Home

Location

Documentation Home
Palo Alto Networks
Support
Live Community
Knowledge Base

Home
Security Operations
Cortex XDR
Cortex XDR™ XQL Language Reference

Last Updated:

Wed Dec 22 09:37:25 PST 2021

Table of Contents

Get Started with XQL

XQL Language Features

XQL Language Structure

Supported Operators

Datasets and Presets

About Examples

Stages Commands Reference

Alter

Arrayexpand

Bin

Comp

avg

count

count_distinct

earliest

first

last

latest

list

max

min

sum

values

Config

case_sensitive

timeframe

Dedup

Fields

Filter

Join

Iploc

Limit

Replacenull

Sort

Target

Union

View

XQL Functions Reference

add

arrayconcat

arraydistinct

arrayfilter

arrayindex

array_length

arraymap

arrayrange

arraystring

coalesce

concat

current_time

divide

extract_time

format_string

format_timestamp

floor

if

incidr

incidrlist

json_extract

json_extract_array

json_extract_scalar

len

lowercase

multiply

parse_timestamp

pow

regextract

replace

replex

round

split

string_count

subtract

timestamp_diff

timestamp_seconds

to_boolean

to_float

to_integer

to_json_string

to_number

to_string

to_timestamp

trim

uppercase

Get Started with XQL
Stages Commands Reference
- Alter
- Arrayexpand
- Bin
- Comp
  - avg
  - count
  - count_distinct
  - earliest
  - first
  - last
  - latest
  - list
  - max
  - min
  - sum
  - values
- Config
  - case_sensitive
  - timeframe
- Dedup
- Fields
- Filter
- Join
- Iploc
- Limit
- Replacenull
- Sort
- Target
- Union
- View
XQL Functions Reference
- add
- arrayconcat
- arraydistinct
- arrayfilter
- arrayindex
- array_length
- arraymap
- arrayrange
- arraystring
- coalesce
- concat
- current_time
- divide
- extract_time
- format_string
- format_timestamp
- floor
- if
- incidr
- incidrlist
- json_extract
- json_extract_array
- json_extract_scalar
- len
- lowercase
- multiply
- parse_timestamp
- pow
- regextract
- replace
- replex
- round
- split
- string_count
- subtract
- timestamp_diff
- timestamp_seconds
- to_boolean
- to_float
- to_integer
- to_json_string
- to_number
- to_string
- to_timestamp
- trim
- uppercase

Cortex XDR™ XQL Language Reference

PDF Cover Image

Last Updated:

Wed Dec 22 09:37:25 PST 2021

© 2022 Palo Alto Networks, Inc. All rights reserved.