Predefined dashboards - Administrator Guide - Cortex XSIAM - Cortex

Predefined dashboards - Administrator Guide - Cortex XSIAM - Cortex - Security Operations

Cortex XSIAM Documentation

Product

Cortex XSIAM

Creation date

2024-03-06

Last date published

2024-10-13

Category

Administrator Guide

Abstract

Predefined dashboards are set up to help you monitor different aspects of your environment.

Cortex XSIAM provides predefined dashboards that display widgets tailored to the dashboard type. The dashboards can help you to monitor different aspects of your environment. To access your default dashboard, select Dashboards & Reports → Dashboard. From the dashboard header, a drop-down menu lists all available predefined and custom dashboards. The available dashboards depend on your license type.

To change your default dashboard, go to Dashboards & Reports → Dashboard Manager. In the Dashboard Manager you can also create custom dashboards based on existing dashboards, and save dashboards as report templates.

Dashboard name	Description	Other details
Agent management	Provides an overview of the deployed agents in your organization, their statuses and content versions, and a breakdown by OS type.
Attack surface management	Provides an overview of assets that are exposed to the Internet, and a breakdown of incidents related to attack surface exposure.	Notice Requires the Attack Surface Management add-on.
Cloud inventory	Provides an overview of your cloud-based assets.
Data ingestion	Provides an overview of data ingestion by product and vendor, the daily quota consumption, and your data ingestion rate.	Due to a calculation change in NGFW log ingestion and improvements to data ingestion metrics, you cannot view data earlier than July 2023 on this dashboard. However, you can still view this data by running Cortex Query Language (XQL) queries on the `metrics_center` data set.
Incident management	Provides a breakdown of the top incidents and hosts in your environment, and an overview of the top incident assignees.	Select the star in the the right corner of a widget to filter the data for incidents that match incident starring policies. A purple star indicates that the widget is displaying only starred incidents. The starring filter is persistent and continues to show the filtered results until you clear the star.
IT metrics	Provides an overview of IT performance on your Cortex XDR agent, including CPU and memory performance data, connectivity data, and data about hard reboots and crashed applications.	The Applications Crashing widget is supported for Windows agents only.
MITRE ATT&CK framework coverage	Provides a comprehensive overview of the Cortex XSIAM content and capabilities in context with the MITRE ATT&CK framework. For more information, see Review MITRE ATT&CK framework coverage.
My dashboard	Provides an overview of the incidents and MTTR for the logged-in user.
Network traffic analysis (NTA)	Provides an overview of network traffic analysis, and highlights key pieces of information.
NGFW ingestion	Provides an overview of ingestion status for all log types, the daily quota consumption for NGFW, and a breakdown by log type.
Playbook optimization	Provides an overview of Playbook, script and command metrics for optimization.
Risk management	Provides alert and incident information to aid in risk assessment by highlighting information about compromised accounts and insider threats. The alerts displayed in this dashboard are tagged by the research as Identity Threat alerts or Identity Analytics alerts. An incident is displayed if any of its associated alerts are tagged as an Identity threat or an Identity Analytics threat.
Security admin	Provides an overview of the incidents in your organization, and the status of resolved and overdue incidents.
Security manager	Provides general information about Cortex XSIAM incidents and agents.
Threat Intel Management	Provides information about malicious or suspicious indicators in incidents.