Create custom XQL widgets - Administrator Guide - Cortex XSIAM - Cortex - Security Operations

Cortex XSIAM Documentation

Cortex XSIAM
Creation date
Last date published
Administrator Guide

You can create custom XQL widgets based on a Cortex Query Language (XQL) query, and add parameters that you can configure as fixed filters or dashboard drilldowns.


Custom XQL widgets are supported in Cortex XDR Pro and Cortex XSIAM only.

With custom XQL widgets you can personalize the information that you display on your custom dashboards and reports. You can build widgets that query specific information that is unique to your workflow, and define the graphical format you require (such as table, line graph, or pie chart).

All of your predefined and custom XQL widgets are available in the Widget Library under Dashboards & ReportsCustomizeWidget Library. From the Widget Library, you can browse all widgets by category, create new XQL widgets, and edit and delete existing XQL widgets.

How to create a custom XQL widget
  1. In the Widget Library, select Create custom XQL widget.

  2. Enter a widget name and an optional description.

  3. Define an XQL query that searches for the data you require. Select XQL Helper to view XQL search and schema examples. For more information, see Create an XQL query.Create an XQL Query

  4. Select Preview to review the search results.


    Cortex Query Language (XQL) queries generated from the Widget Library do not appear in the Query Center. The results are used only for creating the custom widget.

  5. In the Widget section, define how you want to visualize the results.

  6. (Optional) Add parameters to the query.

    You can use parameters to filter widget data on a dashboard or report, and create drilldowns on dashboards. Base your filters on fields and values in the query results.

  7. (Optional) Specify a time frame. The default time frame is 1M.

  8. Save the widget.

    The custom widget appears in the list of existing widgets.