Configure fixed dashboard filters - Administrator Guide - Cortex XSIAM - Cortex - Security Operations

Cortex XSIAM Documentation

Product
Cortex XSIAM
Creation date
2024-03-06
Last date published
2024-12-12
Category
Administrator Guide
Abstract

Configure fixed filters that enable dashboard users to alter the scope of the dashboard by selecting predefined and dynamic values.

Notice

Fixed dashboard filters are supported in Cortex XDR Pro and Cortex XSIAM only.

Define fixed filters on your dashboards to enable dashboard users to alter the scope of the dashboard by selecting from predefined or dynamic values. You can define filters with free text, single select, and multiple select input values. After configuration, anyone who views your dashboard can use the fixed filters in the dashboard header.

Danger

Fixed filters are based on parameters that are defined in custom XQL widgets. Before you can configure fixed filters, take the following steps:

  1. Create custom XQL widgets with parameters. For more information, see Create custom XQL widgets.

  2. Add the widgets to a Custom dashboard. For more information, see Custom dashboards.

How to configure fixed dashboard filters
  1. Open a custom dashboard, and select Edit dashboard.

  2. Click Add Filters & Inputs.

    This option only appears if the dashboard contains custom XQL widgets with defined parameters.

  3. Under Parameter Title enter a name that identifies the parameter.

  4. On the FILTERS & INPUTS panel, click +Add an input and select one of the following options:

    • To specify a single predefined value, select Single Select.

    • To specify multiple predefined or dynamic values, select Multi Select.

    • To specify a single free text value, select Free text/number.

  5. Click Parameter and select the parameter that you want to configure.

    The parameters are extracted from the XQL queries of the widgets on the dashboard. You can define up to four parameter filters on a report or dashboard.

  6. If you selected Single Select or Multi Select values, click Dropdown Options and specify input values. When you generate the dashboard, these input values appear in a dropdown list for selection.

    • To configure Predefined inputs for Single Select and Multi Select values, manually type the list values.

    • To configure Dynamic inputs for Multi Select values, click XQL Query to fetch dynamic values.

  7. Under Default Value, select a value from the list of defined values. Specifying a default value ensures that the widget is automatically populated when you open the dashboard.

  8. Click Save Filters & Inputs and save your dashboard.

    Tip

    After the initial setup, when you access your dashboard the filters and inputs might need further refinement. You can make changes to the configured parameters in the XQL widgets, and update the Filters & Inputs on your dashboard until you are satisfied with the results.