XQL datasets

[slaven.stajic]

Is there a comprehensive document containing all the datasets that are currently available? We've noticed that datasets such as "incidents_artifacts" or "incidents" are not displayed in the autofill text in XQL. We would greatly appreciate having a complete list of all the datasets that are accessible. 

[nsinghvirk · Accepted solution]

Hello @slaven.stajic 

Thanks for reaching out to LiveCommunity.

Please find below the link for the list of Datasets and Presets provided by Palo Alto.

https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-XQL-Language-Reference/Datasets-and...

To see the custom datasets or lookups, please navigate to Settings->Configuration->Dataset management.