Support file data protection

[Aiman_Fathima]

Hi, 

To generate the support file from the endpoint, the zip file is now password protected by an encrypted password. How do we use this feature? As currenlty when we retrieve the support file it does not ask us for a password 

[neelrohit]

Hi @Aiman_Fathima ,

Thank you for writing out to live community!

Assuming you are using Cortex XDR agent 7.8.0 to enable this feature. The TSF will first be a zipped file containing the encrypted log file and another _CRYPTO-INFO file. Open the _CRYPTO-INFO file and copy the data after password= (Screenshot attached). 

Method 1: Go to Cortex XDR Action Center, choose the support file retrieval action for that endpoint, and right click >Additional Data. A new dialog box appears with the agent details. Right Click on agent details row>Generate support File Password. Paste the password copied from the _CRYPTO-INFO file and a new password will be generated. Copy the unencrypted password and open the zip log file and enter the password. 

Method 2: Go to Cortex XDR Endpoints> All Endpoints> At the top click on the key icon and select Retrieve Support File password. 

Paste the password copied from the _CRYPTO-INFO file and a new password will be generated. Copy the unencrypted password and open the zip log file and enter the password. 

Hope this helps

[Aiman_Fathima]

Hi,

Thank you.

Currently when we are downloading the support file we do not get _CRYPTO-INFO file. We can open it without a password. Do we have to enable/change settings for this to happen?  

[creddy]

Hi @Aiman_Fathima ,
This feature is supported for agent versions with 7.8 and above only.
Please upgrade your agent to the 7.8 version and verify to get benefit of this feature.
Refer retrieve-support-file-password  for more details.
I hope that answers your query.

If this reply found helpful, please mark it as solution.
Thank you!