Stages - Administrator Guide - Cortex XSIAM - Cortex - Security Operations

Stages perform certain operations in evaluating queries. For example, the dataset stage specifies a dataset to run the query. Commonly used stages include dataset, fields, filters, join, and sort. The stages supported in Cortex Query Language are detailed below.