data for queries performed before deprecation.
ISSUED BY	User who ran or scheduled the query.
NEXT EXECUTION	For queries that are scheduled to run at a specific frequency, this displays the next execution time. For queries that were scheduled to run at a specific time and date, this field will show `None`.
PUBLIC API	Whether the source executing the query was an XQL query API.
QUERY DESCRIPTION	Query parameters used to run the query.
QUERY ID	Unique identifier of the query.
QUERY NAME	For saved queries, the Query Name identifies the query specified by the administrator. For scheduled queries, the Query Name identifies the auto-generated name of the parent query. Scheduled queries also display an icon to the left of the name to indicate that the query is recurring.
QUERY SYNTAX	The exact syntax used to write the query.
SCHEDULE TIME	Frequency or time at which the query was scheduled to run.
XQL	Whether the query was created by XQL search.