Cortex XQL (Cortex Query Language) is the query language for threat hunting, investigation, and analytics across security data in Cortex.
XQL queries are built as pipelines. Stages connect with the pipe (`|`) operator. Functions run inside those stages to transform, filter, and analyze data.
This reference is organized into three main sections.
* [**Functions**](functions) – Built-in functions for data manipulation, type conversion, string operations, math, bitwise operations, and more.
* [**XQL JSON Functions Reference**](functions/json_functions_reference) – Reference for `json_extract`, `json_extract_scalar`, `json_extract_array`, and `json_extract_scalar_array`.
* [**Stages**](stages) – Pipeline stages that define query structure and flow.
* [**Browse the reference**](summary) – Quick links to the main indexes and section entry points.