> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/forensics/forensic-investigations/data-collection/triage.md).
# Triage
Triage enables you to do a in-depth analysis of a specific endpoint to fully understand the activities that occurred on that endpoint. The triage functionality is configurable and supports the collection of all currently supported forensic artifacts, user-defined file paths, a full file listing for all of the connected drives, full event logs, and registry hives. The amount of data collected during a triage can be large, so triages are limited to ten or fewer endpoints per collection.
### **Create a triage**
Use triage collections when a certain activity, group of activities, or the actions of a specific user on that endpoint have been identified, and additional information is required. The triage functionality collects detailed system information, including a full file listing for all of the connected drives, full event logs, and registry hives, to provide you with a complete, holistic picture of an endpoint.
Triage supports data collection from both online and offline hosts, on both Windows and macOS platforms.
1. In the **Triage Collection Name** field, enter a name that will be easy to find in the collections table.
2. Select the **Platform** either Windows, macOS or Linux.
3. In the **Description** field, enter information that is relevant to the collection you are creating .
4. For **Triage Type**, you can select **Offline** or **Online** or both.
5. Select **Offline** to upload archives containing forensic data collected by the Offline Collector. After the archive is uploaded, the data is extracted and ingested into the Forensics tables on the tenant. Import Offline Triage supports uploading packages created on Windows, macOS, and Linux platforms.
6. Click **Save Collection and Exit** or click **Next** to continue.
7. On the **Configuration** page, refer to [Configure Collection](#UUID-40c2a678-467f-35cb-0a75-36c79cdb990b) for information about each artifact.
8. You can select a preset from **Select Presets (Windows/macOS/Linux)** to copy the options for artifacts, volatiles, and file collections from another collection.
You can also click **Save new preset** to save the current collection as a potential triage collection.
9. Click **Save Collection and Exit** or click **Next** to continue.
### **Upload an offline triage package**
The Forensics Triage feature enables you to create a custom, standalone executable package that collects all of the forensic artifacts in the configuration.
Use the **Upload Offline Triage** to upload archives containing forensic data collected by the offline collector. After the archive has been uploaded, the data is extracted and ingested into the forensics table on the tenant. **Upload Offline Triage** supports uploading packages created on both the Windows and macOS platforms..
1. In Cortex Cloud, select **Investigation & Response** → **Forensics**.
2. Click the link of the relevant investigation.
3. When in the **Collections** page, search for or select the triage and click the menu options button () to select **Upload Offline Package**.
4. Drag and drop or use the **browse** link to search for the file. More than one offline triage package can be uploaded at a time.
Note
Do not upload memory images captured by the Offline Triage Collector. These images are collected for analysis using third-party tools and are not intended for upload.
Windows
1. Select **Investigation & Response** → **Forensics**.
2. Click the investigation link and from the **Collections** tab, find the triage and click the menu options button ()/ Depending on the system type of the endpoint, select **Download 32-bit Collector** or **Download 64-bit Collector** .
3. Copy the downloaded file to a location accessible from the targeted endpoint.
4. From the endpoint, open the folder containing the offline triage collector and right-click on the executable file **cortex-xdr-payload.exe** and select `Run as administrator`.
The `cortex-xdr-payload.exe` opens a command window that displays the status of each artifact collection.
After the collection is completed, a zip file with the hostname and a timestamp in the file name is created in the same directory as the executable.
5. From the **Collections** page, select the triage and click the menu options button () and select **Upload Offline Package**.
6. In the **Import Offline Triage** dialog, browse for or drag and drop the zip file, and click **Done**.
The triage file is ingested, and the results are available for review.
Note
Security software running on the endpoint (including the Cortex agent) can interfere with or block the execution of the offline triage collector. Disable any security software on the endpoint while the collector is running, or whitelist the collector in your security software before running the offline triage collector.
macOS
1. Select **Investigation & Response** → **Forensics**.
2. Click the investigation link and from the **Collections** tab, find the triage and click the menu options button () and select **Download Collector**.
3. Open the folder containing the zip file and run the command `xattr -c .zip` to remove any extended attributes that macOS might have applied to the file.
4. Copy the downloaded zip file to a destination that is accessible from the targeted endpoint.
5. From the endpoint, open the folder containing the offline triage collector and run the **cortex-xdr-payload.exe** file, or from a command line, enter: `sudo cortex-xdr-payload`.
After the collection is completed, a zip file with the hostname and a timestamp in the file name is created in the same directory as the executable.
6. From the **Collections** page, select the triage and click the menu options button () and select **Upload Offline Package**.
7. In the **Import Offline Triage** dialog, browse for or drag and drop the zip file, and click **Done**.
The triage file is ingested, and the results are available for review.
Note
Security software running on the endpoint (including the Cortex agent) can interfere with or block the execution of the offline triage collector. Disable any security software on the endpoint while the collector is running, or whitelist the collector in your security software before running the offline triage collector.
Linux
1. Select **Investigation & Response** → **Forensics**.
2. Click the investigation link and from the **Collections** tab, find the triage and click the menu options button () and select **Download x86 Collector** or **Download ARM64 Collector**.
3. Copy the downloaded zip file to a destination that is accessible from the targeted endpoint.
4. From the endpoint, open the folder containing the offline triage collector and run the **cortex-xdr-payload** file, or from a command line, enter: `sudo ./cortex-xdr-payload`.
After the collection is completed, a zip file with the hostname and a timestamp in the file name is created in the same directory as the executable.
5. From the **Collections** page, select the triage and click the menu options button () and select **Upload Offline Package**.
6. In the **Import Offline Triage** dialog, browse for or drag and drop the zip file, and click **Done**.
The triage file is ingested, and the results are available for review.
Note
Security software running on the endpoint (including the Cortex agent) can interfere with or block the execution of the offline triage collector. Disable any security software on the endpoint while the collector is running, or whitelist the collector in your security software before running the offline triage collector.
### **Triage results**
The Triage collection results page provides an overview of the different types of triage collections initiated on an endpoint.
The triage results page is divided into the following tabs:
* **Artifacts**: Display all of the artifact categories collected. Refer to [Hunt Results](#UUID-5c54a9db-994b-a667-2289-38ec445e90ab) for more information on the artifacts.
* **Host Timeline**: Displays a list of normalized, per-host timelines that include multiple forensic artifacts in a single table.
### **Triage status**
You can drill down to the **Actions** table from the status link of the triage to view the search the status of all the artifacts for the triage.
| Field | Description |
| ------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Endpoint name | Agent hostname. |
| Endpoint ID | Agent unique ID. |
| Action ID | Unique identifier for this agent action. |
| Type | Type of collection.
Example: Amcache, File Collection, Event Logs
|
| Path | Path for files, registry path for registry artifacts. |
| Status | Displays one of the following statuses of the search:
- Pending: agent action sent
- In progress: SAM not sent
- Results received: received SAM results
- Timeout: SAM timed out
- Ingesting: Ingestion started
- Uploaded: data received, but not parsed
- Ingested: ingestion completed
- Partially ingested: ingested with errors
- Failed: ingestion failed
|
| Details | Shows the detailed output from the ingestion script.
Example: Ingested X of Y records
|
| Collected | Time the data was collected. |
| Download expiration | Time when bucket data (raw files) is to be deleted. |
| Preset | Name of the triage configuration. |
| Collection Type | Collection type. |
| Triage ID | Unique ID associated with this triage data. |
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/forensics/forensic-investigations/data-collection/triage.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.