topic Re: Xsoar: Retrieve file which has been quarantined by Cortex XDR in Cortex XSOAR Discussions https://live.paloaltonetworks.com/t5/cortex-xsoar-discussions/xsoar-retrieve-file-which-has-been-quarantined-by-cortex-xdr/m-p/413185#M238 <P>Hi,<BR />Please submit a support case with the logs attached,<BR />thanks.</P> Tue, 15 Jun 2021 08:33:34 GMT gfilippov 2021-06-15T08:33:34Z Xsoar: Retrieve file which has been quarantined by Cortex XDR https://live.paloaltonetworks.com/t5/cortex-xsoar-discussions/xsoar-retrieve-file-which-has-been-quarantined-by-cortex-xdr/m-p/406225#M219 <P>Hello Guys,</P><P>&nbsp;</P><P>I'm trying to retrieve a file that has been quarantined by Cortex XDR using an XSOAR playbook. I trace the Action ID in XDR but I always find it failing. However, it's always working for non-quarantined files.&nbsp;</P><P>&nbsp;</P><P>I need to retrieve the file in order to detonate it using Hybrid Analysis. Is this possible?</P> Tue, 11 May 2021 21:11:58 GMT https://live.paloaltonetworks.com/t5/cortex-xsoar-discussions/xsoar-retrieve-file-which-has-been-quarantined-by-cortex-xdr/m-p/406225#M219 Helmi-Jeddy 2021-05-11T21:11:58Z Re: Xsoar: Retrieve file which has been quarantined by Cortex XDR https://live.paloaltonetworks.com/t5/cortex-xsoar-discussions/xsoar-retrieve-file-which-has-been-quarantined-by-cortex-xdr/m-p/413185#M238 <P>Hi,<BR />Please submit a support case with the logs attached,<BR />thanks.</P> Tue, 15 Jun 2021 08:33:34 GMT https://live.paloaltonetworks.com/t5/cortex-xsoar-discussions/xsoar-retrieve-file-which-has-been-quarantined-by-cortex-xdr/m-p/413185#M238 gfilippov 2021-06-15T08:33:34Z