> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/investigate-endpoints/retrieve-support-logs-from-an-endpoint.md).

# Retrieve support logs from an endpoint

When you need to investigate or share additional forensic data, you can initiate a request to retrieve all the support logs and issue data dump files from an endpoint. After Cortex Cloud receives the logs, you can download the log files or generate a secured link to access them on the Cortex Cloud server.

### How to retrieve support files

1. Retrieve support files.

   1. Go to Investigation & Response → Response → Action Center → **+ New Action**.
   2. Select **Retrieve Support File** and click **Next**.
   3. Select the target endpoints (up to 10) from which you want to retrieve logs and click **Next**.
   4. Review the action summary and click **Done**.

      In the next heartbeat, the agent will retrieve the request to package and send all logs to Cortex Cloud .

   You can also retrieve support files from the **All Endpoints** table by right-clicking and selecting **Endpoint Control** → **Retrieve Support File**.
2. In the **Action Center**, locate your **Support File Retrieval** action type and wait for the **Status** field to display **Completed Successfully**.

   If you need to cancel the action, you can right-click it and select **Cancel for pending endpoint**. You can cancel the retrieval action only if the endpoint is still in `Pending` status and no files have been retrieved from it yet. The cancellation does not affect endpoints that are already in the process of retrieving files.
3. When the status is **Completed Successfully**, right-click and select **Additional data**.

   In the **Actions** table, you can see the endpoints from which support files were retrieved.
4. Select an endpoint, right-click and select either **Download files** or **Generate support file link**.

   Cortex Cloud retains retrieved files for up to 30 days.

   The secured link is valid for only 7 days. Following the 7 day period, in order to access the files, you will need to initiate a new support file link.

   To open the file you will need the support file password. For more information, see [Retrieve support file password](/cortex-cloud-runtime-security/endpoint-security/install-and-manage-endpoints/manage-endpoint-protection/retrieve-support-file-password.md).


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/investigate-endpoints/retrieve-support-logs-from-an-endpoint.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.