topic Cortex XDR Forensics Addon in Cortex XDR Discussions

Cortex XDR Forensics Addon

OrkanAlibayli — Wed, 15 Sep 2021 07:22:28 GMT

Hello everybody.

I have a question about Cortex XDR Forensic addon. When we enable Forensic addon from Agent Settings profile we see "Interval Hours" for each section. But we can not understand what it is. Also we can not find anything about it in any documentation. Can anybody explain this option ("Interval hours") please?

Re: Cortex XDR Forensics Addon

jcandelaria — Wed, 15 Sep 2021 16:21:54 GMT

Hi OrkanAlibayli,

Its basically a timer that you can set to monitor and collect forensic data..

The default is Off which means there is no interval hours of collecting the data. If you put say 24hrs that means it will collect every after 24hrs which means you might missed some data collection within 24hrs which might be vital on your forensic investigation. That's why the default is OFF.

Re: Cortex XDR Forensics Addon

OrkanAlibayli — Thu, 16 Sep 2021 04:50:47 GMT

Thank you very much!