Custom dashboards - Administrator Guide - Cortex XSIAM - Cortex - Security Operations

Cortex XSIAM Documentation

Product
Cortex XSIAM
Creation date
2024-03-06
Last date published
2024-05-22
Category
Administrator Guide
Abstract

Custom dashboards can support your day-to-day operations by providing options that are tailored to your unique workflow.

You can create custom dashboards that are tailored to your unique workflow and support your day-to-day operations. Cortex XSIAM provides dashboard templates that are based on the predefined dashboards, or you can build dashboards from scratch by selecting widgets and choosing their placement on the dashboard.

You can see all predefined and custom XQL widgets in the Widget Library. Custom XQL widgets are built on Cortex Query Language (XQL) queries and provide the flexibility to query specific data, and select the graphical format you require (such as table, line graph, or pie chart).

To enhance the functionality of your dashboards, you can also configure fixed filters and dashboard drilldowns that enabling dashboard users to filter and manipulate the displayed data as follows:

  • Fixed filters enable dashboard users to alter the scope of the dashboard by selecting predefined or dynamic input values from the filters in the dashboard header.

  • Dashboard drilldowns provide dashboard users with interactive data insights when clicking on data points in widgets. Drilldowns can trigger contextual changes on the dashboard, or they can link to an XQL search, a custom URL, another dashboard, or a report. Users can hover over a widget to see details about the drilldown, and click a value to trigger the drilldown.

Fixed filters and drilldowns are based on parameters that you define in custom XQL widgets, and are available on custom dashboards with XQL widgets only. For more information, see Configure fixed dashboard filters and Configure dashboard drilldowns.

Notice

Custom XQL widgets, fixed filters, and dashboard drilldowns are supported in Cortex XDR Pro and Cortex XSIAM only.