09-09-2022 12:38 AM - edited 09-09-2022 01:12 AM
Hi @Aiman_Fathima ,
Thank you for writing out to live community!
Assuming you are using Cortex XDR agent 7.8.0 to enable this feature. The TSF will first be a zipped file containing the encrypted log file and another _CRYPTO-INFO file. Open the _CRYPTO-INFO file and copy the data after password= (Screenshot attached).
Method 1: Go to Cortex XDR Action Center, choose the support file retrieval action for that endpoint, and right click >Additional Data. A new dialog box appears with the agent details. Right Click on agent details row>Generate support File Password. Paste the password copied from the _CRYPTO-INFO file and a new password will be generated. Copy the unencrypted password and open the zip log file and enter the password.
Method 2: Go to Cortex XDR Endpoints> All Endpoints> At the top click on the key icon and select Retrieve Support File password.
Paste the password copied from the _CRYPTO-INFO file and a new password will be generated. Copy the unencrypted password and open the zip log file and enter the password.
Hope this helps
