Widget customization

Overview of widgets, including methods for creating and adding widgets. Use widgets to analyze and display data in a dashboard or report in Cortex XSOAR.

Cortex XSOAR provides out-of-the-box system widgets, such as Late Incidents and Saved by Dbot (ROI Widget). You can edit these widgets when creating or editing a dashboard or report.

Note

Some content packs include a widget that tracks API rate limit errors. You can use this information for troubleshooting and to make decisions about indicator enrichment. From the Widgets Library, click + and choose SOAR Metrics from the dropdown. From the Operations tab, in the Sum field, select Total API Calls. In the Group by dropdown, select API Response Type. Note that this widget only displays data if there is an installed content pack that supports API rate limit information.

You can create custom widgets as follows and then add them to a dashboard or report as required.

Widget customization method	Description
Widgets Library	Create a widget using the widget builder in the Widgets Library which is available for all users. For more information, see Create a widget using the widget builder.
From an incident	Create the widget from the Incidents page and then add it to a dashboard or a report. For more information, see Create a widget from an incident.
From an indicator	Create the widget from the Threat Intel (Indicators) page and then add it to a dashboard or a report. For more information, see Create a widget from an indicator.
In the War Room	In the War Room, view an incident in widget format, for example, as severity in a bar chart. For more information, see Add a widget in the War Room.

Tip

We recommend the following to optimize performance.

• Keep widgets simple (no scripts)
• Set refresh times to greater than one minute
• Limit the number of widgets on a dashboard