XQL datasets

slaven.stajic — Wed, 28 Jun 2023 06:44:55 GMT

Is there a comprehensive document containing all the datasets that are currently available? We've noticed that datasets such as "incidents_artifacts" or "incidents" are not displayed in the autofill text in XQL. We would greatly appreciate having a complete list of all the datasets that are accessible.

Re: XQL datasets

nsinghvirk — Wed, 28 Jun 2023 12:11:25 GMT

Hello @slaven.stajic

Thanks for reaching out to LiveCommunity.

Please find below the link for the list of Datasets and Presets provided by Palo Alto.

https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-XQL-Language-Reference/Datasets-and-Presets

To see the custom datasets or lookups, please navigate to Settings->Configuration->Dataset management.

topic Re: XQL datasets in Cortex XDR Discussions

XQL datasets

Re: XQL datasets