Using Dashboard Filters, Inputs, and Drilldowns - Administrator Guide - Cortex XDR - Cortex - Security Operations

Cortex XDR Pro Administrator Guide

Product
Cortex XDR
License
Pro
Creation date
2024-07-16
Last date published
2024-10-15
Category
Administrator Guide
Retire_Doc
Retiring
Link_to_new_Doc
/r/Cortex-XDR/Cortex-XDR-Documentation
Abstract

Explains how to use dashboard filters and drilldowns.

On Custom dashboards, you can set up fixed filters, inputs, and drilldowns to enable you and other analysts to filter and manipulate the data of a dashboard.

Dashboard Filters

Fixed dashboard filters are displayed in the dashboard header. Depending on the configuration, the filters take the following format:

  • Free text/number: manually enter filter values into the input field.

  • Single Select: select a single predefined filter value from the dropdown list.

  • Multi Select: select multiple predefined or dynamic filter values from the dropdown list. For Multi Select Dynamic values, the list displays the first 100 results from the specified field. You can choose a value from the list, or start typing to search for a specific value.

Fixed filters are based on parameters that are defined in Custom XQL widgets. For information, see Manage Your Widget Library and Configuring Filters & Inputs. Temporary filters are also displayed in the dashboard header, however these filters cannot be modified unless they are configured in the widgets and on the dashboard.Manage Your Widget Library

Dashboard Drilldowns
Abstract

Dashboard drilldowns provide interactive data insights when clicking on data points, table rows, or other visualization elements.

Dashboard drilldowns provide interactive data insights when clicking on data points, table rows, or other visualization elements. Drilldowns can trigger contextual changes on the dashboard, or they can link to an XQL search, a custom URL, another dashboard, or a report.

Hover over a widget to see details about the drilldown, and click a value to trigger the drilldown. If the drilldown triggers an in-dashboard drilldown, all widgets that use the selected parameter are affected. Parameters that are configured as fixed filters are displayed in the dashboard header. Parameters that are not configured are added as temporary filters. For more information, see Configuring Filters, Inputs, and Drilldowns.