Manage API keys - Administrator Guide - Cortex XSIAM - Cortex - Security Operations

For datasets where no filter is defined, determine how to set the When no filter is defined option as either:

Define any filters for the applicable datasets listed in the table:

1. Scroll down the list of datasets to the dataset you want to apply a filter on, and click the Edit Scope icon.

2. In the Define what rows are accessible window, continue to write the query for the filter in the query box (where the syntax is a limited subset of XQL) to limit the data rows for the selected dataset according to the access permissions you want the user to have. The beginning of the query is already defined before the query box, and there is no need to include this in your query.

   Important

   For optimal performance, we recommend using a single field in the filter definition and simple comparison operators.

   Supported syntax

   Fields

   You can define the rest of the filter in the query box, where only the following system fields are supported: _broker_device_id, _broker_device_ip, _broker_device_name, _collector_id, _collector_ip, _collector_name, _collector_type, _device_id, _final_reporting_device_ip, _final_reporting_device_name, _log_type, _product, _scope, _reporting_device_ip, _reporting_device_name, and _vendor.

   For more information on these fields, see the table that describes all the fields in the metrics_source dataset and metrics_view preset in Overview of data ingestion metrics. For more information on the _scope field (relevant when _scope is defined in the Parsing Rule), see [Scenario 3: Supported fields don't provide the necessary segmentation] in Scenarios related to Datasets Rows scoping.Manage user scope

   Comparison operators

   The following comparison operators are supported:

   • Exact matches (=, !=)

   • Comparing numerical values (>, <, >=, <=)

   • Checking membership in lists (in)

   • Querying arrays (array_contains)

   • Partial matches (contains, starts_with): Using this operator has additional performance overhead, and we recommend avoiding its use.

   Example 1. 

   If you only want a user to be able to access rows in the pan_dds_raw dataset, when the _collector_name is bu2_collector , you'd have to define the filter in the query box as:

   _collector_name = “bu2_collector”

   
   

3. (Optional) Set the Time frame for the query. The default is Last 1 day.

4. (Optional) You can preview the query results displayed based on your defined query by clicking Preview. You can edit your query until you're satisfied with the output. By default, the query results are limited to 1000 records.

5. When you are finished, click Done.

   The Scope field for the dataset that you added the filter on is updated with the query.

   Example 2. 

   In the above example, the Scope field displays _collector_name = “bu2_collector”.