Manage Datasets - Administrator Guide - Cortex XSIAM - Cortex - Security Operations

Cortex XSIAM Administrator Guide

Cortex XSIAM
Creation date
Last date published
Administrator Guide

Learn how to import, delete, and interact with custom or third-party datasets in Cortex XSIAM.

Cortex XSIAM runs every Cortex Query Language (XQL) query against a dataset. A dataset is a collection of column:value sets. If you do not specify a dataset in your query, Cortex XSIAM runs the query against the default datasets configured, which is by default xdr_data for a dataset query. The xdr_data dataset contains all of the endpoint and network data that Cortex XSIAM collects. For a Cortex Data Model (XDM) query, unless specific datasets are specified, a query will run against all mapped datasets. You can always change the default datasets using the set to default option. You can also upload datasets as a CSV, TSV, or JSON file that contains the data you are interested in querying. These uploaded datasets are called lookup datasets.

To query other datasets, you have two options:

  • Set a dataset as default, which enables you to query the datasets without specifying them in the query.

  • Name a specific dataset at the beginning of your query with the dataset stage command.

You can manage your datasets in Cortex XSIAM from the SettingsConfigurationsData ManagementDataset Management page.

Here are some of the main tasks available for all dataset types by right-clicking a particular dataset listed in the Datasets table:


For more information on tasks specific to lookup datasets, see Lookup datasets.