A knowledgebase of sample XQL queries for Cortex Cloud (Palo Alto Networks), organized by dataset.
| Dataset | Description |
|---|---|
| asset_inventory | Normalized inventory of all digital assets across cloud environments |
| cloud_health_auditing | Health and error events for scanning capabilities |
| cloud_audit_logs | Cloud provider API audit logs |
| cwp_packages_raw | Raw package data from workload protection scans |
| findings | Security findings across all finding types |
| uvm_findings | Vulnerability-specific findings |
| issues | Cortex Cloud issues |
| cases | Cases aggregating related issues |
| case_to_issue | Mapping between cases and issues |
| cas_criteria | CAS policy criteria |
| cas_policies | CAS policies |
| ciem_permissions_with_last_access | Cloud identity permissions with last access metadata |
Queries useful for Proof of Value demonstrations: pov_queries.md