System dashboards

Reference Cortex XSIAM system dashboards for operational, cloud security, and data ingestion monitoring.

System dashboards help you monitor and evaluate various aspects of your environment. You can access your default view by navigating to Dashboards & Reports → Dashboard. To change the displayed dashboard, click the dashboard name and select from the dashboard menu.

Because system dashboards are managed by the platform and cannot be edited or deleted, you can duplicate any dashboard in the Dashboard Manager. This creates a customizable version you can modify freely while keeping the original template intact.

Dashboard	Improved Description
Agent Management	Track the status, content versions, and OS distribution of all deployed agents across your organization. Note Requires Cortex XSIAM Premium, Enterprise, or any license with the Enterprise Runtime or Cloud Runtime Security add-on.
AI Security	Assess your organization’s AI ecosystem and security posture to guide governance decisions and prioritize risk-mitigation steps. Note For more details, see What is Cortex Cloud AI Security?.
API Security Management	Identify and mitigate threats and vulnerabilities across cloud services by monitoring risky API funnels, regional attack patterns, attack traffic trends, and sensitive data exposure.
Application Security	Evaluate your application security posture through targeted insights into exposed assets, code vulnerabilities, and CI/CD pipeline issues.
Attack Surface Management	Pinpoint internet-exposed assets and analyze related exposure cases to reduce your external attack vector. Note Requires Cortex XSIAM Premium or any license with the Attack Surface Management (ASM) add-on.
Automation Insights	Review high-level automation performance, tracking automatically closed issues and execution trends over time.
Cloud Inventory	Audit and manage your organization's cloud-based assets across all environments. Note Requires a Cortex XSIAM Enterprise Plus license.
Compliance Overview	Review your organization’s compliance performance against industry standards and internal security frameworks. Note For more details, see Compliance Overview Dashboard.
Cortex Cloud Consumption	Track your cloud consumption with a detailed breakdown by workload type, date range, and other usage details across all your cloud accounts. Note For more details, see Cortex Cloud Consumption.
Cloud Security Operations	Assess and resolve high-impact cloud security issues quickly to maintain a strong security operational posture. Note For more details, see Cloud Security Operations.
Data Ingestion	Monitor data ingestion rates, vendor/product breakdowns, and daily quota consumption across your system. For more information, see Data Ingestion. Note Data prior to July 2023 is inaccessible on this dashboard due to metric updates, but remains queryable via XQL on the metrics_center dataset.
Data Security	Discover and visualize all your data assets across the different cloud services, which will help you understand where the sensitive data is, how it is used and how it is moving across the organization. Note For more details, see Cortex Data Security.
Identity Security	Secure your identity estate by monitoring your identity inventory, detecting critical findings, identifying the top critical issues and findings in your environment, detecting risky identities, discovering admins and admins at risk, and analyzing 3rd-party access. Note For more details, see What is Cloud Identity Security?.
IT Metrics	Analyze Cortex XDR agent performance metrics—including CPU/memory utilization, connectivity status, hard reboots, and application crashes. Note The Applications Crashing widget is supported for Windows agents only. Requires Cortex XSIAM Premium, Enterprise, or an Enterprise Runtime add-on.
KSPM (Kubernetes Security Posture Management)	Investigate Kubernetes clusters, assets, and resources to locate unprotected areas, vulnerabilities, malware, and exposed secrets. Note Full access requires 'All assets' scoping or Instance Administrator privileges. Restricted access applies under granular SBAC scoping. For details, see Onboard the Kubernetes connector and Manage user scope.
MITRE ATT&CK Framework Coverage	Review Cortex XSIAM's content and detection capabilities against the techniques and tactics of the MITRE ATT&CK framework. Note For more details, see Review MITRE ATT&CK framework coverage.
My Dashboard	Manage personal case assignments and monitor individual Mean Time to Respond (MTTR) performance.
Network Traffic Analysis (NTA)	Analyze network traffic patterns and anomalies to highlight potential threats and unusual network behavior.
NGFW Ingestion	Track Next-Generation Firewall (NGFW) log ingestion statuses, daily quota consumption, and individual log type breakdowns.
Risk Management	Evaluate risk exposure by investigating compromised accounts and insider threats. The issues displayed in this dashboard are tagged by the research as Identity Threat issues or Identity Analytics issues. A case is displayed if any of its associated issues are tagged as an Identity threat or an Identity Analytics threat. Note Requires the ITDR add-on.
Security Manager	Supervise operational case management and agent health across your environment. Monitor 30-day open cases by severity, top 10 open cases, and workload distribution by assignee (aged vs. total open cases), alongside top 5 agent version distributions and overall agent status breakdowns.
Threat Intel Management	Investigate malicious or suspicious indicators linked to active security cases. Note Requires the Cortex XSIAM Premium license or any other XSIAM license with the Threat Intel Management (TIM) add-on.
Troubleshooting Instances	Diagnose integration failures by analyzing command and execution errors at the individual instance level.
Troubleshooting Playbooks	Debug playbook and task execution errors using focused runtime metrics and failure analysis.