Is partial import of data from a XSOAR instance to another XSOAR instance supported?

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements

Is partial import of data from a XSOAR instance to another XSOAR instance supported?

L1 Bithead

Hello

a customer I work for is trying to perform a partial import of data from a XSOAR to another instance of the same with same version.

They want a partial import beacause they have not so much resources on the second instance and they just need it to test some things.

 

But the question is, is it supported?

Should Palo Alto discourage this type of actions?

 

Thanks

1 accepted solution

Accepted Solutions

L2 Linker

Hi Marco!

 

This would be similar to "Freeing up space with Dat Archiving" as found here: https://docs.paloaltonetworks.com/cortex/cortex-xsoar/6-2/cortex-xsoar-admin/manage-data/free-up-dis...

 

XSOAR incident data is stored in folders and data files per month.  If the customer only wants the most recent (or perhaps the oldest) data available you basically remove the folders you don't want and reindex.  It's actually a recommended way to speed up access time and searching.

 

Hope this helps!

-Doug

Doug Couch  |  XSOAR Customer Success Engineer - Manager
Palo Alto Networks  |  3000 Tannery Way  |  Santa Clara, CA 95054  

View solution in original post

3 REPLIES 3

L2 Linker

Hi Marco!

 

This would be similar to "Freeing up space with Dat Archiving" as found here: https://docs.paloaltonetworks.com/cortex/cortex-xsoar/6-2/cortex-xsoar-admin/manage-data/free-up-dis...

 

XSOAR incident data is stored in folders and data files per month.  If the customer only wants the most recent (or perhaps the oldest) data available you basically remove the folders you don't want and reindex.  It's actually a recommended way to speed up access time and searching.

 

Hope this helps!

-Doug

Doug Couch  |  XSOAR Customer Success Engineer - Manager
Palo Alto Networks  |  3000 Tannery Way  |  Santa Clara, CA 95054  

Thanks Doug! We'll try following that, but can we say that it is official supported by Palo Alto or not?

I mean, is this a workaround or an official procedure.

L2 Linker

That's an official procedure.  We recommend that clients archive anything over a year's worth of data for best performance.

 

Thanks!

 

Doug Couch  |  XSOAR Customer Success Engineer - Manager
Palo Alto Networks  |  3000 Tannery Way  |  Santa Clara, CA 95054  
  • 1 accepted solution
  • 3011 Views
  • 3 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!