What is the difference between presets and datasets in XQL?
What is the difference between presets and datasets in XQL?
A dataset in XQL can be either a built-in or third-party data source, whereas presets in XQL are used to group specific XDR data fields that help analyze particular aspects of network and endpoint activity.
I agree with the link listed below
C https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-XQL-Language-Reference/Datasets-and-Presets Datasets - The standard, built-in data source that is available in every Cortex XDR instance is the xdr_data dataset.This dataset is comprised of both raw EDR events reported by the Cortex XDR agent, and of logs from different sources such as third-party logs. Presets - Presets offer groupings of xdr_data fields that are useful for analyzing specific areas of network and endpoint activity.
Use preset to use a pre-defined datasets in which data is stored from console description Answer: D