Configure fixed dashboard filters

Configure fixed filters that enable dashboard users to alter the scope of the dashboard by selecting predefined and dynamic values.

Notice

Fixed dashboard filters are supported in Cortex XDR Pro and Cortex XSIAM only.

Define fixed filters on your dashboards to enable dashboard users to alter the scope of the dashboard by selecting from predefined or dynamic values. You can define filters with free text, single select, and multiple select input values. After configuration, anyone who views your dashboard can use the fixed filters in the dashboard header.

Prerequisite

Fixed filters are based on parameters that are defined in custom XQL widgets. Before you can configure fixed filters, take the following steps:

1. Create custom XQL widgets with parameters. For more information, see Create custom XQL widgets.
2. Add the widgets to a Custom dashboard. For more information, see Custom dashboards.

How to configure fixed dashboard filters

1. Open a custom dashboard, and select Edit dashboard.
2. Click Add Filters & Inputs.

   This option only appears if the dashboard contains custom XQL widgets with defined parameters.
3. Under Parameter Title enter a name that identifies the parameter.
4. On the FILTERS & INPUTS panel, click +Add an input and select one of the following options:

   • To specify a single predefined value, select Single Select.
   • To specify multiple predefined or dynamic values, select Multi Select.
   • To specify a single free text value, select Free text/number.

Guidelines

• Select an option that corresponds with the parameter configured in the XQL widget. Parameters with single predefined or free text values use the = operator, and parameters with multiple values, use the IN operator.

  • Predefined values are most suitable for filtering fields that have static values, such as status fields with a limited number of available options.
  • Dynamic values help you to filter with values that change often. You can configure an XQL query that extracts all of the values that are available for that field. For example, in the endpoints dataset, the endpoint_name field values can change frequently.

1. Click Parameter and select the parameter that you want to configure.

   The parameters are extracted from the XQL queries of the widgets on the dashboard. You can define up to four parameter filters on a report or dashboard.
2. If you selected Single Select or Multi Select values, click Dropdown Options and specify input values. When you generate the dashboard, these input values appear in a dropdown list for selection.

   • To configure Predefined inputs for Single Select and Multi Select values, manually type the list values.

Guidelines

• The values must support the parameter type. For example, for $name specify characters and for $num specify numbers.
• If you uploaded numbers in a string, specify each number in quotes, for example "500".

• To configure Dynamic inputs for Multi Select values, click XQL Query to fetch dynamic values.

Guidelines

In the XQL Query Builder, configure a query that includes the field stage and the name of the column from which to take the dropdown values. All values in the specified field will be available for selection, and the values are dynamically updated.

Example:

In this example, the endpoint_name field is configured. The dashboard user will be able to filter by one or more values from the endpoint_name field.

dataset =endpoints | fields endpoint_name

Note

If you specify more than one field, only the first field value is used.

1. Under Default Value, select a value from the list of defined values. Specifying a default value ensures that the widget is automatically populated when you open the dashboard.
2. Click Save Filters & Inputs and save your dashboard.

   Tip

   After the initial setup, when you access your dashboard the filters and inputs might need further refinement. You can make changes to the configured parameters in the XQL widgets, and update the Filters & Inputs on your dashboard until you are satisfied with the results.