Configure filters and inputs for custom XQL widgets - Learn more about configuring fixed filters on your dashboards to enable dashboard users to alter the scope of the dashboard. - Administrator Guide - Cortex XDR - Cortex

Configure filters and inputs for custom XQL widgets - Learn more about configuring fixed filters on your dashboards to enable dashboard users to alter the scope of the dashboard. - Administrator Guide - Cortex XDR - Cortex - Security Operations

Cortex XDR 5.x Documentation

Product

Cortex XDR

License

XDR + Cloud

Creation date

2025-07-13

Last date published

2026-06-11

Notice

Custom XQL widgets require a Data Collection add-on.

Prerequisite

Fixed filters are based on parameters that are defined in custom XQL widgets. Before you can configure fixed filters, take the following steps:

Create custom XQL widgets with parameters. For more information, see Create custom XQL widgets.
Add the widgets to a custom dashboard. For more information, see Build a custom dashboard.

Role permissions: Your ability to configure and use these filters is governed by your administrator through your user role. For more information, see Manage access to custom dashboards.
Widget visibility:
- Restricted widgets: If you add a Restricted XQL widget with parameters to a dashboard, only users with whom you have shared that dashboard can interact with its filters.
- Inherited access: When a dashboard is shared, authorized viewers can use the configured filters to narrow down the dashboard's results, even if they do not have direct access to the underlying XQL widgets in the Widget Library.

Initiate the dashboard editor using one of the following methods:
- From the Dashboard page: Select Dashboards & Reports → Dashboard, click the ellipse menu (vertical ellipses) in the header, and select Edit dashboard.
- From the Dashboard Manager: Select Dashboards & Reports → Dashboard Manager, right-click the custom dashboard you want to modify, and select Edit.
Click Add Filters & Inputs.
Note
This option only appears if the dashboard contains custom XQL widgets with defined parameters.
Under Parameter Title, enter a name that identifies the parameter for dashboard users.
On the FILTERS & INPUTS panel, click +Add an input and select one of the following options:
- Single Select: To specify a single predefined value.
- Multi Select: To specify multiple predefined or dynamic values.
- Free text/number: To specify a single free text value.
Guidelines
Select an option that corresponds with the parameter configured in the XQL widget query. Parameters with single predefined or free text values use the = operator, and parameters with multiple values, use the IN operator.
Predefined values are most suitable for filtering fields that have static values, such as status fields with a limited number of available options.
Dynamic values help you to filter with values that change often. You can configure an XQL query that extracts all of the values that are available for that field. For example, in the endpoints dataset, the endpoint_name field values can change frequently.
Click Parameter and select the specific parameter from your XQL widgets that you want to configure.
Note
You can define up to four parameter filters on a single dashboard or report.
If you selected Single Select or Multi Select values, click Dropdown Options and specify input values. When you generate the dashboard, these input values appear in a dropdown list for selection.
- To configure Predefined inputs for Single Select and Multi Select values, manually type the list values.
  Guidelines
  The values must support the parameter type. For example, for $name specify characters and for $num specify numbers.
  If you uploaded numbers in a string, specify each number in quotes, for example "500".
- To configure Dynamic inputs for Multi Select values, click XQL Query to fetch dynamic values.
  Guidelines
  In the XQL Query Builder, configure a query that includes the field stage and the name of the column from which to take the dropdown values. All values in the specified field will be available for selection, and the values are dynamically updated.
  Example 97. Example
  In this example, the endpoint_name field is configured. The dashboard user will be able to filter by one or more values from the endpoint_name field.
  dataset =endpoints | fields endpoint_name
  
  Note
  If you specify more than one field, only the first field value is used.
Under Default Value, select a value to ensure the widget is automatically populated when the dashboard is opened.
Click Save Filters & Inputs and save your dashboard.
Tip
After the initial setup, when you access your dashboard the filters and inputs might need further refinement. You can make changes to the configured parameters in the XQL widgets, and update the Filters & Inputs on your dashboard until you are satisfied with the results.

Notice

Prerequisite

Note

Note

Note

Tip