Query Center reference information - Administrator Guide - Cortex XSIAM - Cortex

Query Center reference information - Administrator Guide - Cortex XSIAM - Cortex - Security Operations

Cortex XSIAM Documentation

Product

Cortex XSIAM

Creation date

2024-03-06

Last date published

2024-11-28

Note

Certain fields are exposed and hidden by default. An asterisk (*) is beside every field that is exposed by default.

Field	Description
BQL	Whether the query was created by the native search. Native search has been deprecated; this field allows you to view data for queries performed before deprecation.
COMPUTE UNIT USAGE	Number of query units that were used to execute the API query and Cold Storage query.
CREATED BY *	User who created or scheduled the query.
DURATION (SEC)	Number of seconds it took to execute the query.
EXECUTION ID	Unique identifier of Cortex Query Language (XQL) queries in the tenant. The identifier ID generated for queries executed in Cortex XSIAM and XQL query API.
NUM OF RESULTS*	Number of results returned by the query.
PUBLIC API	Whether the source executing the query was an XQL query API.
QUERY DESCRIPTION*	Query parameters used to run the query.
QUERY ID	Unique identifier of the query.
QUERY NAME*	For saved queries, the Query Name identifies the query specified by the administrator. For scheduled queries, the Query Name identifies the auto-generated name of the parent query. Scheduled queries also display an icon to the left of the name to indicate that the query is recurring.
QUERY STATUS*	Status of the query: Queued: The query is queued and will run when there is an available slot. Running Failed Partially completed: The query was stopped after exceeding the maximum number of permitted results. The default results for a Cortex Data Model (XDM) query or an XQL dataset query is limited to 1000, when no limit is explicitly stated in the query. This applies to basic queries with no stages except the `fields` stage. This default limit does not apply to widgets, Correlation Rules, public APIs, saved queries, or scheduled queries, where the limit is a maximum of 1,000,000 results. Queries based on legacy templates are limited to 10,000 results. To reduce the number of results returned, you can adjust the query settings and rerun. Stopped: The query was stopped by an administrator. Completed Deleted: The query was pruned.
RESULTS SAVED*	Yes or No.
SIMULATED COMPUTE UNITS	Number of query units that were used to execute the Hot Storage query.
TENANT	List of tenants on which an XQL query were executed.
TIMESTAMP*	Date and time the query was created.
XQL	Whether the query was created by an XQL search.