Configure dashboard drilldowns - Administrator Guide - Cortex XDR - Cortex

Configure dashboard drilldowns - Administrator Guide - Cortex XDR - Cortex - Security Operations

Cortex XDR Documentation

Product

Cortex XDR

Creation date

2024-03-06

Last date published

2024-10-01

Notice

Dashboard drilldowns are supported in Cortex XDR Pro and Cortex XSIAM only.

Dashboard drilldowns can trigger contextual changes on the dashboard, or they can link to an XQL search, a custom URL, another dashboard, or a report. You configure drilldowns on individual widgets. After a drilldown is configured, clicking the widget triggers the drilldown.

Danger

To configure drilldowns your dashboard must contain custom XQL widgets. In addition, if you want to configure in-dashboard drilldowns your custom XQL widget must contain one or more parameters. For more information about configuring parameters in custom XQL widgets, see Create custom XQL widgets.

How to configure dashboard drilldowns

Open a custom dashboard and select Edit dashboard.
Identify the widget to which you want to apply a drilldown, click on the widget menu, and select Add drilldown.

In Action On Click select one of the following options:

In-Dashboard Drilldown: Interactively filters the dashboard data. Filters are based on the parameters defined in the custom XQL widgets on the dashboard.

Field	Action
Parameters	Select the parameter by which to filter. You can choose any parameter that is defined in the XQL query of the widget. Note If the selected parameter is configured in other XQL widgets on the dashboard, these widgets are also affected by the drilldown.
Value	When a user clicks the widget, the dashboard is filtered by this value. Type your own value. Select a variable from which to capture the clicked value, for example, the $y-axis.value in a chart. For more information, see Variables in drilldowns.

Link to dashboard: Opens a target dashboard.

Field	Action
Dashboard	Select the target dashboard.
(Optional) Parameter	Select parameters by which to filter the data on the target dashboard. Parameters are only available if there are parameters defined in the widgets on the target dashboard.
(Optional) Value	When a user clicks the widget, this value is configured as a parameter on the target dashboard. Type your own value. Select a variable from which to capture the clicked value in the source dashboard, for example, the $y-axis.value in a chart. For more information, see Variables in drilldowns.

Open XQL Search: Runs an XQL query based on the clicked value.

Field	Action
XQL Query	Define the query that you want to run on drilldown. Type `$` to see autocomplete options for variables that are available in the widget drilldown. For example, in a table widget $first.name selects the leftmost column name in the table. For more information, see Variables in drilldowns.

Field

Action

XQL Query

Define the query that you want to run on drilldown.

Type $ to see autocomplete options for variables that are available in the widget drilldown. For example, in a table widget $first.name selects the leftmost column name in the table. For more information, see Variables in drilldowns.

In the following example two parameters are passed from a table widget to an XQL query. The first parameter with the cell value that the user clicked on, and a second parameter with the cell value in the request_url column in the row that the user clicked.

dataset=xdr_data
|filter event_type=$y_axis.value and requestUri=$row.request_url
|fields action_download, action_remote_ip as remote_ip,
actor_process_image_name as process_name
|comp count_distinct(action_download) as total_download by process_name,
remote_ip, remote_hostname
|sort desc total_download
|limit 10
|view graph type=single subtype=standard xaxis=remote_ip yaxis=total_download

Open custom URL: Opens an external URL based on a clicked value.
Define the following values:
Field
Action
URL Address
Type the URL.
To create a dynamic drilldown, you can include Available parameters. For more information about the parameters, see Variables in drilldowns.
In the following URL, the $x_axis.value parameter represents cortex products names. On drilldown, the $x_axis.value is replaced with the clicked product name in the pie chart.
https://www.paloaltonetworks.com/cortex/cortex-$x_axis.value
Generate Report: Runs a report from a clicked value.

Notice

Danger

Note