Configure dashboard drilldowns

Configure drilldowns on custom dashboards to provide users with interactive data insights when clicking on data points in a widget

Notice

Dashboard drilldowns are supported in Cortex XDR Pro and Cortex XSIAM only.

Dashboard drilldowns can trigger contextual changes on the dashboard, or they can link to an XQL search, a custom URL, another dashboard, or a report. You configure drilldowns on individual widgets. After a drilldown is configured, clicking the widget triggers the drilldown.

Prerequisite

To configure drilldowns your dashboard must contain custom XQL widgets. In addition, if you want to configure in-dashboard drilldowns your custom XQL widget must contain one or more parameters. For more information about configuring parameters in custom XQL widgets, see Create custom XQL widgets.

How to configure dashboard drilldowns

1. Open a custom dashboard and select Edit dashboard.
2. Identify the widget to which you want to apply a drilldown, click on the widget menu, and select Add drilldown.
3. In Action On Click select one of the following options:

   • In-Dashboard Drilldown­: Interactively filters the dashboard data. Filters are based on the parameters defined in the custom XQL widgets on the dashboard.

Define the following values:

Field	Action
Parameters	Select the parameter by which to filter. You can choose any parameter that is defined in the XQL query of the widget. Note If the selected parameter is configured in other XQL widgets on the dashboard, these widgets are also affected by the drilldown.
Value	When a user clicks the widget, the dashboard is filtered by this value. Type your own value. Select a variable from which to capture the clicked value, for example, the $y-axis.value in a chart. For more information, see Variables in drilldowns.

• Link to dashboard: Opens a target dashboard.

Define the following values:

Field	Action
Dashboard	Select the target dashboard.
(Optional) Parameter	Select parameters by which to filter the data on the target dashboard. Parameters are only available if there are parameters defined in the widgets on the target dashboard.
(Optional) Value	When a user clicks the widget, this value is configured as a parameter on the target dashboard. Type your own value. Select a variable from which to capture the clicked value in the source dashboard, for example, the $y-axis.value in a chart. For more information, see Variables in drilldowns.

• Open XQL Search: Runs an XQL query based on the clicked value.

Define the following values:

Field	Action
XQL Query	Define the query that you want to run on drilldown. Type $ to see autocomplete options for variables that are available in the widget drilldown. For example, in a table widget $first.name selects the leftmost column name in the table. For more information, see Variables in drilldowns.

In the following example two parameters are passed from a table widget to an XQL query. The first parameter with the cell value that the user clicked on, and a second parameter with the cell value in the request_url column in the row that the user clicked.

dataset=xdr_data
|filter event_type=$y_axis.value and requestUri=$row.request_url
|fields action_download, action_remote_ip as remote_ip,
actor_process_image_name as process_name
|comp count_distinct(action_download) as total_download by process_name,
remote_ip, remote_hostname
|sort desc total_download
|limit 10
|view graph type=single subtype=standard xaxis=remote_ip yaxis=total_download

• Open custom URL: Opens an external URL based on a clicked value.

Define the following values:

Field	Action
URL Address	Type the URL. To create a dynamic drilldown, you can include Available parameters. For more information about the parameters, see Variables in drilldowns.

In the following URL, the $x_axis.value parameter represents cortex products names. On drilldown, the $x_axis.value is replaced with the clicked product name in the pie chart.

• Generate Report: Runs a report from a clicked value.