Widget Library - User Guide - 2 - Cortex XPANSE - Cortex - Security Operations

Cortex Xpanse Expander User Guide

Creation date
Last date published
User Guide

Create, search, and view custom widgets in Cortex Xpanse, or use predefined widgets.

Widgets are visual components that populate dashboards and reports with specific data in various formats such as graphs, pie charts, and text. Cortex Xpanse comes with dozens of existing widgets that you can drop into any dashboard and report. You can also create your own custom widgets.

The widget library displays both the predefined widgets and user-created custom widgets. From the Widget Library page in Expander, you can create, edit, and delete your own custom widgets based on XQL queries. Go to DashboardsWidget Library to access the Widget Library.

Create a custom XQL widget

Perform these steps to create a new custom widget.

  1. In Cortex Xpanse , navigate to DashboardsWidget Library.

  2. In the widget menu, Create custom XQL widget.

  3. Enter a widget Name and optional Description.

  4. Create an XQL query. Select XQL Helper to view XQL search and schema examples.

  5. Generate the XQL query to display the search results.


    XQL queries generated from the widget library do not appear in the Query Center. The results are used only for creating the custom widget.

  6. In the Widget section, define how you want to visualize the results.

  7. After you are happy with the query parameters and visualization definitions, Save widget.

    The custom widget will appear in the list of existing widgets, so you can include it in a dashboard or report.

Edit a custom widget

Perform these steps to edit or delete an existing custom XQL widget.

  1. In Cortex Xpanse , navigate to DashboardsWidget Library.

  2. Search or scroll to locate the custom widget.

  3. Mouse over the widget and select Update widget (pencil-icon.png) to edit the widget or Delete widget from library.


    Editing an existing widget affects all dashboards that include the widget and future generated reports.