A CISO has asked an engineer to create a custom dashboard in Cortex XSIAM that can be filtered to show incidents assigned to a specific user. Which feature should be used to filter the incident data in the dashboard?

To create a custom dashboard that can be dynamically filtered by an end-user, the correct feature is "Filters and inputs." This functionality allows an engineer to add interactive controls, such as dropdown menus or text boxes, directly onto the dashboard canvas. These inputs can then be configured to filter the data displayed in the dashboard's widgets based on user selection. For the CISO's request, an input could be created to select a specific user, which would then filter all relevant widgets to show only incidents assigned to that individual.

B. Report template to set the incident user filter: Report templates are used for generating static or scheduled reports, not for creating interactive, real-time filterable dashboards.
C. Visualization filter options in the widget configuration: This sets a static filter within a single widget's configuration and is not an interactive filter for the entire dashboard.
D. Incident summary view to filter by user: The incident summary view is a standard, pre-built interface, not a custom dashboard as specified in the CISO's request.

1. Palo Alto Networks, Cortex XSIAM Administrator's Guide: In the section "Create and Manage Dashboards and Reports," the sub-section "Add an Input to a Dashboard" explicitly details this capability. It states, "You can add inputs to your dashboards to enable you to filter the data displayed in the dashboard widgets." This directly supports the use of inputs for user-driven filtering. (Reference: Cortex XSIAM Administrator's Guide > Dashboards and Reports > Create and Manage Dashboards and Reports > Add an Input to a Dashboard).