Dashboard Overview

Cortex XSOAR dashboards provide visual data from customizable widgets. Create, edit, import, share and delete Cortex XSOAR dashboards. Dashboard tabs.
The dashboard consists of visualized data powered by fully customizable widgets, which enables you to analyze data from inside or outside Cortex XSOAR, in different formats such as graphs, pie charts, or text from information. For more information about widgets, see Widgets Overview.
When you first install Cortex XSOAR, the following dashboard tabs are created:
  • Incidents
    : Information relating to incidents, such as severity type, active incidents, unassigned incidents and so on.
  • System Health
    : Information relating to the Cortex XSOAR Server.
  • My Dashboard
    : A personalized dashboard relating to your incidents, tasks, and so on.
  • SLA
    : Information relating to your Service Level Agreement.
If you install a Content Pack which contain dashboards, these can be added when creating a new dashboard. To change the order of the dashboards, click next to the relevant dashboard, and then drag and drop the dashboard into the required location.
Dashboard Options
In every dashboard, you can set the date range from which to return data and the refresh rate. In the
DASHBOARDS
tab, you can do the following:
  • Filter Data for all widgets
    You can filter dashboard data by either typing the query in the query bar, or in the relevant widget, by clicking
    Filter In
    . When clicking
    Filter In
    the query is added to the query bar. To filter out, delete the query. For example, if you only want to see Cortex XDR incidents that are critical, in the
    Incident Severity by Type
    widget, hover over the Cortex XDR incident and click
    Filter In
    .
    In the
    Active Incidents by Severity
    widget, hover over
    Critical
    and click
    Filter In
    . The dashboard only shows active critical incidents relating to Cortex XDR.
    To remove the filter, delete the query.
    If you want to see more information about the data, click the data to take you to the relevant page. For example, in the
    Active Incidents by Severity
    widget, to see only critical incidents, click
    Critical
    . This takes you to the
    Incident
    page, where you can see all the active critical incidents.
    After you have created the filter, you can send the URL of the filtered dashboard to other users.
  • Change Color of Widgets
    : You can change the group color in some of the widgets. The color changes only for that widget in the dashboard. To change the color of the widget permanently, edit the color in the Widgets Library. For example, in the Widgets Library, if you change the color for Cortex XDR in the Incident Severity by Type to red, the next time you add it to a dashboard, the color remains red for that widget only. It does not change for any other widget.
  • Import and export a dashboard, which is useful in a test and production environment.
  • Add default dashboards
    In a production environment, an administrator defines the default dashboards for each user, which is dependent on a user’s role. If a user has not modified their dashboard, these dashboards are added automatically, otherwise users can add these dashboards to their existing dashboards. These default dashboards can be removed but not deleted, and can be added again if required.
  • Delete or remove (if shared) a dashboard.
  • Create a report
    You can generate a report from the dashboard as is, or add new widgets as required. You can set the format, when to run, orientation, etc. To run the report, click
    Run Now
    . The Report is generated and it also appears in the
    Reports
    tab, which can be run again. For more information about creating reports, see Create a Report.
If you want to set up dashboards as a default for all existing and future users, see Configure a Default Dashboard.

Recommended For You