Nominated Discussion: Cortex XDR - View Exported Policy Details from Console

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
General Articles
1 min read
Community Team Member
No ratings

This Nominated Discussion Article is based on the post "View exported Policy details from console" by @Shahwaz_Md and responded to by @anlynch. Read on to see the discussion and solution!

 

We have exported all the policies from the console (.export) format but are unable to view them or open them anywhere.

 

Kindly help me view these exported policy details.

When exporting policies or profiles in Cortex XDR they are going to be given a file extension of .export. Using a program like Sublime Text or Notepad++ you can open the documents and see they're Base64 encoded. You can use a variety of tools like Cyberchef or built in windows utilities to decode the Base64. Just so you're aware once decoded the Base64 will be in .JSON format. Depending on the utility you use the format may need to be edited slightly to appear properly.

 

 

Rate this article:
Comments

That is not the case for us. When we base64 decode the data we get gibberish, as if it was encrypted. Any ideas on how to proceed?

L0 Member

Once you base64 decode add an additional operation in Cyberchef by the following name "Zlib inflate". This will clean up the garbled text and make it readable in .JSON format. 

  • 2491 Views
  • 2 comments
  • 1 Likes
Register or Sign-in
Labels
Article Dashboard
Version history
Last Updated:
‎04-27-2023 07:49 AM
Updated by: