Predefined dashboards - Administrator Guide - Cortex XDR - Cortex

Predefined dashboards - Administrator Guide - Cortex XDR - Cortex - Security Operations

Cortex XDR Documentation

Product

Cortex XDR

Creation date

2024-03-06

Last date published

2024-10-09

Category

Administrator Guide

Abstract

Predefined dashboards are set up to help you monitor different aspects of your environment.

Cortex XDR provides predefined dashboards that display widgets tailored to the dashboard type. The dashboards can help you to monitor different aspects of your environment. To access your default dashboard, select Dashboards & Reports → Dashboard. From the dashboard header, a drop-down menu lists all available predefined and custom dashboards. The available dashboards depend on your license type.

To change your default dashboard, go to Dashboards & Reports → Dashboard Manager. In the Dashboard Manager you can also create custom dashboards based on existing dashboards, and save dashboards as report templates.

Dashboard name	Description	Other details
Agent management	Provides an overview of the deployed agents in your organization, their statuses and content versions, and a breakdown by OS type.	Notice Requires a Cortex XDR Prevent or Cortex XDR Pro per Endpoint license.
Cloud inventory	Provides an overview of your cloud-based assets.	Notice Requires a Cortex XDR Pro per GB license.
Data ingestion	Provides an overview of data ingestion by product and vendor, the daily quota consumption, and your data ingestion rate.	Notice Requires a Cortex XDR Pro license. Due to a calculation change in NGFW log ingestion and improvements to data ingestion metrics, you cannot view data earlier than July 2023 on this dashboard. However, you can still view this data by running Cortex Query Language (XQL) queries on the `metrics_center` data set.
Incident management	Provides a breakdown of the top incidents and hosts in your environment, and an overview of the top incident assignees.	Select the star in the the right corner of a widget to filter the data for incidents that match incident starring policies. A purple star indicates that the widget is displaying only starred incidents. The starring filter is persistent and continues to show the filtered results until you clear the star.
My dashboard	Provides an overview of the incidents and MTTR for the logged-in user.
Network traffic analysis (NTA)	Provides an overview of network traffic analysis, and highlights key pieces of information.	Notice Requires a Cortex XDR Pro license.
NGFW ingestion	Provides an overview of ingestion status for all log types, the daily quota consumption for NGFW, and a breakdown by log type.	Notice Requires a Cortex XDR Pro per GB license.
Risk management	Provides alert and incident information to aid in risk assessment by highlighting information about compromised accounts and insider threats. The alerts displayed in this dashboard are tagged by the research as Identity Threat alerts or Identity Analytics alerts. An incident is displayed if any of its associated alerts are tagged as an Identity threat or an Identity Analytics threat.	Notice Requires a Cortex XDR Pro license and the Identity Threat Module add-on to be enabled.
Security admin	Provides an overview of the incidents in your organization, and the status of resolved and overdue incidents.
Security manager	Provides general information about Cortex XDR incidents and agents.	Notice Requires a Cortex XDR Pro per Endpoint license.