Manage access to saved queries ↗

Review the following:

The Query Library serves as the central repository for your team's investigation logic. By using object-level access, you can ensure that specific Cortex Query Language (XQL) queries, such as those used for sensitive internal investigations or executive reporting, are only accessible to authorized users, user groups, and API keys.

Prerequisite

Configure tenant-level settings: An administrator must first establish the sharing framework under Settings → Configurations → Access Management → Objects.

The configuration of these settings defines the authorized sharing workflows for saved queries in the Query Library, including the options that appear to users when clicking the three dot, vertical ellipsis (⋮) for a query in the Query Library:

  • Enable "Owners can Share objects they created": Grants owners the ability to share saved queries with specific users, user groups, and API keys to the query's access list. In the Query Library, this enables the Share option.
  • Disable "Owners can Share objects they created": Restricts owners to managing only General access (Public vs. Restricted). In the Query Library, this replaces the Share option with the Manage Access option.

For more information on these tenant-level configurations, see Manage access to objects.

How access impacts the Query Builder

The permissions assigned to your role, combined with the ownership of specific objects, directly change the tools available to you while working in the Query Builder:

  • Restricted versus Public visibility: Your Query Library view is personalized. You will only see queries where you are the Owner, queries that have been explicitly shared with you (or your user group or API key), or queries marked as Public.
  • Context-sensitive functionality: The permissions assigned to your role, combined with the ownership of specific objects, directly change the tools available to you while working in the Query Builder and the Query Library. UI elements like the Save as menu or the Share action only appear if you have the required functional capabilities.

How to configure access to saved queries

Setting up access involves a two-part process: enabling the user interface (UI) elements in the role settings, and then defining the audience for individual saved query objects.

Step 1: Define role capabilities

Role-level permissions act as the "master switch" for Query Builder functionality and determine what actions a user can take.

  1. Select Settings → Configurations → Access Management → Roles.
  2. Right-click the relevant user role, and select Edit Role.
  3. Under Components, expand Investigation & Response.
  4. Ensure Query Library is set to Enabled.

  5. Define functional capabilities to control the UI:

    • Create Queries: Selecting this enables the Save as drop-down menu in the Query Builder. This allows users to select Save as → Query to Library or Save as → Widget to Library. The user who performs this action becomes the Owner of the object and is granted the inherent right to edit, delete, and manage sharing for that specific object..

    • Edit Public Queries: This allows a user to modify queries marked as Public by others.

      Note

      If the role of a user is set to Edit Public Queries but not Create Queries, they can update existing public queries, but the Save as drop-down menu will be hidden, preventing them from creating new Query Library entries.

    Keep in mind the following:

    • If a custom query does not have an assigned Owner, an Administrator can use the Change Owner action to assign one.

Step 2: Manage sharing for a specific query

Once a query exists in the Query Library, the Owner (or an authorized Editor) can define who has permission to view (and run) or edit it.

  1. Select Investigation & Response → Search → Query Builder → XQL.
  2. Under the Query Library tab, locate the query that you want to share in the table.
  3. Click the three dot, vertical ellipsis (⋮) and select the available action:
    • Share: This option appears when Owners can Share objects they created is enabled in tenant-level settings. It allows you to manage both General access and specific principals (users, user groups, and API keys).
    • Manage Access: This option appears when Owners can Share objects they created is disabled. It only allows you to change the General access state.
  4. (If sharing is enabled) To share with specific entities (for Restricted queries):
    • Search for the User, User Group, or API Key.
    • Assign the access level: Viewer (can run/view) or Editor (can modify and, if permitted by tenant-level settings, share).

  5. Set the General access drop-down menu (if authorized by tenant-level settings):

    • Restricted: The query is private. It is only visible to the Owner and the specific principals added to the list.
    • Public: The query is visible to every user who has the Query Library enabled in their role.

    Note

    When the tenant-level setting Owners and editors can change the general access is unselected, the drop-down is disabled and only an administrator can configure this option.

  6. Click Save.

Sharing icons in the Query Library

The following icons in the Query Library table help you identify the security access of your queries:

  • unshared-query-icon.png: A Restricted query you created that is not shared with anyone else.
  • query-created-by-me-shared-icon.png: A query you created that is currently shared with other users, user groups, or API keys.
  • query-created-by-someone-else-shared.png: A query created by another user that has been shared with you.
  • PANW_Query.png: A standard system query provided by Palo Alto Networks. These are always Public and can't be deleted, or have their ownership transferred.