> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.6/configure-cortex-xsoar/dashboards-and-reports/dashboards/dashboard-actions.md). # Dashboard actions In the **Dashboards** tab, you can set the date range from which to return data and the refresh rate. In each dashboard you can also do the following. | Dashboard actions | Description | | ------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | Filter dashboard data |

You can filter dashboard data by either typing the query in the query bar, or in the relevant widget, by clicking Filter In. When clicking Filter In the query is added to the query bar. To filter out, delete the query. For example, if you only want to see active incidents that are high severity, in the Active Incidents by Severity widget, hover over High and click Filter In.

Note

In widgets that group excess results under an Other category (such as the Owners widget), you cannot use the Filter in or Filter out options for the Other item. Doing so creates a search query that returns no results. To view or filter these excess items, create a custom widget and increase the limit of displayed results or disable the grouping option.

dashboards-pivot.png

To remove the filter, delete the query.

Tip

If you want to see more information about the data, click the data to take you to the relevant page. For example, in the Active Incidents by Severity widget, to see only high incidents, click High. This takes you to the Incidents page, where you can see all the active critical incidents.

After creating the filter, you can send the URL of the filtered dashboard to other users.

| | Change the color of legend items in graphs |

You can change the color of items (such as indicator types and incident types) in some widgets, depending on the widget type and the chart/graph type. When editing a widget, click the item within the legend in the preview window on the right. The Edit color option appears and you can select the color for the item.

If you edit the color after a widget has been added to a dashboard or report, the change only applies to the widget within that dashboard or report. If you edit the widget directly in the Widgets Library before adding it to a dashboard or report, the change is applied every time you add the widget to a dashboard or report. Changes to an item within a widget only apply within that widget. For example, changing the color for the Phishing incident type within the Active Incidents widget only applies to Active Incidents, and not other widgets that contain incident types.

| | Copy values from graphs | In the **Quick chart definitions** window, click an item in the legend and select **Copy value**. This enables copying the value from the widget for commands in the War Room. | | Create or edit a dashboard |

Design a new interface for specific security investigation needs, or edit an existing dashboard. To edit out-of-the-box dashboards, you first need to duplicate them.

For more information, see Manage dashboards.

| | Import and export a dashboard | The dashboard is exported as a JSON file. You can make any changes you require and then import the file, for example between test and production environments. | | (Admin only) Define dashboard access |

In a production environment, an administrator defines the default dashboard for each user and selects the default dashboards that the user sees when logging into the tenant, depending on a user’s role. If a user has not modified their dashboard, these dashboards are added automatically, otherwise users can add these dashboards to their existing dashboards. These default dashboards can be removed but not deleted, and can be added again if required.

Note

You cannot add default dashboards to out-of-the-box roles.

For more information, see Manage roles in the Cortex XSOAR tenant.

| | Share a dashboard |

Sharing dashboards enables collaboration and alignment among security teams by providing real-time visibility into key metrics and insights, facilitating informed decision-making and coordinated response efforts. Out-of-the-box dashboards and dashboards from content packs cannot be shared unless you duplicate them.

For more information, see Manage dashboards.

| | Create a report |

You can generate a report from the dashboard as is, or configure report settings, for example add new widgets to the report, change the report format, and schedule running a report. To create a report from a dashboard, click cog-wheel-8.png and select Create report. Click Run Now to generate the report.

For more information, see Manage reports.

| --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.6/configure-cortex-xsoar/dashboards-and-reports/dashboards/dashboard-actions.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.