Is partial import of data from a XSOAR instance to another XSOAR instance supported?

[MarcoGianfico]

Hello

a customer I work for is trying to perform a partial import of data from a XSOAR to another instance of the same with same version.

They want a partial import beacause they have not so much resources on the second instance and they just need it to test some things.

But the question is, is it supported?

Should Palo Alto discourage this type of actions?

Thanks

[DougCouch · Accepted solution]

Hi Marco!

This would be similar to "Freeing up space with Dat Archiving" as found here: https://docs.paloaltonetworks.com/cortex/cortex-xsoar/6-2/cortex-xsoar-admin/manage-data/free-up-dis...

XSOAR incident data is stored in folders and data files per month.  If the customer only wants the most recent (or perhaps the oldest) data available you basically remove the folders you don't want and reindex.  It's actually a recommended way to speed up access time and searching.

Hope this helps!

-Doug

[MarcoGianfico]

Thanks Doug! We'll try following that, but can we say that it is official supported by Palo Alto or not?

I mean, is this a workaround or an official procedure.

[DougCouch]

That's an official procedure.  We recommend that clients archive anything over a year's worth of data for best performance.

Thanks!