Predefined dashboards - Learn more about predefined dashboards, which are out-of-the-box dashboards providedby Palo Alto Networks. - Administrator Guide - Cortex XSIAM - Cortex - Security Operations

Agent Management

Provides an overview of the deployed agents in your organization, their statuses and content versions, and a breakdown by OS type.

AI Security

The Cortex Cloud AI Security overview dashboard serves as the central hub for information on the AI ecosystem within the organization. It provides a comprehensive overview of AI security posture and is designed to help users quickly access relevant information. The layout and organization of the dashboard are tailored to guide you in understanding the AI environment and determining the next steps to take for effective AI governance.

For more information, see What is Cortex Cloud AI Security?.

API security Management

Provides an overview of your API security landscape. You can view all the information and statistics applicable to threats and vulnerabilities of APIs across the cloud and services in your environment. Using this information, you can manage and implement security measures to safeguard the APIs running in your environment.

The predefined dashboard for API security management, you can view data for:

Application Security

Provides an overview of application security posture with asset and code/pipeline issue insights.

Attack Surface Management

Provides an overview of assets that are exposed to the Internet, and a breakdown of cases related to attack surface exposure.

Automation Insights

Provides a high-level overview of automation, focusing on issues automatically closed and execution trends.

Cloud Inventory

Provides an overview of your cloud-based assets.

Compliance Overview

Provides a centralized view of your organization's compliance performance against industry standards and your own internal security frameworks. For more information, see Compliance Overview Dashboard.

Cortex Cloud Command Center

A central hub that provides a prioritized high-level summary of cloud accounts, provider scanning health, and asset distribution across all cloud providers, tracking progress over time with 90-day trends for Threat and Posture cases. For more information, see Cortex Cloud Command Center.

Cloud Security Operations

Provides an overview of your cloud security operations dashboard helps you rapidly assess your security posture and resolve issues with the largest impact. For more information, see Cloud Security Operations.

Data Ingestion

Provides an overview of data ingestion by product and vendor, the daily quota consumption, and your data ingestion rate.

Due to a calculation change in NGFW log ingestion and improvements to data ingestion metrics, you cannot view data earlier than July 2023 on this dashboard. However, you can still view this data by running Cortex Query Language (XQL) queries on the metrics_center data set.

Data Security

Discover and visualize all your data assets across the different cloud services, which will help you understand where the sensitive data is, how it is used and how it is moving across the organization.

For more information, see What is Cortex Cloud Data Security?.

Identity Security

You can use the Identity Security dashboard to ensure that your identity estate is fully covered from a security perspective. The Identity Security dashboard helps you perform actions such as monitoring your identity inventory, detecting the top critical issues and findings in your environment, identifying risky identities, discovering admins and admins at risk, and analyzing 3rd-party access.

For more information, see What is Cortex Cloud Identity Security?.

IT Metrics

Provides an overview of IT performance on your Cortex XDR agent, including CPU and memory performance data, connectivity data, and data about hard reboots and crashed applications.

The Applications Crashing widget is supported for Windows agents only.

KSPM

Provides insights into your Kubernetes environment, including clusters, assets, and resources. Receive critical security information related to vulnerabilities, malware, secrets, and other available scanners. Identify areas lacking protection and take action to secure your clusters.

For more information on onboarding your Kubernetes environment, see Onboard the Kubernetes Connector.

MITRE ATT&CK Framework Coverage

Provides a comprehensive overview of the Cortex XSIAM content and capabilities in context with the MITRE ATT&CK framework.

For more information, see Review MITRE ATT&CK framework coverage.

My Dashboard

Provides an overview of the cases and MTTR for the logged-in user.

Network Traffic Analysis (NTA)

Provides an overview of network traffic analysis, highlighting key pieces of information.

NGFW Ingestion

Provides an overview of ingestion status for all log types, the daily quota consumption for NGFW, and a breakdown by log type.

Risk Management

Provides issue and case information to aid in risk assessment by highlighting information about compromised accounts and insider threats.

The issues displayed in this dashboard are tagged by the research as Identity Threat issues or Identity Analytics issues. A case is displayed if any of its associated issues are tagged as an Identity threat or an Identity Analytics threat.

Security Manager

Provides general information about Cortex XSIAM cases and agents.

Threat Intel Management

Provides information about malicious or suspicious indicators in cases.

Troubleshooting Instances

Provides a detailed view of command and execution errors at the instance level, helping diagnose and resolve issues with specific integrations.

Troubleshooting Playbooks

Provides the ability to identify and resolve issues with playbooks and tasks through focused error analysis and runtime metrics.