What is the difference between presets and datasets in XQL?

The correct answer is C. A dataset is a built-in or third party source; presets group XDR data fields.. https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-XQL-Language- Datasets - The standard, built-in data source that is available in every Cortex XDR instance is the xdr_data dataset.This dataset is comprised of both raw EDR events reported by the Cortex XDR agent, a

Submitted by marco_it· Apr 18, 2026Investigation and Response

Question

Options

AA dataset is a Cortex data lake data source only; presets are built-in data source.
BA dataset is a database; presets is a field.
CA dataset is a built-in or third party source; presets group XDR data fields.
DA dataset is a third-party data source; presets are built-in data source.

How the community answered

(33 responses)

A
6% (2)
C
91% (30)
D
3% (1)

Explanation

https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-XQL-Language- Datasets - The standard, built-in data source that is available in every Cortex XDR instance is the xdr_data dataset.This dataset is comprised of both raw EDR events reported by the Cortex XDR agent, and of logs from different sources such as third-party logs. Presets - Presets offer groupings of xdr_data fields that are useful for analyzing specific areas of network and endpoint activity.

Topics

#XQL#Datasets#Presets#Data Sources

Community Discussion

No community discussion yet for this question.

Full PCDRA Practice