SecOps-Pro Palo Alto Networks Security Operations Professional

In the XQL (Cortex Query Language) syntax, every query must begin with the dataset stage.

Data Source Identification: The dataset command tells the engine exactly where to look within the Cortex Data Lake. For example, dataset = xdr_data targets endpoint and network logs, while dataset = pan_os_logs targets firewall logs specifically.

Query Structure: Without a defined dataset, the query engine has no context for the fields or filters that follow. Once the dataset is established, you then use pipes (|) to add stages like filter (to narrow results), fields (to select columns), and comp (to perform calculations/aggregations).

The Cortex Gateway (formerly known as the Cortex Hub) serves as the centralized management plane for all Palo Alto Networks Cortex applications, including XDR, XSIAM, and XSOAR.

User Management: For non-SSO users, the process of granting access starts at the Gateway level. An administrator logs into the Gateway to create the user account and then selects the specific tenant the user should have access to.

Role Assignment: Once the user is added to the Gateway, the administrator can then assign the specific administrative or analyst roles required for that user within the tenant.

Why others are incorrect: While the Customer Support Portal (A) is used for licensing and support cases, and Access Management (C) is where you define the permissions within the tenant, the actual "beginning" of granting access for a new account typically happens at the Gateway level to ensure the user identity exists in the Palo Alto cloud ecosystem first.