Feature Request – Add ability to capture memory dump

lmschander — Mon, 16 Nov 2020 19:20:34 GMT

During a recent investigation our team came across a situation where we needed to take a forensic image of a device on our network. Prior to taking the image, we had hoped to utilize Live Terminal in order to remotely capture a memory dump to get a head start on our investigation. Unfortunately, we ran into several limitations including the file size limitation for downloading files via Live Terminal (500 MB I believe). From an analysis and response perspective, it would be ideal if the XDR Agent had the ability to capture memory dumps on its own. Secondarily, it would also be nice to increase or have the file download option adjustable.

The only way around the limitation would be to develop a customized script and upload it to the XDR script repository within the action center. Has anyone else within the community came across this scenario or have a better idea? Any other suggestions would be appreciated! Thanks in advance.

Re: Feature Request – Add ability to capture memory dump

gjenkins — Fri, 11 Dec 2020 19:48:27 GMT

Hi @lmschander,

It's unfortunate to hear about the troubles encountered while collecting a memory dump.

XDR Version 2.1, released in February 2020, implemented the capability to collect the contents of memory. You can read about that release here, and the instructions to enable it are here.

As for downloading files greater than 500MB in size, I'd recommend using a file splitting tool like 7Zip to get the job done. Once split (how to split a file using 7zip,) you can use the File Retrieval feature in the Action Center. You can select up to twenty at a time, which, I hope, is helpful to you.

Finally, as for submitting feature requests, your Palo Alto Networks Account or Customer Success teams are waiting to receive that feedback. Please do not delay in getting your suggestions to them!

topic Feature Request – Add ability to capture memory dump in Cortex XDR Discussions

Feature Request – Add ability to capture memory dump

Re: Feature Request – Add ability to capture memory dump