Dashboard actions - Administrator Guide - 8 - Cortex XSOAR - Cortex - Security Operations

Filter dashboard data

You can filter dashboard data by either typing the query in the query bar, or in the relevant widget, by clicking Filter In. When clicking Filter In the query is added to the query bar. To filter out, delete the query. For example, if you only want to see active incidents that are high severity, in the Active Incidents by Severity widget, hover over High and click Filter In.

To remove the filter, delete the query.

After creating the filter, you can send the URL of the filtered dashboard to other users.

Change the color of legend items in graphs

You can change the color of items (such as indicator types and incident types) in some widgets, depending on the widget type and the chart/graph type. When editing a widget, click the item within the legend in the preview window on the right. The Edit color option appears and you can select the color for the item.

If you edit the color after a widget has been added to a dashboard or report, the change only applies to the widget within that dashboard or report. If you edit the widget directly in the Widgets Library before adding it to a dashboard or report, the change is applied every time you add the widget to a dashboard or report. Changes to an item within a widget only apply within that widget. For example, changing the color for the Phishing incident type within the Active Incidents widget only applies to Active Incidents, and not other widgets that contain incident types.

Copy values from graphs

In the Quick chart definitions window, click an item in the legend and select Copy value. This enables copying the value from the widget for commands in the War Room.

Create or edit a dashboard

Design a new interface for specific security investigation needs, or edit an existing dashboard. To edit out-of-the-box dashboards, you first need to duplicate them.

For more information, see Manage dashboards.

Import and export a dashboard

The dashboard is exported as a JSON file. You can make any changes you require and then import the file, for example between test and production environments.

(Admin only) Define dashboard access

In a production environment, an administrator defines the default dashboard for each user and selects the default dashboards that the user sees when logging into the tenant, depending on a user’s role. If a user has not modified their dashboard, these dashboards are added automatically, otherwise users can add these dashboards to their existing dashboards. These default dashboards can be removed but not deleted, and can be added again if required.

For more information, see Manage roles in the Cortex XSOAR tenant.

Share a dashboard

Sharing dashboards enables collaboration and alignment among security teams by providing real-time visibility into key metrics and insights, facilitating informed decision-making and coordinated response efforts. Out-of-the-box dashboards and dashboards from content packs cannot be shared unless you duplicate them.

For more information, see Manage dashboards.

Create a report

You can generate a report from the dashboard as is, or configure report settings, for example add new widgets to the report, change the report format, and schedule running a report. To create a report from a dashboard, click and select Create report. Click Run Now to generate the report.

For more information, see Manage reports.