Documentation — August 07, 2026
2712 files changed, 181439 insertions, 1 deletions — view the commit on the mirror.
Initial import: 2,711 pages across eight books seeded from the Cortex documentation portal
- This is the mirror’s first export, not a day of change: 2,711 of the 2,712 files are additions and the one modification is the generated
README.md. - Eight books were seeded — the largest by far is the Cortex XSIAM Documentation at 2,271 pages.
- Within XSIAM, Configure Cortex XSIAM accounts for 1,224 pages and Detect, Investigate, and Respond to Threats for another 408.
- Nothing here should be read as an upstream edit; the first meaningful docs diff is the following day.
Highlights
-
The mirror starts from a snapshot, so every page reads as new
There is no prior state to diff against, so no page on this date was actually added, removed or changed upstream.
-
Eight books were captured, each at its portal path under a book-named directory
Cortex XSIAM Documentation (2,271), Cortex XQL Command Reference (184), Linux Kernel Versions (100), Cortex XSIAM Developer Guide (84), Cortex XDR Agent Administrator Guide (35), Cortex XDR Compatibility Matrix (15), Cortex XQL Schema Reference (10) and Cortex XDR Agent Releases (4).
-
The Cortex XDR Agent Administrator Guide was pinned at version 9.3
Its 35 pages came from the cortex-xdr-agent/9.3 portal section, the only book seeded from a version-specific section.
-
Navigation trees were recorded alongside the pages
Eight `.meta/<book>.json` manifests capture each book's navigation and the portal section it was collapsed from, which is what later diffs use to detect added, removed or reordered pages.
Bulk change — 2,712 files. Per-file diffs are not stored for a change this size; view it on the mirror.
Changes
2712 files listed, 1 written up and shaded below.
-
▸ ▾ first_value added +82 −0
xql/functions/first_valueRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ floor added +132 −0
xql/functions/floorRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ format_string added +158 −0
xql/functions/format_stringRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ format_timestamp added +107 −0
xql/functions/format_timestampRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Functions list added +154 −0
xql/functions/functions-listRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ greatest added +110 −0
xql/functions/greatestRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ hierarchy_match added +222 −0
xql/functions/hierarchy_matchRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ if added +265 −0
xql/functions/ifRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ incidr added +126 −0
xql/functions/incidrRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ incidr6 added +81 −0
xql/functions/incidr6Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ incidrlist added +110 −0
xql/functions/incidrlistRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Functions overview added +8 −0
xql/functions/indexRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ int_to_ip added +129 −0
xql/functions/int_to_ipRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ ip_to_int added +157 −0
xql/functions/ip_to_intRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ is_ipv4 added +81 −0
xql/functions/is_ipv4Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ is_ipv6 added +55 −0
xql/functions/is_ipv6Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ is_known_private_ipv4 added +81 −0
xql/functions/is_known_private_ipv4Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ is_known_private_ipv6 added +78 −0
xql/functions/is_known_private_ipv6Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ json_extract added +336 −0
xql/functions/json_extractRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ json_extract_array added +138 −0
xql/functions/json_extract_arrayRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ json_extract_scalar added +251 −0
xql/functions/json_extract_scalarRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ json_extract_scalar_array added +203 −0
xql/functions/json_extract_scalar_arrayRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ XQL JSON Functions Reference added +572 −0
xql/functions/json_functions_referenceRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ json_path_extract added +286 −0
xql/functions/json_path_extractRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ lag added +57 −0
xql/functions/lagRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ last added +83 −0
xql/functions/lastRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ last_value added +136 −0
xql/functions/last_valueRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ latest added +77 −0
xql/functions/latestRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ least added +110 −0
xql/functions/leastRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ len added +160 −0
xql/functions/lenRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ list (comp) added +78 −0
xql/functions/list_with_comp_stageRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ ln added +111 −0
xql/functions/lnRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ log added +111 −0
xql/functions/logRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ log10 added +113 −0
xql/functions/log10Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ lowercase added +183 −0
xql/functions/lowercaseRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ ltrim added +179 −0
xql/functions/ltrimRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ max (comp) added +97 −0
xql/functions/max_with_comp_stageRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ max (windowcomp) added +110 −0
xql/functions/max_with_windowcomp_stageRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ md5 added +155 −0
xql/functions/md5Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ median (comp) added +79 −0
xql/functions/median_with_comp_stageRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ median (windowcomp) added +88 −0
xql/functions/median_with_windowcomp_stageRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ min (comp) added +98 −0
xql/functions/min_with_comp_stageRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ min (windowcomp) added +110 −0
xql/functions/min_with_windowcomp_stageRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ mod added +110 −0
xql/functions/modRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ multiply added +155 −0
xql/functions/multiplyRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ object_create added +175 −0
xql/functions/object_createRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ object_merge added +179 −0
xql/functions/object_mergeRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ parse_epoch added +135 −0
xql/functions/parse_epochRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ parse_timestamp added +133 −0
xql/functions/parse_timestampRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ pow added +205 −0
xql/functions/powRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ power added +111 −0
xql/functions/powerRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ rand added +110 −0
xql/functions/randRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ range_bucket added +113 −0
xql/functions/range_bucketRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ rank (windowcomp) added +108 −0
xql/functions/rank_with_windowcomp_stageRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ regexcapture added +148 −0
xql/functions/regexcaptureRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ regextract added +102 −0
xql/functions/regextractRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ replace added +168 −0
xql/functions/replaceRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ replex added +149 −0
xql/functions/replexRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ round added +160 −0
xql/functions/roundRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ row_number (windowcomp) added +107 −0
xql/functions/row_number_with_windowcomp_stageRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ rtrim added +195 −0
xql/functions/rtrimRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ safe_add added +109 −0
xql/functions/safe_addRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ safe_divide added +108 −0
xql/functions/safe_divideRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ safe_multiply added +109 −0
xql/functions/safe_multiplyRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ safe_negate added +107 −0
xql/functions/safe_negateRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ safe_subtract added +109 −0
xql/functions/safe_subtractRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ sec added +109 −0
xql/functions/secRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ sha1 added +156 −0
xql/functions/sha1Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ sha256 added +155 −0
xql/functions/sha256Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ sha512 added +157 −0
xql/functions/sha512Read it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ sign added +111 −0
xql/functions/signRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ sin added +109 −0
xql/functions/sinRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ split added +178 −0
xql/functions/splitRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ sqrt added +112 −0
xql/functions/sqrtRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ stddev_population (comp) added +98 −0
xql/functions/stddev_population_with_comp_stageRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ stddev_population (windowcomp) added +110 −0
xql/functions/stddev_population_with_windowcomp_stageRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ stddev_sample (comp) added +98 −0
xql/functions/stddev_sample_with_comp_stageRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ stddev_sample (windowcomp) added +111 −0
xql/functions/stddev_sample_with_windowcomp_stageRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ string_count added +193 −0
xql/functions/string_countRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ subtract added +152 −0
xql/functions/subtractRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ sum (comp) added +98 −0
xql/functions/sum_with_comp_stageRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ sum (windowcomp) added +110 −0
xql/functions/sum_with_windowcomp_stageRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ tan added +113 −0
xql/functions/tanRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ time_frame_end added +107 −0
xql/functions/time_frame_endRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ timestamp_diff added +166 −0
xql/functions/timestamp_diffRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ timestamp_seconds added +134 −0
xql/functions/timestamp_secondsRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ to_boolean added +181 −0
xql/functions/to_booleanRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ to_epoch added +131 −0
xql/functions/to_epochRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ to_float added +156 −0
xql/functions/to_floatRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ to_integer added +178 −0
xql/functions/to_integerRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ to_json_string added +179 −0
xql/functions/to_json_stringRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ to_number added +156 −0
xql/functions/to_numberRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ to_string added +175 −0
xql/functions/to_stringRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ to_timestamp added +182 −0
xql/functions/to_timestampRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ trim added +101 −0
xql/functions/trimRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ trunc added +136 −0
xql/functions/truncRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ uppercase added +152 −0
xql/functions/uppercaseRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ values added +99 −0
xql/functions/valuesRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ var added +99 −0
xql/functions/varRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ wildcard_match added +132 −0
xql/functions/wildcard_matchRead it on the Cortex docs portal ↗ Read it here → This file's diff on GitHub ↗
Diffs are not stored for a change this size — view it on the mirror.