Nominated Discussion: Cortex XDR - View Exported Policy Details from Console

[kiwi]

This Nominated Discussion Article is based on the post "View exported Policy details from console" by @Shahwaz_Md and responded to by @anlynch. Read on to see the discussion and solution!

We have exported all the policies from the console (.export) format but are unable to view them or open them anywhere.

Kindly help me view these exported policy details.

When exporting policies or profiles in Cortex XDR they are going to be given a file extension of .export. Using a program like Sublime Text or Notepad++ you can open the documents and see they're Base64 encoded. You can use a variety of tools like Cyberchef or built in windows utilities to decode the Base64. Just so you're aware once decoded the Base64 will be in .JSON format. Depending on the utility you use the format may need to be edited slightly to appear properly.

[PVARELA BATANERO]

That is not the case for us. When we base64 decode the data we get gibberish, as if it was encrypted. Any ideas on how to proceed?

[dsklyar]

Once you base64 decode add an additional operation in Cyberchef by the following name "Zlib inflate". This will clean up the garbled text and make it readable in .JSON format.