https://live.paloaltonetworks.com/t5/cortex-xsiam-discussions/xsiam-analytics-rules-dashboard/m-p/1254309#M406 <P>Hello&nbsp;<a href="https://live.paloaltonetworks.com/t5/user/viewprofilepage/user-id/710084109">@bridgetlitt</a>&nbsp;,</P> <P>&nbsp;</P> <P>Greetings for the day.</P> <P>&nbsp;</P> <DIV class="qMYqUG_convSearchResultHighlightRoot"> <DIV class="" data-is-intersecting="true" data-turn-id-container="request-WEB:de2c8334-d273-4cc8-97db-40294f60b252-0"> <DIV class="relative w-full overflow-visible"> <SECTION class="text-token-text-primary w-full focus:outline-none has-data-writing-block:pointer-events-none [&amp;:has([data-writing-block])&gt;*]:pointer-events-auto R6Vx5W_threadScrollVars scroll-mb-[calc(var(--scroll-root-safe-area-inset-bottom,0px)+var(--thread-response-height))] scroll-mt-[calc(var(--header-height)+min(200px,max(70px,20svh)))]" dir="auto" data-turn="assistant" data-scroll-anchor="false" data-testid="conversation-turn-2" data-turn-id-container="request-WEB:de2c8334-d273-4cc8-97db-40294f60b252-0" data-turn-id="request-WEB:de2c8334-d273-4cc8-97db-40294f60b252-0"> <DIV class="text-base my-auto mx-auto pb-10 [--thread-content-margin:var(--thread-content-margin-xs,calc(var(--spacing)*4))] @w-sm/main:[--thread-content-margin:var(--thread-content-margin-sm,calc(var(--spacing)*6))] @w-lg/main:[--thread-content-margin:var(--thread-content-margin-lg,calc(var(--spacing)*16))] px-(--thread-content-margin)"> <DIV class="[--thread-content-max-width:40rem] @w-lg/main:[--thread-content-max-width:48rem] mx-auto max-w-(--thread-content-max-width) flex-1 group/turn-messages focus-visible:outline-hidden relative flex w-full min-w-0 flex-col agent-turn"> <DIV class="flex max-w-full flex-col gap-4 grow"> <DIV class="min-h-8 text-message relative flex w-full flex-col items-end gap-2 text-start break-words whitespace-normal outline-none keyboard-focused:focus-ring [.text-message+&amp;]:mt-1" dir="auto" tabindex="0" data-turn-start-message="true" data-message-model-slug="gpt-5-5" data-message-id="a32751bd-b432-4179-8915-9c6cc38cef21" data-message-author-role="assistant"> <DIV class="flex w-full flex-col gap-1 empty:hidden"> <DIV class="markdown prose dark:prose-invert wrap-break-word w-full light markdown-new-styling"> <P data-end="324" data-start="0">Based on the current product design and provided documentation, there is no way to create a custom dashboard widget to display a list of enabled analytics rules in XSIAM. Custom widgets are powered by XQL queries, and XSIAM does not currently provide a public dataset that contains the metadata or status of detection rules.</P> <H4 data-end="356" data-start="326" data-section-id="rocoe1">Current Visibility Options:</H4> <P data-end="495" data-start="358">While you cannot create a custom widget for this specific purpose, you can view and manage analytics rules through the following methods:</P> <UL data-is-last-node="" data-is-only-node="" data-end="1084" data-start="497"> <LI data-end="812" data-start="497" data-section-id="6ljttz"> <P data-end="663" data-start="499"><STRONG data-end="524" data-start="499">Analytics Rules Table</STRONG><BR data-end="527" data-start="524" />The primary location to see all enabled and disabled analytics rules is under:&nbsp;<STRONG data-is-only-node="" data-end="661" data-start="612">Detection &gt; Detection Rules &gt; Analytics Rules</STRONG></P> <P data-end="812" data-start="667">In this view, you can see the status of each rule, whether it is <STRONG data-end="743" data-start="732">Enabled</STRONG>, <STRONG data-end="757" data-start="745">Disabled</STRONG>, or <STRONG data-end="784" data-start="762">Pending Activation</STRONG> (due to data soak periods).<BR /><BR /></P> </LI> <LI data-is-last-node="" data-end="1084" data-start="814" data-section-id="1ny4kwd"><STRONG data-end="861" data-start="816">MITRE ATT&amp;CK Framework Coverage Dashboard</STRONG><BR data-end="864" data-start="861" />This predefined dashboard provides high-level counts of analytics rules mapped to the MITRE framework. However, a known design limitation prevents users from clicking these counts to drill down into the specific rules.</LI> </UL> </DIV> </DIV> </DIV> </DIV> </DIV> </DIV> </SECTION> </DIV> </DIV> </DIV> <P>If you feel this has answered your query, please let us know by clicking<SPAN>&nbsp;</SPAN><STRONG>like</STRONG><SPAN>&nbsp;</SPAN>and on&nbsp;<STRONG>"mark this as a Solution".</STRONG></P> <P>&nbsp;</P> <P>Thanks &amp; Regards,<BR />S. Subashkar Sekar</P> Tue, 19 May 2026 14:02:27 GMT susekar 2026-05-19T14:02:27Z https://live.paloaltonetworks.com/t5/cortex-xsiam-discussions/xsiam-analytics-rules-dashboard/m-p/1254198#M405 <P>Is there anyway to create a widget used on a dashboard that shows me all the enabled analytics rules in xsiam?</P> <P>&nbsp;</P> <P><LI-PRODUCT title="Cortex XSIAM" id="Cortex_XSIAM"></LI-PRODUCT>&nbsp;</P> Mon, 18 May 2026 18:22:45 GMT https://live.paloaltonetworks.com/t5/cortex-xsiam-discussions/xsiam-analytics-rules-dashboard/m-p/1254198#M405 bridgetlitt 2026-05-18T18:22:45Z https://live.paloaltonetworks.com/t5/cortex-xsiam-discussions/xsiam-analytics-rules-dashboard/m-p/1254309#M406 <P>Hello&nbsp;<a href="https://live.paloaltonetworks.com/t5/user/viewprofilepage/user-id/710084109">@bridgetlitt</a>&nbsp;,</P> <P>&nbsp;</P> <P>Greetings for the day.</P> <P>&nbsp;</P> <DIV class="qMYqUG_convSearchResultHighlightRoot"> <DIV class="" data-is-intersecting="true" data-turn-id-container="request-WEB:de2c8334-d273-4cc8-97db-40294f60b252-0"> <DIV class="relative w-full overflow-visible"> <SECTION class="text-token-text-primary w-full focus:outline-none has-data-writing-block:pointer-events-none [&amp;:has([data-writing-block])&gt;*]:pointer-events-auto R6Vx5W_threadScrollVars scroll-mb-[calc(var(--scroll-root-safe-area-inset-bottom,0px)+var(--thread-response-height))] scroll-mt-[calc(var(--header-height)+min(200px,max(70px,20svh)))]" dir="auto" data-turn="assistant" data-scroll-anchor="false" data-testid="conversation-turn-2" data-turn-id-container="request-WEB:de2c8334-d273-4cc8-97db-40294f60b252-0" data-turn-id="request-WEB:de2c8334-d273-4cc8-97db-40294f60b252-0"> <DIV class="text-base my-auto mx-auto pb-10 [--thread-content-margin:var(--thread-content-margin-xs,calc(var(--spacing)*4))] @w-sm/main:[--thread-content-margin:var(--thread-content-margin-sm,calc(var(--spacing)*6))] @w-lg/main:[--thread-content-margin:var(--thread-content-margin-lg,calc(var(--spacing)*16))] px-(--thread-content-margin)"> <DIV class="[--thread-content-max-width:40rem] @w-lg/main:[--thread-content-max-width:48rem] mx-auto max-w-(--thread-content-max-width) flex-1 group/turn-messages focus-visible:outline-hidden relative flex w-full min-w-0 flex-col agent-turn"> <DIV class="flex max-w-full flex-col gap-4 grow"> <DIV class="min-h-8 text-message relative flex w-full flex-col items-end gap-2 text-start break-words whitespace-normal outline-none keyboard-focused:focus-ring [.text-message+&amp;]:mt-1" dir="auto" tabindex="0" data-turn-start-message="true" data-message-model-slug="gpt-5-5" data-message-id="a32751bd-b432-4179-8915-9c6cc38cef21" data-message-author-role="assistant"> <DIV class="flex w-full flex-col gap-1 empty:hidden"> <DIV class="markdown prose dark:prose-invert wrap-break-word w-full light markdown-new-styling"> <P data-end="324" data-start="0">Based on the current product design and provided documentation, there is no way to create a custom dashboard widget to display a list of enabled analytics rules in XSIAM. Custom widgets are powered by XQL queries, and XSIAM does not currently provide a public dataset that contains the metadata or status of detection rules.</P> <H4 data-end="356" data-start="326" data-section-id="rocoe1">Current Visibility Options:</H4> <P data-end="495" data-start="358">While you cannot create a custom widget for this specific purpose, you can view and manage analytics rules through the following methods:</P> <UL data-is-last-node="" data-is-only-node="" data-end="1084" data-start="497"> <LI data-end="812" data-start="497" data-section-id="6ljttz"> <P data-end="663" data-start="499"><STRONG data-end="524" data-start="499">Analytics Rules Table</STRONG><BR data-end="527" data-start="524" />The primary location to see all enabled and disabled analytics rules is under:&nbsp;<STRONG data-is-only-node="" data-end="661" data-start="612">Detection &gt; Detection Rules &gt; Analytics Rules</STRONG></P> <P data-end="812" data-start="667">In this view, you can see the status of each rule, whether it is <STRONG data-end="743" data-start="732">Enabled</STRONG>, <STRONG data-end="757" data-start="745">Disabled</STRONG>, or <STRONG data-end="784" data-start="762">Pending Activation</STRONG> (due to data soak periods).<BR /><BR /></P> </LI> <LI data-is-last-node="" data-end="1084" data-start="814" data-section-id="1ny4kwd"><STRONG data-end="861" data-start="816">MITRE ATT&amp;CK Framework Coverage Dashboard</STRONG><BR data-end="864" data-start="861" />This predefined dashboard provides high-level counts of analytics rules mapped to the MITRE framework. However, a known design limitation prevents users from clicking these counts to drill down into the specific rules.</LI> </UL> </DIV> </DIV> </DIV> </DIV> </DIV> </DIV> </SECTION> </DIV> </DIV> </DIV> <P>If you feel this has answered your query, please let us know by clicking<SPAN>&nbsp;</SPAN><STRONG>like</STRONG><SPAN>&nbsp;</SPAN>and on&nbsp;<STRONG>"mark this as a Solution".</STRONG></P> <P>&nbsp;</P> <P>Thanks &amp; Regards,<BR />S. Subashkar Sekar</P> Tue, 19 May 2026 14:02:27 GMT https://live.paloaltonetworks.com/t5/cortex-xsiam-discussions/xsiam-analytics-rules-dashboard/m-p/1254309#M406 susekar 2026-05-19T14:02:27Z