thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Security Operations · Advanced

Cortex Query Language (XQL)

The query language used to search and analyze data in Cortex XDR and Cortex XSIAM datasets.

Definition

XQL queries begin with a dataset, such as xdr_data, and pipe through stages like filter, fields, alter, comp, sort, dedup and join. XQL powers threat hunting, custom correlation rules, BIOCs and dashboards in Cortex products.

Example

dataset = xdr_data | filter event_type = ENUM.PROCESS and action_process_image_name = "powershell.exe" | comp count() by agent_hostname

Exam tip

Know the basic stages: dataset, filter, fields, alter, comp (aggregate).

Related terms