Dashboard actions

Manage dashboard actions in Cortex XSOAR 8 SaaS.

In the Dashboards tab, you can set the date range from which to return data and the refresh rate. In each dashboard you can also do the following.

Dashboard actions	Description
Filter dashboard data	You can filter dashboard data by either typing the query in the query bar, or in the relevant widget, by clicking Filter In. When clicking Filter In the query is added to the query bar. To filter out, delete the query. For example, if you only want to see active incidents that are high severity, in the Active Incidents by Severity widget, hover over High and click Filter In. Note In widgets that group excess results under an Other category (such as the Owners widget), you cannot use the Filter in or Filter out options for the Other item. Doing so creates a search query that returns no results. To view or filter these excess items, create a custom widget and increase the limit of displayed results or disable the grouping option. To remove the filter, delete the query. Tip If you want to see more information about the data, click the data to take you to the relevant page. For example, in the Active Incidents by Severity widget, to see only high incidents, click High. This takes you to the Incidents page, where you can see all the active critical incidents. After creating the filter, you can send the URL of the filtered dashboard to other users.
Change the color of legend items in graphs	You can change the color of items (such as indicator types and incident types) in some widgets, depending on the widget type and the chart/graph type. When editing a widget, click the item within the legend in the preview window on the right. The Edit color option appears and you can select the color for the item. If you edit the color after a widget has been added to a dashboard or report, the change only applies to the widget within that dashboard or report. If you edit the widget directly in the Widgets Library before adding it to a dashboard or report, the change is applied every time you add the widget to a dashboard or report. Changes to an item within a widget only apply within that widget. For example, changing the color for the Phishing incident type within the Active Incidents widget only applies to Active Incidents, and not other widgets that contain incident types.
Copy values from graphs	In the Quick chart definitions window, click an item in the legend and select Copy value. This enables copying the value from the widget for commands in the War Room.
Create or edit a dashboard	Design a new interface for specific security investigation needs, or edit an existing dashboard. To edit out-of-the-box dashboards, you first need to duplicate them. For more information, see Manage dashboards.
Import and export a dashboard	The dashboard is exported as a JSON file. You can make any changes you require and then import the file, for example between test and production environments.
(Admin only) Define dashboard access	In a production environment, an administrator defines the default dashboard for each user and selects the default dashboards that the user sees when logging into the tenant, depending on a user’s role. If a user has not modified their dashboard, these dashboards are added automatically, otherwise users can add these dashboards to their existing dashboards. Default dashboards can be removed but not deleted, and can be added again if required. You cannot add default dashboards to out-of-the-box roles. Important Before adding a dashboard to a role's default dashboards, the dashboard must first be shared with that role, otherwise it will not appear in the dropdown. For more information, see Manage roles in the Cortex XSOAR tenant.
Share a dashboard	Sharing dashboards enables collaboration and alignment among security teams by providing real-time visibility into key metrics and insights, facilitating informed decision-making and coordinated response efforts. Out-of-the-box dashboards and dashboards from content packs cannot be shared unless you duplicate them. For more information, see Manage dashboards.
Create a report	You can generate a report from the dashboard as is, or configure report settings, for example add new widgets to the report, change the report format, and schedule running a report. To create a report from a dashboard, click and select Create report. Click Run Now to generate the report. For more information, see Manage reports.