Build a custom dashboard

Build customized dashboards to display and filter the information that is most relevant to you.

You can build custom dashboards based on predefined dashboard templates, or you can build a new dashboard from scratch.

1. Select Dashboards & Reports → Customize → Dashboards Manager → + New Dashboard, or in the Dashboard Manager right-click an existing dashboard and select Save as new.
2. In the Dashboard Builder, under Dashboard Name enter a unique name for the dashboard.
3. Under Dashboard Type, choose a built-in dashboard template or a blank template, and click Next.
4. Customize your dashboard.

   To get a feel for how the data will look, Cortex XDR provides mock data. To see how the dashboard would look with real data in your environment, change the toggle to Real Data.
5. Add widgets to the dashboard. From the widget library, drag widgets on to the dashboard.

Notes for agent-related widgets and incident-related widgets

Note

• For agent-related widgets, you can limit the results to only the endpoints that belong to the group by applying an endpoint scope.

  Select the menu on the top right corner of the widget, select Groups, and select one or more endpoint groups.
• For incident-related widgets, you can limit your incidents to only those that match an incident starring configuration on your dashboard. A purple star indicates that the widget is displaying only starred incidents. For more information, see Incident starring.

1. (Optional) Configure fixed filters and inputs.

What are fixed filters and inputs?

Add fixed filters to your dashboard to provide dashboard users with useful dashboard filters that are based on predefined or dynamic input values. Any defined filters are displayed in the dashboard header.

Fixed filters are based on XQL widgets with dynamic parameters. If a dashboard contains these widgets, the Add Filters & Inputs option is displayed. For more information, see Configure fixed dashboard filters.

Notice

This feature requires a Cortex XDR Pro or Cortex XSIAM license.

7. (Optional) Configure dashboard drilldowns.

What are dashboard drilldowns?

Add drilldowns to your dashboard to provide interactive data insights when clicking on data points, table rows, or other visualization elements.

Dashboard drilldowns are based on XQL widgets. To add a drilldown to an XQL widget, click on the widget menu, and select Add drilldown. For more information, see Configure dashboard drilldowns.

Notice

This feature requires a Cortex XDR Pro or Cortex XSIAM license.

8. Under Time Range, set a time range for your dashboard.

By default, the widgets use the dashboard time frame. You can change the widget time frame from the widget menu.

9. When you have finished customizing your dashboard, click Next.

1. To set the custom dashboard as your default dashboard, select Define as default dashboard.
2. To keep this dashboard visible only for you, select Private.

   Otherwise, the dashboard is public and visible to all Cortex XDR users with the appropriate roles to view dashboards. Private dashboards can only be viewed, edited, and deleted by the dashboard creator.
3. Click Generate to complete your dashboard.