Limitations Observed with XQL Custom Widgets and Issue Visibility

[Jai_Prakas]

Hi,

We are facing multiple limitations while creating custom widgets using XQL, which are impacting our dashboard visibility and operational efficiency. The details are outlined below:

1. Auto Refresh Limitation
   When creating a custom widget using XQL, there is no option to configure automatic refresh intervals. Currently, the widget refreshes only once every 24 hours.
   For our environment, we require auto-refresh options such as 1 minute, 5 minutes, 10 minutes, or 1 hour to maintain near real-time visibility.

2. Drill-Down Limitation in XQL Widgets
   While configuring drill-down for a custom XQL widget, we are able to add only one static URL.
   This limits dynamic drill-down behavior based on widget values.

   Example:
   If the widget shows 20 total issues categorized as:

   • 5 Critical

   • 10 Medium

   • 3 High

   • 2 Low

   Clicking on “High” should ideally open a filtered view showing only High-severity issues. However, the drill-down does not redirect to the corresponding issue list based on severity, making the widget less actionable.

3. No Predefined Widget for Issues
   Currently, there is no predefined widget available for Issues, which limits clear and direct visibility of issues on the dashboard. This is a significant gap, especially when compared to the availability of predefined widgets for Cases.

Due to the above constraints, it becomes difficult to achieve real-time monitoring and effective issue-level visibility through the dashboard.

Kindly clarify:

• Whether these limitations are expected behavior

• If there is any workaround available

• Or if there is a product roadmap to address these gaps

Thanks & regards,
Jai Prakash

Cortex XDR 

[susekar]

Hello @Jai_Prakas ,

Greetings for the day!

1. Auto Refresh Limitation

The behavior you observed is a known design limitation of the product.
* Expected Behavior: Custom XQL widgets do not currently support automatic refresh intervals and typically require a manual click of the "Update Now" button to reflect the most recent data.
* Workaround: Currently, there is no configuration to enable real-time auto-refresh for custom widgets. Users must manually refresh the widget or the dashboard.
* Roadmap: There is an active enhancement request being tracked under CRTX-37773 to provide customizable refresh intervals for Custom XQL Widgets.

2. Drill-Down Limitation in XQL Widgets

Custom widgets do not automatically inherit the dynamic, context-aware drill-down capabilities found in predefined system widgets.
* Expected Behavior: While predefined widgets use hard-coded server-side logic to redirect to specific filtered views, custom XQL widgets are limited to the URL configured in the drill-down settings.
* Partial Workaround: You can construct a custom URL that uses dynamic parameters to capture values from the widget's axis. For example, using $x_axis.value or $y_axis.value in your URL string can allow the platform to replace those placeholders with the actual clicked value.
* Syntax Example: https://[TENANT_URL]/endpoints/agents?platform=AGENT_OS_$x_axis.value
* Constraint: This only works if the destination page has a valid URL parameter that accepts the value being passed. If the specific field (like a granular "Issue" attribute) is not exposed as a filterable column on the target page, the navigation will fail or just refresh the current page.

3. No Predefined Widget for Issues

The absence of a predefined widget for "Issues" is consistent with current product findings where specific visualizations for certain datasets are not available out-of-the-box.
* Status: Predefined widgets are typically "hard-coded" for specific use cases (like Cases or Incidents) and cannot be easily modified or cloned into different datasets.
* Workaround: The recommended approach is to continue building custom XQL widgets using the incidents or relevant issue-based datasets to achieve the desired visibility.

Recommendation: For features like the Issues widget or enhanced dynamic drill-down behavior that are not currently supported, it is advised to coordinate with your Account Team or Sales Engineer to submit or upvote a formal Feature Request (FR) 

If you feel this has answered your query, please let us know by clicking like and on "mark this as a Solution".

Happy New year!!

Thanks & Regards,
S. Subashkar Sekar