> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/data-management.md). # Data Management - [Broker VM](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/data-management/broker-vm.md): Deploy and manage Broker VM for secure data collection and connectivity. - [What is the Broker VM?](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/data-management/broker-vm/what-is-the-broker-vm.md): Learn how Broker VM securely connects Cortex Cloud to your environment. - [Set up and configure Broker VM](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/data-management/broker-vm/set-up-and-configure-broker-vm.md): Set up and configure Broker VM for data collection and integrations. - [Broker VM image installations](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/data-management/broker-vm/set-up-and-configure-broker-vm/broker-vm-image-installations.md): Install Broker VM images on supported cloud and virtualization platforms. - [Set up Broker VM on Alibaba Cloud](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/data-management/broker-vm/set-up-and-configure-broker-vm/broker-vm-image-installations/set-up-broker-vm-on-alibaba-cloud.md): Deploy Broker VM on Alibaba Cloud using a supported image. - [Set up Broker VM on Amazon Web Services](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/data-management/broker-vm/set-up-and-configure-broker-vm/broker-vm-image-installations/set-up-broker-vm-on-amazon-web-services.md): Deploy Broker VM on Amazon Web Services using a supported image. - [Set up Broker VM on Google Cloud Platform (GCP)](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/data-management/broker-vm/set-up-and-configure-broker-vm/broker-vm-image-installations/set-up-broker-vm-on-google-cloud-platform-gcp.md): Deploy Broker VM on Google Cloud Platform using a supported image. - [Set up Broker VM on KVM using Ubuntu](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/data-management/broker-vm/set-up-and-configure-broker-vm/broker-vm-image-installations/set-up-broker-vm-on-kvm-using-ubuntu.md): Deploy Broker VM on KVM hosts running Ubuntu. - [Set up Broker VM on Microsoft Azure](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/data-management/broker-vm/set-up-and-configure-broker-vm/broker-vm-image-installations/set-up-broker-vm-on-microsoft-azure.md): Deploy Broker VM on Microsoft Azure using a supported image. - [Set up Broker VM on Microsoft Hyper-V](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/data-management/broker-vm/set-up-and-configure-broker-vm/broker-vm-image-installations/set-up-broker-vm-on-microsoft-hyper-v.md): Deploy Broker VM on Microsoft Hyper-V using a supported image. - [Set up Broker VM on Nutanix Hypervisor](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/data-management/broker-vm/set-up-and-configure-broker-vm/broker-vm-image-installations/set-up-broker-vm-on-nutanix-hypervisor.md): Deploy Broker VM on Nutanix Hypervisor using a supported image. - [Set up Broker VM on VMware ESXi using vSphere Client](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/data-management/broker-vm/set-up-and-configure-broker-vm/broker-vm-image-installations/set-up-broker-vm-on-vmware-esxi-using-vsphere-client.md): Deploy Broker VM on VMware ESXi using the vSphere Client. - [Broker VM data collector applets](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/data-management/broker-vm/set-up-and-configure-broker-vm/broker-vm-data-collector-applets.md): Learn about data collector applets that run on Broker VM. - [Manage Broker VM](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/data-management/broker-vm/manage-broker-vm.md): Manage Broker VM configuration, maintenance, monitoring, and clustering. - [Edit Broker VM Configuration](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/data-management/broker-vm/manage-broker-vm/edit-broker-vm-configuration.md): Update Broker VM configuration settings for your environment. - [Increase Broker VM storage allocated for data caching](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/data-management/broker-vm/manage-broker-vm/increase-broker-vm-storage-allocated-for-data-caching.md): Increase Broker VM storage available for cached data. - [Monitor Broker VM using Prometheus](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/data-management/broker-vm/manage-broker-vm/monitor-broker-vm-using-prometheus.md): Monitor Broker VM metrics with Prometheus. - [Collect Broker VM Logs](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/data-management/broker-vm/manage-broker-vm/collect-broker-vm-logs.md): Collect Broker VM logs for troubleshooting and support. - [Upgrade Broker VM](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/data-management/broker-vm/manage-broker-vm/upgrade-broker-vm.md): Upgrade Broker VM to the latest supported version. - [Update Broker VM applets independently](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/data-management/broker-vm/manage-broker-vm/update-broker-vm-applets-independently.md): Update Broker VM data collector applets independently of the VM image. - [Import Broker VM Configuration](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/data-management/broker-vm/manage-broker-vm/import-broker-vm-configuration.md): Import an existing configuration into Broker VM. - [Open Live Terminal](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/data-management/broker-vm/manage-broker-vm/open-live-terminal.md): Open a Live Terminal session on Broker VM. - [Add Broker VM to cluster](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/data-management/broker-vm/manage-broker-vm/add-broker-vm-to-cluster.md): Add a Broker VM node to a high availability cluster. - [Switchover Primary Node in Cluster](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/data-management/broker-vm/manage-broker-vm/switchover-primary-node-in-cluster.md): Switch the primary node in a Broker VM high availability cluster. - [Remove from Cluster](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/data-management/broker-vm/manage-broker-vm/remove-from-cluster.md): Remove a Broker VM node from its high availability cluster. - [Manage Broker VM data collector applets](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/data-management/broker-vm/manage-broker-vm-data-collector-applets.md): Manage data collector applets installed on Broker VM. - [Broker VM High Availability Cluster](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/data-management/broker-vm/broker-vm-high-availability-cluster.md): Use Broker VM high availability clusters for resilient data collection. - [Configure High Availability Cluster](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/data-management/broker-vm/broker-vm-high-availability-cluster/configure-high-availability-cluster.md): Configure a high availability cluster for Broker VM. - [Manage Broker VM clusters](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/data-management/broker-vm/broker-vm-high-availability-cluster/manage-broker-vm-clusters.md): Manage Broker VM high availability clusters and their members. - [View cluster details](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/data-management/broker-vm/broker-vm-high-availability-cluster/manage-broker-vm-clusters/view-cluster-details.md): View status, configuration, and members for a Broker VM cluster. - [Edit cluster](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/data-management/broker-vm/broker-vm-high-availability-cluster/manage-broker-vm-clusters/edit-cluster.md): Edit the configuration of a Broker VM cluster. - [Add applet to cluster](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/data-management/broker-vm/broker-vm-high-availability-cluster/manage-broker-vm-clusters/add-applet-to-cluster.md): Add a data collector applet to a Broker VM cluster. - [Add Broker VM to cluster](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/data-management/broker-vm/broker-vm-high-availability-cluster/manage-broker-vm-clusters/add-broker-vm-to-cluster.md): Add a Broker VM node to a high availability cluster. - [Remove cluster](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/data-management/broker-vm/broker-vm-high-availability-cluster/manage-broker-vm-clusters/remove-cluster.md): Remove a Broker VM high availability cluster. - [Broker VM notifications](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/data-management/broker-vm/broker-vm-notifications.md): Configure and review Broker VM notifications. - [Monitor Broker VM activity](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/data-management/broker-vm/monitor-broker-vm-activity.md): Monitor Broker VM activity and operational status. - [Troubleshoot Broker VM applet errors](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/data-management/broker-vm/troubleshoot-broker-vm-applet-errors.md): Troubleshoot errors reported by Broker VM data collector applets. - [Dataset management](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/data-management/dataset-management.md): Learn more about managing your datasets and understanding your overall data storage, period-based retention. - [What are datasets?](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/data-management/dataset-management/what-are-datasets.md): Learn how to import, delete, and interact with custom or third-party datasets in Cortex Cloud. - [Lookup datasets](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/data-management/dataset-management/lookup-datasets.md): Learn more about lookup datasets to correlate data from a data source with events in your environment. - [Import a lookup dataset](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/data-management/dataset-management/lookup-datasets/import-a-lookup-dataset.md): Import a lookup dataset for correlating data in Cortex Cloud. - [Download JSON file of lookup dataset](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/data-management/dataset-management/lookup-datasets/download-json-file-of-lookup-dataset.md): Download lookup dataset contents as a JSON file. - [Set time to live for lookup datasets](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/data-management/dataset-management/lookup-datasets/set-time-to-live-for-lookup-datasets.md): Set how long lookup dataset entries remain available. - [Monitor datasets and dataset views activity](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/data-management/dataset-management/monitor-datasets-and-dataset-views-activity.md): Learn more about the monitored Cortex Cloud datasets and dataset views activities. - [Manage Event Forwarding](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/data-management/manage-event-forwarding.md): Save your ingested, parsed data in an external location by exporting your event logs to a temporary GCP storage bucket. - [Upload to a temporary GCP storage bucket](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/data-management/manage-event-forwarding/upload-to-a-temporary-gcp-storage-bucket.md): Save your ingested, parsed data in an external location by exporting your event logs to a temporary GCP storage bucket. - [Endpoints Event Forwarding - included/excluded fields by event type](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/data-management/manage-event-forwarding/endpoints-event-forwarding-includedexcluded-fields-by-event-type.md): Learn more about the included/excluded fields by event type for Endpoint Event Forwarding in Cortex Cloud. - [Manage compute units](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/data-management/manage-compute-units.md): Learn more about managing and tracking your compute units usage for API and Cold Storage XQL queries. - [Compute units usage](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/data-management/manage-compute-units/compute-units-usage.md): Learn more about how to compute units CU) works according to your license and available options after reaching your quota. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/data-management.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.