What is the expected behavior when querying a data model with no specific fields specified in the query?

When executing a query against a data model in Cortex XSIAM using XQL, if no specific fields are requested using a fields stage, the system defaults to returning the xdmcore fieldset. The xdmcore fields represent the most common and essential normalized fields within the Cortex Query Data Model (XDM). This default behavior is designed to provide the analyst with a consistent and meaningful set of core data points (such as actor, action, and target information) from the queried events without requiring explicit field selection for every query.

A. The query will not error out. XQL is designed to execute valid queries by applying default behaviors, such as returning a standard fieldset.

B. xdrdata is a raw dataset, not a data model fieldset. The default fields are derived from the normalized XDM schema, not a specific underlying dataset.

C. A query that returns results will always include data columns; returning no fields would not be a useful or logical default behavior.

1. Palo Alto Networks, Cortex XSIAM Administrator's Guide. "Get Started with XQL". In the section describing basic queries, the documentation states that when querying a data model, the xdmcore fields are returned by default if no other fields are specified.

2. Palo Alto Networks, Cortex XSIAM XQL Language Reference. "datamodel". The documentation for the datamodel query stage explicitly mentions: "When you query a data model without specifying any fields, the query returns the xdmcore fields by default." This confirms the standard behavior for this query type.