Build XQL queries

To support investigation and analysis in Cortex XSIAM, you can search your data by creating queries in the Query Builder. You can create queries with the Cortex Query Language (XQL) or by using the Query Builder templates.

If you have Cortex Agentic Assistant, you can use natural language prompts to create and run XQL queries within the chat interface. For more information, see [Create and run XQL queries with Agentic Assistant chat](../agentic-assistant-chat/create-and-run-xql-queries-with-agentic-assistant-chat).

Sub-topics

• About the Query Builder
• How to build XQL queries
  • Get started with XQL queries
  • Useful XQL user interface features
  • XQL Query best practices
  • Expected results when querying fields
  • Create XQL query
  • Review XQL query results
  • Translate to XQL
  • Graph query results
• Query Builder templates
  • Get started with Query Builder templates
  • Considerations for using Query Builder templates
  • Create a query from a template
  • Run a free text query
  • Query Builder template examples
• Overview of the Query Center
  • Edit and run queries in Query Center
  • Query Center reference information
• Manage scheduled queries
  • Scheduled Queries reference information
• Manage your personal query library
• XQL macros
• Manage your macros
• Federated Search
  • Federated Search configuration
  • Query using Federated Search
  • Manage external datasets
• Legacy Query Builder
  • Create authentication query
  • Create event log query
  • Create file query
  • Create image load query
  • Create network connections query
  • Create network query
  • Create process query
  • Create registry query
  • Query across all entities