Cortex XSIAM XQL

Understand more about the Cortex Query Language called XQL, so you can build queries to gain insight from the data contained in the different data sources in Cortex XSIAM.

Sub-topics

• Get started with XQL
  • XQL language features
  • XQL Language Structure
  • Supported operators
  • Datasets and presets
  • About examples
  • JSON functions
  • How to filter for empty values in the results table
  • Understanding string manipulation in XQL
• Build XQL queries
  • About the Query Builder
  • How to build XQL queries
    • Get started with XQL queries
    • Useful XQL user interface features
    • XQL Query best practices
    • Expected results when querying fields
    • Create XQL query
    • Review XQL query results
    • Translate to XQL
    • Graph query results
  • Query Builder templates
    • Get started with Query Builder templates
    • Considerations for using Query Builder templates
    • Create a query from a template
    • Run a free text query
    • Query Builder template examples
  • Overview of the Query Center
    • Edit and run queries in Query Center
    • Query Center reference information
  • Manage scheduled queries
    • Scheduled Queries reference information
  • Manage your personal query library
  • XQL macros
  • Manage your macros
  • Federated Search
    • Federated Search configuration
    • Query using Federated Search
    • Manage external datasets
  • Legacy Query Builder
    • Create authentication query
    • Create event log query
    • Create file query
    • Create image load query
    • Create network connections query
    • Create network query
    • Create process query
    • Create registry query
    • Query across all entities
• Cortex XQL syntax, parameters, and examples