Configuring Filters, Inputs, and Drilldowns - Administrator Guide - Cortex XDR - Cortex - Security Operations

The values must support the parameter type. For example, for $name specify characters and for $num specify numbers.

If you uploaded numbers in a string, specify each number in quotes, for example "500".

Parameters— Select the parameter by which to filter. You can choose parameters that are defined in the XQL queries of the widgets on the dashboard.

Value— Type your own value, or, select a variable from which to capture the clicked value and assign to a parameter. For more information, see Variables in drilldowns.

Dashboard— Select the target dashboard.

Parameter (optional)— Select parameters by which to filter the data on the target dashboard. Parameters are available if there are parameters defined in the widgets on the target dashboards.

Value— Type your own value, or, select a variable from which to capture the clicked value in the source dashboard and map as a parameter in the target dashboard. For more information, see Variables in drilldowns.

XQL Query— Define the query that you want to run on drilldown. Type $ to see autocomplete options for variables that are available in the widget drilldown. For more information, see Variables in drilldowns.

In the following example two parameters are passed from a table widget to an XQL query. The first parameter with the cell value that the user clicked on, and a second parameter with the cell value in the request_url column in the row that the user clicked.

dataset=xdr_data
|filter event_type=$y_axis.value and requestUri=$row.request_url
|fields action_download, action_remote_ip as remote_ip,
actor_process_image_name as process_name
|comp count_distinct(action_download) as total_download by process_name,
remote_ip, remote_hostname
|sort desc total_download
|limit 10
|view graph type=single subtype=standard xaxis=remote_ip yaxis=total_download

URL Address— Type the URL. To create a dynamic drilldown, you can include Available parameters. For more information about the parameters, see Variables in drilldowns.

In the following URL, the $x_axis.value parameter represents cortex products names. On drilldown, the $x_axis.value is replaced with the clicked product name in the pie chart.

https://www.paloaltonetworks.com/cortex/cortex-$x_axis.value