XDR Alert Dump – Finding the File That Triggered the Alert

tlmarques — Thu, 27 Aug 2026 16:55:31 GMT

I have a question.

When we perform a Dump Alert and get the ZIP file, how can we analyze it in more detail?

For example, if I want to see the .ps1 file that a particular user executed on the machine and that triggered the alert, would that file be included in the dump?

I’ve already searched everywhere, but I can’t find it. I can see a folder called “RecentFiles”, but all the files have strange names, so I’m not sure how to identify them.

Does anyone know how we can analyze the dump in more detail?

I was able to download the Alert Dump, but I couldn’t find the PowerShell script that was executed. I’d like to understand whether the actual file/script that triggered the alert should be included in the dump and, if so, how I can identify it.

Re: XDR Alert Dump – Finding the File That Triggered the Alert

tlmarques — Thu, 27 Aug 2026 16:57:13 GMT

the alert is:

topic Re: XDR Alert Dump – Finding the File That Triggered the Alert in Cortex XDR Discussions

XDR Alert Dump – Finding the File That Triggered the Alert

Re: XDR Alert Dump – Finding the File That Triggered the Alert