automation for retrieve alerts

[tlmarques]

Hi,

I would like to know if it is possible #Cortex XDR automatically perform "retrieve alert data" and/or "retrieve TSF" for all incidents or alert (critical and high).

I'm asking this because I work with non-persistent VDIs, and many times the user has already closed the session, and I can no longer retrieve the necessary logs for a better analysis.

[aspatil · Accepted solution]

Hello @tlmarques ,

Thanks for reaching out on LiveCommunity!

Enabling the checkbox "Enable Cortex XDR to automatically upload defined alert data files for advanced analysis should help here. This is the same alert data collected when selecting right click + Retrieve Alert Data from the alerts table, with the addition of dumpster analysis on the back end.

https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-Pro-Administrator-Guide/Configure-G...

If you feel this has answered your query, please let us know by clicking on Like and "mark this as a Solution".

[tlmarques]

Yes, I have that configured, thank you.
But sometimes, it seems to me that in some alerts, not all the data shows up...which appears when you download the alert data or TSF....but maybe is my mistake.