What is the function of the schema browser in XQL?

The schema browser is an essential tool integrated into the XQL search interface. Its primary function is to provide users with a navigable view of the Cortex XDR data model. It allows analysts to easily discover and explore available datasets (e.g., xdrdata), the fields contained within each dataset (e.g., actorprocessimagename), and the data type of each field (e.g., string, number). This helps in constructing syntactically correct and logically sound queries without needing to memorize the entire schema.

It creates automated dashboards: Dashboards are created and managed through the dedicated Dashboard or Reports section, not the schema browser. It merges incidents: Incident management functions, such as merging, are performed within the Incident view, not through the XQL interface's schema browser. It generates exclusions: Exclusions and exceptions for security profiles are configured in the prevention or detection policy management sections, not the schema browser.

1. Palo Alto Networks. (n.d.). Get Started with XQL. Cortex XDR Docs. Retrieved from https://docs.paloaltonetworks.com/cortex/cortex-xdr/cortex-xdr-pro-admin/investigation-and-response/get-started-with-xql. "To help you build queries, Cortex XDR provides a schema of the Cortex XDR datasets that you can browse to view the available fields and field types." (Section: Use the Schema to Build a Query)

2. Palo Alto Networks. (n.d.). XQL Search. Cortex XDR Docs. Retrieved from https://docs.paloaltonetworks.com/cortex/cortex-xdr/cortex-xdr-pro-admin/investigation-and-response/xql-search. The documentation illustrates the user interface, showing the schema browser on the right side of the query input field, listing datasets and their corresponding fields.