Dashboards help you to monitor system activity in your environment. Select a dashboard from the drop-down menu, or take actions on your dashboards from the Dashboard Manager.
Dashboards offer graphical overviews of your tenant's activities, enabling you to effectively monitor incidents and overall activity in your environment. Each dashboard comprises widgets that summarize information about your endpoint in graphical or tabular format.
When you sign in to Cortex XSIAM your default dashboard is displayed. To change the displayed dashboard, in the dashboard header choose from the list of predefined and custom dashboards. You can also manage all of your dashboards from the Dashboard Manager.
On each dashboard, you can you can see the selected Time Range on the right side of the header. An indicator shows the time that the dashboard was last updated, and if the data is not up-to-date you can click Refresh to update all widget data, or Refresh each widget individually. You can also select widget specific time frames from the menu on an XQL widget. If you select a different time frame for a widget, a clock icon is displayed.
Predefined dashboard filters are displayed in the dashboard header. A filter icon on a widget indicates that the widget data is filtered. Hover over the icon to see details of the filters applied. A filter icon on a widget indicates that the widget data is filtered. Hover over the icon to see details of the filters applied.
To see additional options for the dashboard, including saving the dashboard as a report template and disabling the background animation, open the dashboard menu.
Types of dashboards
Cortex XSIAM provides the following types of dashboards:
Command Center dashboards
Command Center dashboards provide instant visibility into your security operations, with drilldowns to additional dashboards and associated pages. For more information, see Command Center dashboards.
Predefined dashboards
Predefined dashboards are configured for different system set-ups and use cases, and to assist SOC analysts in their investigations. You can create reports and custom dashboards that are based on predefined dashboards. For more information, see Predefined dashboards.
Custom dashboards
Custom dashboards provide the flexibility to design dashboards that are built to your own specifications. You can base custom dashboards on the predefined dashboards or create a new dashboard from scratch, and save your custom dashboards as reports. For more information, see Custom dashboards.
Manage your dashboards
You can see all of your predefined and custom dashboards in the Dashboard Manager, and take the following actions:
Create, edit, and delete custom dashboards
Note
You cannot edit the predefined dashboards but you can create a new dashboard that is based on a dashboard template.
Select your default dashboard
Create a report template based on a dashboard
Import and export dashboards
You can import and export dashboards in a JSON format, which enables you to transfer your configurations between environments for onboarding, migration, backup, and sharing. You can also bulk export and import multiple dashboards at a time.
Note
Dashboards that are based on custom infrastructure cannot be exported.
If you import a dashboard template that already exists in the system, the imported template will overwrite the existing template. If you do not want to overwrite the existing template, duplicate and rename the existing template before importing the new template.