XSIAM Analytics rules Dashboard

[bridgetlitt]

Is there anyway to create a widget used on a dashboard that shows me all the enabled analytics rules in xsiam?

Cortex XSIAM 

[susekar]

Hello @bridgetlitt ,

Greetings for the day.

Based on the current product design and provided documentation, there is no way to create a custom dashboard widget to display a list of enabled analytics rules in XSIAM. Custom widgets are powered by XQL queries, and XSIAM does not currently provide a public dataset that contains the metadata or status of detection rules.

Current Visibility Options:

While you cannot create a custom widget for this specific purpose, you can view and manage analytics rules through the following methods:

• Analytics Rules Table
  The primary location to see all enabled and disabled analytics rules is under: Detection > Detection Rules > Analytics Rules

  In this view, you can see the status of each rule, whether it is Enabled, Disabled, or Pending Activation (due to data soak periods).
  
  

• MITRE ATT&CK Framework Coverage Dashboard
  This predefined dashboard provides high-level counts of analytics rules mapped to the MITRE framework. However, a known design limitation prevents users from clicking these counts to drill down into the specific rules.

If you feel this has answered your query, please let us know by clicking like and on "mark this as a Solution".

Thanks & Regards,
S. Subashkar Sekar