The Cortex XDR XQL examples in this document are designed to illustrate how stages or functions behave.
This document contains many examples that are intended to illustrate the behavior or
usage of a particular stage or function. They are not intended to also illustrate real-world queries
that you would use to perform investigations or otherwise solve real world problems.
For examples of queries that illustrate useful investigative queries, see the
example Query Library that is available from the product user interface: