Retrieve Files from an Endpoint

Log in to Cortex XDR.
Go to
Response
Action Center
+ New Action
.
Select
Files Retrieval
and click
Next
.
Select the operating system and enter the paths for the files you want to retrieve, pressing
ADD
after each completed path.

You cannot define a path using environment variables on Mac and Linux endpoints.
Click
Next
.
Select the target endpoints (up to 10) from which you want to retrieve files.
If needed,
Filter
the list of endpoints. For more information, refer to Filter Page Results.
Click
Next
.
Review the action summary and click
Done
when finished.
To track the status of a files retrieval action, return to the
Action Center
. Cortex XDR retains retrieved files for up to 30 days.
If at any time you need to cancel the action, you can right-click it and select
Cancel for pending endpoint
. You can cancel the retrieval action only if the endpoint is still in
Pending
status and no files have been retrieved from it yet. The cancellation does not affect endpoints that are already in the process of retrieving files.
To view additional data and download the retrieved files, right-click the action and select
Additional data
.
This view displays all endpoints from which files are being retrieved, including their
IP Address
,
Status
, and
Additional Data
such as error messages of names of files that were not retrieved.
When the action status is
Completed Successfully
, you can right-click the action and download the retrieved files logs.
Cortex XDR retains retrieved files for up to 30 days.