Datasets and presets - Administrator Guide - Cortex XSIAM - Cortex - Security Operations

Cortex XSIAM Documentation

Product
Cortex XSIAM
Creation date
2024-03-06
Last date published
2025-02-18
Category
Administrator Guide
Abstract

The Cortex Query Language supports built-in datasets, custom datasets, and presets.

Every Cortex Query Language (XQL) dataset query begins by identifying a data source that the query will run against. Each data source has a unique name, and a series of fields. Your query specifies the data source, and then provides stages that identify fields of interest and perform operations against those fields.

You can query against either datasets or Presets in a dataset query. XQL supports using different languages for dataset and field names. In addition, the dataset formats supported are dependent on the data retention offerings available in Cortex XSIAM according to whether you want to query hot storage (default) or cold storage. For more information, see XQL Language Structure.

The standard, built-in data source that is available in every Cortex XSIAM instance is the xdr_data dataset. This is a very large dataset with many available fields. For more information about this dataset, see Cortex XDR XQL Schema Reference. Cortex Query Language (XQL) supports using different languages for dataset and field names. In addition, the dataset formats supported are dependent on the data retention offerings available in Cortex XSIAM according to whether you want to query hot storage (default) or cold storage. For more information, see XQL Language Structure.

This dataset is comprised of both raw Endpoint Detection and Response (EDR) events reported by the Cortex XSIAM agent, and of logs from different sources such as third-party logs. To help you investigate events more efficiently, Cortex XSIAM also stitches these logs and events together into common schemas called stories. These stories are available using the Cortex XSIAM Presets.

Presets offer groupings of xdr_data fields that are useful for analyzing specific areas of network and endpoint activity. All of the fields available for a preset are also available on the larger xdr_data dataset, but by using the preset your query can run more efficiently. Presets are sorted at random by the first one million results found.

Two of the available presets are stories. These contain information stitched together from Cortex XSIAM agent events and log files to form a common schema. They are authentication_story and network_story.

You use the preset keyword to specify a dataset in your query.