Query Center reference information - Administrator Guide - Cortex XDR - Cortex - Security Operations

BQL

Whether the query was created by the native search.

Native search has been deprecated; this field allows you to view data for queries performed before deprecation.

COMPUTE UNIT USAGE

Number of query units that were used to execute the API query and Cold Storage query.

CREATED BY *

User who created or scheduled the query.

DURATION (SEC)

Number of seconds it took to execute the query.

EXECUTION ID

Unique identifier of Cortex Query Language (XQL) queries in the tenant. The identifier ID generated for queries executed in Cortex XDR and XQL query API.

NUM OF RESULTS*

Number of results returned by the query.

PUBLIC API

Whether the source executing the query was an XQL query API.

QUERY DESCRIPTION*

Query parameters used to run the query.

QUERY ID

Unique identifier of the query.

QUERY NAME*

QUERY STATUS*

Status of the query:

RESULTS SAVED*

Yes or No.

SIMULATED COMPUTE UNITS

Number of query units that were used to execute the Hot Storage query.

TENANT

List of tenants on which an XQL query were executed.

TIMESTAMP*

Date and time the query was created.

XQL

Whether the query was created by an XQL search.