Cortex XSOAR dashboards provide visual data from customizable widgets. Create, edit, import, share and delete Cortex XSOAR dashboards. Dashboard tabs.
The dashboard consists of visualized data powered by fully customizable widgets, which enables you to analyze data from inside or outside Cortex XSOAR, in different formats such as graphs, pie charts, or text from information. For more information about widgets, see Widgets Overview.
When you first install Cortex XSOAR, the following dashboard tabs are created:
- Incidents: Information relating to incidents, such as severity type, active incidents, unassigned incidents and so on.
- System Health: Information relating to the Cortex XSOAR Server.
- My Dashboard: A personalized dashboard relating to your incidents, tasks, and so on.
- SLA: Information relating to your Service Level Agreement.
If you install a Content Pack which contain dashboards, these can be added when creating a new dashboard. To change the order of the dashboards, click next to the relevant dashboard, and then drag and drop the dashboard into the required location.
In every dashboard, you can set the date range from which to return data and the refresh rate. In the
DASHBOARDStab, you can do the following:
- Filter Data for all widgetsYou can filter dashboard data by either typing the query in the query bar, or in the relevant widget, by clickingFilter In. When clickingFilter Inthe query is added to the query bar. To filter out, delete the query. For example, if you only want to see Cortex XDR incidents that are critical, in theIncident Severity by Typewidget, hover over the Cortex XDR incident and clickFilter In.In theActive Incidents by Severitywidget, hover overCriticaland clickFilter In. The dashboard only shows active critical incidents relating to Cortex XDR.To remove the filter, delete the query.If you want to see more information about the data, click the data to take you to the relevant page. For example, in theActive Incidents by Severitywidget, to see only critical incidents, clickCritical. This takes you to theIncidentpage, where you can see all the active critical incidents.After you have created the filter, you can send the URL of the filtered dashboard to other users.
- Change Color of Widgets: You can change the group color in some of the widgets. The color changes only for that widget in the dashboard. To change the color of the widget permanently, edit the color in the Widgets Library. For example, in the Widgets Library, if you change the color for Cortex XDR in the Incident Severity by Type to red, the next time you add it to a dashboard, the color remains red for that widget only. It does not change for any other widget.
- Import and export a dashboard, which is useful in a test and production environment.
- Add default dashboardsIn a production environment, an administrator defines the default dashboards for each user, which is dependent on a user’s role. If a user has not modified their dashboard, these dashboards are added automatically, otherwise users can add these dashboards to their existing dashboards. These default dashboards can be removed but not deleted, and can be added again if required.
- Delete or remove (if shared) a dashboard.
- Create a reportYou can generate a report from the dashboard as is, or add new widgets as required. You can set the format, when to run, orientation, etc. To run the report, clickRun Now. The Report is generated and it also appears in theReportstab, which can be run again. For more information about creating reports, see Create a Report.
If you want to set up dashboards as a default for all existing and future users, see Configure a Default Dashboard.
Recommended For You
Recommended videos not found.