Feature Request – Add ability to capture memory dump

Showing results for 
Show  only  | Search instead for 
Did you mean: 
Please sign in to see details of an important advisory in our Customer Advisories area.

Feature Request – Add ability to capture memory dump

L0 Member

During a recent investigation our team came across a situation where we needed to take a forensic image of a device on our network. Prior to taking the image, we had hoped to utilize Live Terminal in order to remotely capture a memory dump to get a head start on our investigation.  Unfortunately, we ran into several limitations including the file size limitation for downloading files via Live Terminal (500 MB I believe). From an analysis and response perspective, it would be ideal if the XDR Agent had the ability to capture memory dumps on its own. Secondarily, it would also be nice to increase or have the file download option adjustable.

The only way around the limitation would be to develop a customized script and upload it to the XDR script repository within the action center. Has anyone else within the community came across this scenario or have a better idea? Any other suggestions would be appreciated! Thanks in advance.


L4 Transporter

Hi @lmschander,


It's unfortunate to hear about the troubles encountered while collecting a memory dump.


XDR Version 2.1, released in February 2020, implemented the capability to collect the contents of memory. You can read about that release here, and the instructions to enable it are here.


As for downloading files greater than 500MB in size, I'd recommend using a file splitting tool like 7Zip to get the job done. Once split (how to split a file using 7zip,) you can use the File Retrieval feature in the Action Center. You can select up to twenty at a time, which, I hope, is helpful to you.


Finally, as for submitting feature requests, your Palo Alto Networks Account or Customer Success teams are waiting to receive that feedback. Please do not delay in getting your suggestions to them!

Visit our Cortex XDR Customer Corner on Live Community to access resources for your product journey, engage in discussions with community members and subject matter experts, and register for upcoming events!

*Cortex XDR Customer Corner: https://live.paloaltonetworks.com/t5/cortex-xdr-customer-corner/ct-p/Cortex_XDR_Customer_Corner

Join our Cortex XDR Office Hours to receive live guidance and training from our Customer Success Architects.

*Cortex XDR Office Hours [NAM]: https://paloaltonetworks.zoom.us/webinar/register/3316669859020/WN_yMpAB-aBTt6xk2h-gsra4w
*Cortex XDR Office Hours [EMEA/APAC]: https://paloaltonetworks.zoom.us/webinar/register/4116709604301/WN_CZuFE5CHQbG9LUEqugsIOw
  • 1 replies
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!