Configure dashboard drilldowns - Learn more about configuring drilldowns on custom dashboards providing interactive data insights when clicking data points in a widget. - Administrator Guide

Configure dashboard drilldowns - Learn more about configuring drilldowns on custom dashboards providing interactive data insights when clicking data points in a widget. - Administrator Guide - Cortex CLOUD

Cortex Cloud Posture Management Documentation

Product

Cortex Cloud Application Security > Cortex CLOUD

License

Cloud Posture Management

Creation date

2025-01-22

Last date published

2026-06-10

Prerequisite

To configure drilldowns your dashboard must contain custom XQL widgets. In addition, if you want to configure in-dashboard drilldowns your custom XQL widget must contain one or more parameters. For more information about configuring parameters in custom XQL widgets, see Create custom XQL widgets.

Dashboard drilldowns can trigger contextual changes on the dashboard, or they can link to an XQL search, a custom URL, another dashboard, or a report. You configure drilldowns on individual widgets. After a drilldown is configured, clicking the widget triggers the drilldown. You can configure a dashboard drilldown to enable users to investigate specific data points by clicking a widget. After configuration, any user with authorized access to the dashboard can use these drilldowns.

Role permissions: Your ability to configure and interact with drilldowns is set by your administrator through your user role. For more information, see Manage access to custom dashboards.
Inherited access: Drilldowns respect the sharing settings of the dashboard. If you share a dashboard containing a drilldown that leads to a Restricted widget or a private query, the authorized viewers of that dashboard can still execute that drilldown and see the resulting data within the context of that dashboard.
Target visibility: If a drilldown is configured to open a different dashboard, the user must have at least Viewer access to that target dashboard to view it.

Initiate the dashboard editor using one of the following methods:
- From the Dashboard page: Select Dashboards & Reports → Dashboard, click the ellipse menu (vertical ellipses) in the header, and select Edit dashboard.
- From the Dashboard Manager: Select Dashboards & Reports → Dashboard Manager, right-click the custom dashboard you want to modify, and select Edit.
On the widget you want to use as the trigger, click the vertical ellipses and select Add Drilldown.

In the Widget Drilldown dialog box, select the Action on Click:

In-Dashboard Drilldown: Interactively filters the dashboard data. Filters are based on the parameters defined in the custom XQL widgets on the dashboard.

Field	Action
Parameters	Select the parameter by which to filter. You can choose any parameter that is defined in the XQL query of the widget. Note If the selected parameter is configured in other XQL widgets on the dashboard, these widgets are also affected by the drilldown.
Value	When a user clicks the widget, the dashboard is filtered by this value. Type your own value. Select a variable from which to capture the clicked value, for example, the $y-axis.value in a chart. For more information, see Variables in drilldowns.

Link to dashboard: Opens a target dashboard.

Field	Action
Dashboard	Select the target dashboard.
(Optional) Parameter	Select parameters by which to filter the data on the target dashboard. Parameters are only available if there are parameters defined in the widgets on the target dashboard.
(Optional) Value	When a user clicks the widget, this value is configured as a parameter on the target dashboard. Type your own value. Select a variable from which to capture the clicked value in the source dashboard, for example, the $y-axis.value in a chart. For more information, see Variables in drilldowns.

Open XQL Search: Runs an XQL query based on the clicked value.

Field	Action
XQL Query	Define the query that you want to run on drilldown. Type `$` to see autocomplete options for variables that are available in the widget drilldown. For example, in a table widget $first.name selects the leftmost column name in the table. For more information, see Variables in drilldowns.

Field

Action

XQL Query

Define the query that you want to run on drilldown.

Type $ to see autocomplete options for variables that are available in the widget drilldown. For example, in a table widget $first.name selects the leftmost column name in the table. For more information, see Variables in drilldowns.

In the following example two parameters are passed from a table widget to an XQL query. The first parameter with the cell value that the user clicked on, and a second parameter with the cell value in the request_url column in the row that the user clicked.

dataset=xdr_data
|filter event_type=$y_axis.value and requestUri=$row.request_url
|fields action_download, action_remote_ip as remote_ip,
actor_process_image_name as process_name
|comp count_distinct(action_download) as total_download by process_name,
remote_ip, remote_hostname
|sort desc total_download
|limit 10
|view graph type=single subtype=standard xaxis=remote_ip yaxis=total_download

Open custom URL: Opens an external URL based on a clicked value.
Define the following values:
Field
Action
URL Address
Type the URL.
To create a dynamic drilldown, you can include Available parameters. For more information about the parameters, see Variables in drilldowns.
In the following URL, the $x_axis.value parameter represents cortex products names. On drilldown, the $x_axis.value is replaced with the clicked product name in the pie chart.
https://www.paloaltonetworks.com/cortex/cortex-$x_axis.value
Generate Report: Runs a report from a clicked value.

Save the changes for the widget and dashboard.

Prerequisite

Note