topic automation for retrieve alerts in Cortex XDR Discussions

automation for retrieve alerts

tlmarques — Fri, 19 Jul 2024 16:55:25 GMT

Hi,

I would like to know if it is possible #Cortex XDR automatically perform "retrieve alert data" and/or "retrieve TSF" for all incidents or alert (critical and high).

I'm asking this because I work with non-persistent VDIs, and many times the user has already closed the session, and I can no longer retrieve the necessary logs for a better analysis.

Re: automation for retrieve alerts

aspatil — Tue, 23 Jul 2024 09:29:43 GMT

Hello @tlmarques ,

Thanks for reaching out on LiveCommunity!

Enabling the checkbox "Enable Cortex XDR to automatically upload defined alert data files for advanced analysis should help here. This is the same alert data collected when selecting right click + Retrieve Alert Data from the alerts table, with the addition of dumpster analysis on the back end.

https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-Pro-Administrator-Guide/Configure-Global-Agent-Settings

If you feel this has answered your query, please let us know by clicking on Like and "mark this as a Solution".

Re: automation for retrieve alerts

tlmarques — Tue, 23 Jul 2024 12:27:16 GMT

Yes, I have that configured, thank you.
But sometimes, it seems to me that in some alerts, not all the data shows up...which appears when you download the alert data or TSF....but maybe is my mistake.