Cortex XDR & XSIAM XQL Assistant

Build, check and reuse your XQL queries for Cortex XDR and XSIAM.

Cybersecurity
Forensic Analysis
References & Portals
Free

Everything stays in your browser: no query is run or sent.

quick actions: 23
ready queries: 61
data sources: 25
documented stages: 29

What are you looking for?

A name, a login, a host, an IP, a domain, a hash or a file: the assistant recognizes the input and suggests the right queries.

Find a user

By name, login, UPN or SID: matching accounts, SID, hosts and last activity.

User

Source

Time range

Fill in: User.

Person-level search: run it as part of an incident or an authorized investigation, in line with your IT policy and the GDPR.

All actions

One investigation question, one ready query. Values you type are never stored.

User

Host

Web & network

Files & programs

Hunting queries

61 queries

Host timeline

Every recent event of a host, newest first: the starting point of any investigation.

Cortex agentLevel: Basicxdr_data

Parameters

Time rangeHostname

Values you enter are reused in every query and kept in this browser.

host-timeline.xql· 6 lines

config case_sensitive = false timeframe = 7d
| dataset = xdr_data
| filter agent_hostname = "PC-FINANCE-042"
| fields _time, event_type, event_sub_type, actor_effective_username, actor_process_image_name, action_process_image_name, action_process_image_command_line, action_file_path, action_registry_key_name, action_remote_ip, action_remote_port
| sort desc _time
| limit 500

Check of the filled-in query

No issue found.

Queries are provided as examples: test them on a short time range before using them as detection rules. Syntax reference: Palo Alto Networks Cortex XQL documentation.

About

Cortex XDR & XSIAM XQL Assistant

The XQL assistant saves SOC analysts time on Cortex XDR and Cortex XSIAM: quick actions that turn a name, a host, an IP or a hash into a query, a library of 61 parameterized hunting queries (execution, network, persistence, identity, lateral movement, cloud, firewall), a syntax-free visual builder, a guide to pick the right dataset or preset, IOC-list-to-query conversion and an editor that flags common mistakes line by line, including SPL and KQL habits.

What it does

23 quick actions: a name, a host, an IP, a domain or a hash gives the right query (Internet history, logons, files…)
61 ready queries, organized by SOC use case and filterable by MITRE ATT&CK technique, with reusable parameters and a check of the filled-in query
Visual builder: source, time range, event type, conditions, columns or aggregation, sort and chart; every value is quoted and escaped
"I am looking for… → which dataset" guide: xdr_data, network_story and authentication_story presets, NGFW, Okta, Entra ID, XDM
IOC → XQL: IPv4, IPv6, domains, URLs, SHA256, MD5 and files extracted from text, even defanged, with value-by-value exclusion
Editor with highlighting, formatting and line-by-line analysis (==, quotes, SPL/KQL syntax, missing ENUM, column gone after comp…)
Cheat sheet: stages, functions, operators and an SPL / KQL → XQL equivalence table
Shareable link, history of copied queries, "My queries" with JSON export and import, Markdown copy for tickets

Frequently asked questions

What is the XQL language?

XQL (XDR Query Language) is Palo Alto Networks' query language for the telemetry centralized in Cortex XDR and Cortex XSIAM. A query chains stages separated by "|": config for the time range, dataset or preset for the source, then filter, alter, comp, sort, limit… The approach is close to Splunk's SPL or Microsoft Sentinel's KQL.

Which dataset should I pick?

xdr_data holds raw agent telemetry (processes, network, files, registry, Windows event logs): filter event_type first, for example ENUM.PROCESS. The network_story preset gathers connections with the resolved hostname, authentication_story the authentications from every source, and *_raw datasets (panw_ngfw_traffic_raw, okta_sso_raw, msft_azure_ad_raw…) the integration logs. The Datasets tab offers an "I am looking for…" guide and an example for each source.

How do I move from Splunk (SPL) or Sentinel (KQL) to XQL?

Most commands map directly: where becomes filter, stats or summarize becomes comp, eval or extend becomes alter, table or project becomes fields, head or take becomes limit. The cheat sheet holds a full equivalence table, and the editor flags SPL or KQL commands left in an XQL query.

Do the queries work as-is in my tenant?

Queries on xdr_data and presets use the fields documented by Palo Alto Networks. For third-party datasets (firewalls, Okta, Office 365, AWS…), field names depend on the integration and parsing: those queries are flagged and should be checked in your console's Schema tab. Always test on a short time range before turning one into a rule.

Are my queries and IOCs sent to ForenShield?

No. Generation, analysis and IOC conversion run in your browser; no query is executed and nothing is sent. Only your favorites, parameters, "My queries" and the history of copied queries are stored locally, in this browser: the "Clear local data" button removes them. Values typed in quick actions are never stored, and a link copied from the editor contains the query: only share it if the query can be shared.