Query Library permissions ↗

Abstract

Configure access to the Query Library for XQL queries.

Controls access to the Query Library, which is a repository of saved XQL queries within Cortex XSIAM. It allows users to save, organize, share, and reuse XQL queries across the team. Key capabilities include:

  • Browse, search, and filter saved queries by name, labels, and type

  • Save new queries from XQL Search results

  • Share queries with specific users or make them public

Users can primarily access Query Library from Investigation & Response → Search → XQL Search, and select the Query Library tab.

Note

Users must have at least View permission in Query Center to access the Query Library from Query Center.

If you want to execute and schedule queries from the Query Library, you also need View/Edit permission in the Query Center.

Cortex XSIAM enforces least-privileged per-object access by allowing you to manage access for individual instances of Saved Queries. For more information, see Manage access to objects.

Permission

Description

Roles Example

Enabled

Users can browse, search, filter, and view saved queries. Users can also save, edit, delete, and share their own queries. Users can also be granted:

  • Create Queries: Users can edit, delete, and share queries.

  • Edit Public Queries: Adds the ability to edit and delete public/shared queries created by other users.

Most roles require creating/editing public queries.

Disabled

No access to the Query Library.