Manage Datasets - Administrator Guide - Cortex XDR - Cortex - Security Operations

Cortex XDR Pro Administrator Guide

Cortex XDR
Creation date
Last date published
Administrator Guide

Learn how to import, delete, and interact with custom or third-party datasets in Cortex XDR.


This feature requires a Cortex XDR Pro per GB license.

Cortex XDR runs every Cortex Query Language (XQL) query against a dataset. A dataset is a collection of column:value sets. If you do not specify a dataset in your query, Cortex XDR runs the query against the default datasets configured, which is by default xdr_data. The xdr_data dataset contains all of the endpoint and network data that Cortex XDR collects. For a Cortex Data Model (XDM) query, unless specific datasets are specified, a query will run against all mapped datasets. You can always change the default datasets using the set to default option. You can also upload datasets as a CSV, TSV, or JSON file that contains the data you are interested in querying. These uploaded datasets are called lookup datasets.

To query other datasets, you have two options:

  • Set a dataset as default, which enables you to query the datasets without specifying them in the query.

  • Name a specific dataset at the beginning of your query with the dataset stage command.

You can manage your datasets in Cortex XDR from the SettingsConfigurationsData ManagementDataset Management page.

Here are some of the main tasks available for all dataset types by right-clicking a particular dataset listed in the Datasets table:


For more information on tasks specific to lookup datasets, see Lookup datasets.