About the Query Builder - Administrator Guide - Cortex XSIAM - Cortex

About the Query Builder - Administrator Guide - Cortex XSIAM - Cortex - Security Operations

Cortex XSIAM Administrator Guide

Product

Cortex XSIAM

Creation date

2024-02-26

Last date published

2024-04-25

Category

Administrator Guide

Abstract

Build XQL queries that search your ingested data, and assist you in the investigation and analysis process. You can use a query template or build your own.

To support investigation and analysis, you can search all of the data ingested by Cortex XSIAM by creating queries in the Query Builder. You can create queries that investigate leads, expose the root cause of an alert, perform damage assessment, and hunt for threats from your data sources.

Cortex XSIAM provides different options in the Query Builder for creating queries:

XQL Search (Build your own queries)
You can use the Cortex Query Language (XQL) to build complex and flexible queries that search specific datasets or presets, or the entire Cortex Data Model (XDM). With XQL Search you create queries based on stages, functions, and operators. To help you build your queries, Cortex XSIAM provides tools in the interface that provide suggestions as you type, or you can look up predefined queries, common stages and examples.
Query Builder templates (No XQL knowledge required)
You can use the Query Builder templates to access your data without prior XQL knowledge. The templates include predefined filtering fields and key fieldsets, and can include any field from the XDM schema.
As the templates are also based on XQL, you can also translate your template queries into XQL. With this flexibility, you can enrich the basic queries created by templates for more detailed investigation, or use the templates as a starting point for creating complex queries with full XQL functionality.

Cortex XSIAM saves every query that you run in the Query Center. From the Query Center you can view query results, edit, re-run, or reschedule a query. You can then visualize your query results in tables or graphs, and create widgets and correlations with the data. You can also save you queries to your own personal query library.

Tip

If you prefer to use the Query Builder in Legacy mode, switch the toggle in the header. In Legacy mode, the Query Builder searches predefined datasets only. To search the full XDM Data Model, switch to New mode or select XQL Search.