About dashboards - Learn more about dashboards, which help you to monitor system activity and security operations in your environment. - Administrator Guide - Cortex CLOUD

Cortex Cloud Runtime Security Documentation
Product
Cortex Cloud Application Security > Cortex CLOUD
License
Cloud Runtime Security
Creation date
2024-12-24
Last date published
2026-06-04
Category
Administrator Guide
Abstract

Learn more about dashboards, which help you to monitor system activity and security operations in your environment.

Dashboards help you monitor system activity and security operations in your environment. Each dashboard consists of widgets that summarize information about your tenant's activities in a graphical or tabular format, enabling you to effectively monitor your cases and overall activity in your environment.

Agent_management_DB.png

When you sign in to Cortex Cloud, your default dashboard is displayed. To change the displayed dashboard, you can select from the list of predefined and custom dashboards using the dashboard menu, or manage them centrally from the Dashboard Manager.

On each dashboard, you can see the selected Time Range on the right side of the header. To see the last updated status for each widget, hover over a widget and if required, Refresh the data. You can also select widget specific time frames from the menu on an XQL widget.

Predefined dashboard filters are displayed in the dashboard header. A filter icon on a widget indicates that the widget data is filtered. Hover over the icon to see details of the filters applied.

Click the dashboard menu to see additional actions, including the option to save the dashboard as a report template, set it as your default dashboard, and pause automatic dashboard refresh.

Types of dashboards

Cortex Cloud provides the following types of dashboards:

  • Command Center dashboards: These are system-provided dashboards that offer interactive, high-level overviews of system status, data ingestion, and security operations with built-in drilldowns. These dashboards are not editable. For more information, see Command Center dashboards.

  • Predefined dashboards: These are read-only dashboards tailored for common use cases and system setups to assist in both security operations and posture management. These dashboards provide immediate visibility into various aspects of your environment, including active threats, asset risk levels, and data ingestion health. You can create reports and custom dashboards that are based on predefined dashboards. For more information, see Predefined dashboards.

  • Custom dashboards: These are user-defined dashboards that provide the flexibility to design views according to your own specifications. You can base custom dashboards on the predefined dashboards or create a new dashboard from scratch, and save your custom dashboards as reports. Ownership and access for these dashboards are managed through the Share or Manage Access options in the Dashboard Manager. For more information, see Build custom dashboards and reports.

Manage your dashboards

You can view and manage all predefined and custom dashboards from the Dashboard Manager. The actions you can perform on a dashboard depend on its visibility status and the permissions granted to your role.

Important

The ability to create, edit, or share custom dashboards is governed by access management. If certain options are unavailable, contact your administrator. For more information, see Manage access to custom dashboards.

From the Dashboard Manager, you can take the following actions:

  • Manage visibility: Custom dashboards can be set to either Public or Restricted.

    • Public: Visible to all users with appropriate role permissions to view dashboards.

    • Restricted: Visible only to the dashboard Owner and the specific users or user groups who have been granted explicit access through sharing.

  • Create, edit, and delete custom dashboards: You can build new dashboards to suit your specific needs. While you cannot edit predefined dashboards, you can save them as a new custom dashboard to use as a starting template. Restricted dashboards can be viewed and edited by the Owner and any users or user groups granted explicit access. Yet, only the Owner (the creator) or an administrator can delete a custom dashboard.

  • Manage access: If permitted by your administrator, you can share custom dashboards you own with other users or user groups, granting them either Viewer or Editor permissions. Dashboards can be shared with users, user groups, and API keys.

  • Select your default dashboard: Set any available dashboard as the primary view when you log in.

  • Create report templates: Use a dashboard layout as the basis for a scheduled report.

  • Import and export dashboards: Administrators can import and export dashboards in a JSON format, which enables transferring configurations between environments for onboarding, migration, backup, and sharing. It's also possible to bulk export and import multiple dashboards at a time.

    Note

    • Dashboards that are based on custom infrastructure cannot be exported.

    • When importing a dashboard that already exists in the system, the imported dashboard overwrites the existing dashboard. To avoid overwriting the existing dashboard, duplicate and rename the existing dashboard before importing the new dashboard.

Dashboard sharing icons

The following icons in the Dashboard Manager (under the Source column) help you identify the security access and status of your dashboards:

  • unshared-query-icon.png:

    • A Restricted custom dashboard you created (Owner) that is not currently shared with anyone else.

    • A custom dashboard you created that is currently shared with other users or user groups.

  • query-created-by-someone-else-shared.png: A custom dashboard created by another user that has been shared with you (either individually or through a user group).

  • PANW_Query.png: A standard system dashboard provided by Palo Alto Networks. These are always Public and can't be deleted, or have their ownership transferred.