Configure dashboard drilldowns - Administrator Guide - Cortex XSIAM - Cortex - Security Operations

Cortex XSIAM Documentation

Cortex XSIAM
Creation date
Last date published
Administrator Guide

Configure drilldowns on custom dashboards to provide users with interactive data insights when clicking on data points in a widget


Dashboard drilldowns are supported in Cortex XDR Pro and Cortex XSIAM only.

Dashboard drilldowns can trigger contextual changes on the dashboard, or they can link to an XQL search, a custom URL, another dashboard, or a report. You configure drilldowns on individual widgets. After a drilldown is configured, clicking the widget triggers the drilldown.


To configure drilldowns your dashboard must contain custom XQL widgets. In addition, if you want to configure in-dashboard drilldowns your custom XQL widget must contain one or more parameters. For more information about configuring parameters in custom XQL widgets, see Create custom XQL widgets.

How to configure dashboard drilldowns
  1. Open a custom dashboard and select Edit dashboard.

  2. Identify the widget to which you want to apply a drilldown, click on the widget menu, and select Add drilldown.

  3. In Action On Click select one of the following options:

    • In-Dashboard Drilldown­: Interactively filters the dashboard data. Filters are based on the parameters defined in the custom XQL widgets on the dashboard.

    • Link to dashboard: Opens a target dashboard.

    • Open XQL Search: Runs an XQL query based on the clicked value.

    • Open custom URL: Opens an external URL based on a clicked value.

    • Generate Report: Runs a report from a clicked value.