Using Dashboard Filters, Inputs, and Drilldowns - Administrator Guide - Cortex XSIAM - Cortex - Security Operations

Cortex XSIAM Administrator Guide

Product
Cortex XSIAM
Creation date
2024-02-26
Last date published
2024-04-16
Category
Administrator Guide
Abstract

Explains how to use dashboard filters and drilldowns.

On Custom dashboards, you can set up fixed filters, inputs, and drilldowns to enable you and other analysts to filter and manipulate the data of a dashboard.

Dashboard Filters

Fixed dashboard filters are displayed in the dashboard header. Depending on the configuration, the filters take the following format:

  • Free text/number: manually enter filter values into the input field.

  • Single Select: select a single predefined filter value from the dropdown list.

  • Multi Select: select multiple predefined or dynamic filter values from the dropdown list. For Multi Select Dynamic values, the list displays the first 100 results from the specified field. You can choose a value from the list, or start typing to search for a specific value.

Fixed filters are based on parameters that are defined in Custom XQL widgets. For information, see Manage Your Widget Library and Configuring Filters & Inputs. Temporary filters are also displayed in the dashboard header, however these filters cannot be modified unless they are configured in the widgets and on the dashboard.

Dashboard Drilldowns
Abstract

Dashboard drilldowns provide interactive data insights when clicking on data points, table rows, or other visualization elements.

Dashboard drilldowns provide interactive data insights when clicking on data points, table rows, or other visualization elements. Drilldowns can trigger contextual changes on the dashboard, or they can link to an XQL search, a custom URL, another dashboard, or a report.

Hover over a widget to see details about the drilldown, and click a value to trigger the drilldown. If the drilldown triggers an in-dashboard drilldown, all widgets that use the selected parameter are affected. Parameters that are configured as fixed filters are displayed in the dashboard header. Parameters that are not configured are added as temporary filters. For more information, see Configuring Filters, Inputs, and Drilldowns.