topic Re: Is partial import of data from a XSOAR instance to another XSOAR instance supported? in Cortex XSOAR Discussions

Is partial import of data from a XSOAR instance to another XSOAR instance supported?

MarcoGianfico — Tue, 21 Sep 2021 08:27:47 GMT

Hello

a customer I work for is trying to perform a partial import of data from a XSOAR to another instance of the same with same version.

They want a partial import beacause they have not so much resources on the second instance and they just need it to test some things.

But the question is, is it supported?

Should Palo Alto discourage this type of actions?

Thanks

Re: Is partial import of data from a XSOAR instance to another XSOAR instance supported?

DougCouch — Tue, 21 Sep 2021 14:48:41 GMT

Hi Marco!

This would be similar to "Freeing up space with Dat Archiving" as found here: https://docs.paloaltonetworks.com/cortex/cortex-xsoar/6-2/cortex-xsoar-admin/manage-data/free-up-disc-space-with-data-archiving

XSOAR incident data is stored in folders and data files per month. If the customer only wants the most recent (or perhaps the oldest) data available you basically remove the folders you don't want and reindex. It's actually a recommended way to speed up access time and searching.

Hope this helps!

-Doug

Re: Is partial import of data from a XSOAR instance to another XSOAR instance supported?

MarcoGianfico — Tue, 21 Sep 2021 15:48:28 GMT

Thanks Doug! We'll try following that, but can we say that it is official supported by Palo Alto or not?

I mean, is this a workaround or an official procedure.

Re: Is partial import of data from a XSOAR instance to another XSOAR instance supported?

DougCouch — Tue, 21 Sep 2021 16:12:50 GMT

That's an official procedure. We recommend that clients archive anything over a year's worth of data for best performance.

Thanks!