> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/data-security-documentation/inventory-and-monitoring/dashboards-and-reports/data-security-dashboards/cortex-ddr-dashboard.md).
# Cortex DDR Dashboard
The Cortex Data Detection and Response (DDR) Dashboard is the central hub for monitoring and responding to real-time threats against your data. It brings your data threats into a single interactive view. The dashboard covers real-time threat detections across Cloud, SaaS, and AI infrastructure.
The dashboard is designed to guide you from the current state of your environment—how many threats are open, how old they are, and how fast you are closing them—down to the individual issue you need to investigate.
A global time filter of **24H**, **7D**, or **30D** applies to every widget on the dashboard, and defaults to **24H**.
The following image shows the Cortex DDR Dashboard:
### How to access the Cortex DDR Dashboard
You can open the DDR Dashboard from any of the following locations:
* **Modules → Data Security → Data Detection and Response**
* **Dashboards & Reports → Dashboard**, then choose **Data Detection & Response** from the dashboard drop-down menu in the header.
### Current state
These widgets summarize your threat backlog and how quickly your team is working through it:
* **Issue breakdown:** The total open issues in your environment, broken down by severity.
* **Mean time to remediate issues:** The MTTR for critical, high, and overall issues, plotted per severity alongside the overall average.
* **Open issues by age:** Unresolved issues sorted by how long they have been in the system.
* **Issue Burndown:** A trendline of issues created against issues resolved, with the total for each shown in the legend. When more issues are created than resolved, your security debt is growing.
### MITRE ATT\&CK
Maps all open issues in the selected time filter to the MITRE ATT\&CK framework, with the number of issues and techniques recorded against each tactic. You can track an attacker's progress and judge whether a quiet tactic reflects effective controls or a detection gap.
{% hint style="info" %}
**Note:** The sum of the issues across all tactics may be greater than the totals in the widgets above, as a single issue can be recorded against multiple tactics.
{% endhint %}
Select a tactic or technique, or select **Open full view** to see the complete matrix.
### Data security issues
Lists the individual threats in your environment so you can triage them by priority. Alongside the issue name, severity, and status, each row shows the insert time and the issue category. You can add further columns, such as the issue description and a link to the associated case.
Select a row to open the issue investigation view in a side card.
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.
Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:
```
GET https://cortex-docs.paloaltonetworks.com/data-security-documentation/inventory-and-monitoring/dashboards-and-reports/data-security-dashboards/cortex-ddr-dashboard.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.
