What does the syntax and schema component of XQL define?

The Cortex XDR Query Language (XQL) is fundamentally designed for data retrieval and analysis. Its schema defines the structure of the data, organizing it into specific datasets (e.g., xdrdata) and fields (e.g., agenthostname, actionprocessimagepath). This structure dictates how information is stored. The syntax provides the set of rules, commands, and functions used to build queries that retrieve, filter, and manipulate this structured data. Therefore, the syntax and schema together define how datasets are structured and subsequently accessed by an analyst.