Manage cloud instances

Learn how to manage, edit, and troubleshoot cloud instances in Cortex Cloud. Monitor connector health, view security capabilities, and investigate errors.

You can manage the cloud instances configured for a CSP on the Data Sources & Integrations page. You can check the status, edit, delete, enable, or disable instances, and initiate discovery scan.

1. Navigate to Settings → Data Sources & Integrations.
2. Find the cloud instance by clicking the CSP name or using the Search field.
3. In the row for the cloud instance, click View Details. The Cloud Instances page is displayed, filtered by the CSP you selected.
4. In the Cloud Instances page, you can filter the results by any heading and value.
5. Click on an instance name to open the details pane for that instance.
6. You can perform the following actions on each cloud instance:

   Action	Instructions
   Discover Now	To initiate a discovery scan, in the row for the cloud instance, right-click and select Discover Now. Alternatively, in the details pane, click the more options icon and select Discover Now.
   Enable/Disable	In the row for the cloud instance, right-click and select Enable or Disable. Alternatively, in the details pane, click the more options icon and select Enable or Disable.
   Delete	In the row for the cloud instance, right-click and select Delete. Alternatively, in the details pane, click the more options icon and select Delete.
   Create a new instance	Click New Instance and select the type of CSP of which you want to create a new instance. Follow the onboarding wizard to define its settings.
   Edit configuration	In the row for the cloud instance, right-click and select Configuration. Alternatively, in the details pane, click the edit button. Follow the onboarding wizard to edit the cloud instance's settings. (Optional) Under Show advanced settings, select Automation and select a log level for the automation integration logs. You must execute the updated template in the CSP environment for the configuration changes to be applied.

Cloud instance details pane

When you click an instance name, the details pane opens and shows the full health and configuration of that connector. The pane has three sections: the cloud instance overview, the Security Capabilities section, and the section that details the instance's resources.

Cloud instance overview

The overview shows the overall status of the instance and the following configuration details:

Field	Description
Status	The overall health of the cloud instance: Connected, Warning, Error, or Disabled.
Scope	The number of accounts onboarded on the cloud instance and their individual statuses.
Scan mode	How Cortex Cloud scans your environment: Cloud Scan (Cortex-managed) or Outpost (customer-managed). For Outpost scan, the Outpost account ID and its status are also shown.
Resource Tags	Any custom tags applied to cloud resources during onboarding.
Pending changes	Displayed when a configuration edit has been saved but the updated template has not yet been redeployed in the cloud environment.
Upgrade available	Displayed when a newer version of the connector template is available.

Cloud instance status values

Status	Meaning
Connected	The cloud instance is enabled and has no issues.
Warning	The cloud instance is enabled and has minor issues. For example, some accounts or capabilities are in Warning or Error status.
Error	The cloud instance is enabled and has substantial errors. For example, an authentication failure, an Outpost failure, major permissions issues, or (for organization-level connectors) the majority of accounts are in Error status.
Disabled	The connector has been manually disabled.

Security capabilities

The Security Capabilities section lists every security capability that is active for this cloud instance, along with its current status. The capabilities shown depend on which ones were enabled during onboarding and on your license.

Status	Meaning
Connected	The capability is running with no issues.
Warning	The capability has minor issues that may affect coverage.
Error	The capability has significant issues that are affecting its function.
Disabled	The capability is not enabled for this connector, or the connector itself is disabled.

Click any capability row that shows a Warning or Error status. The Issues table is displayed. To view the specific errors contributing to the status, click the Errors tab. In the case of Permissions, click the Missing Permissions tab:

• Errors (or Missing Permissions in the case of Permissions) are factual records automatically created when a problem occurs, such as a missing permission or a failed API call. Browse and filter errors to understand the scope and nature of the problem.
• Issues are actionable objects triggered when detected problems exceed defined thresholds. Issues are trackable, include remediation suggestions, and can be assigned and managed. Click an issue to open it and start investigating.

For the Discovery Engine, a Coverage bar is shown alongside the status. This bar gives a proportional view of how many scans succeeded, warned, or failed, so you can see at a glance whether a problem affects a small or large portion of your environment.

Export errors to a file

For the Permissions, Discovery Engine, and Audit Logs capabilities, you can export the errors table to a TSV file. This lets you share, analyze, or track errors outside of Cortex Cloud, such as in a spreadsheet or ticketing system.

To export errors:

1. Click a capability row that shows a Warning or Error status to expand the errors table.
2. Click the Export button in the table toolbar.

The file downloads immediately to your browser's default download location. The filename follows the pattern <capability>_<timestamp>.tsv.

The exported file includes all columns visible in the errors table. For the Permissions and Discovery Engine capabilities, any accounts and regions grouped in the UI view are fully expanded in the export. Rather than appearing as separate entries, accounts and regions are combined into a single comma-separated string within a single row per error. For example, account-1 (region-a, region-b), account-2 (region-c).

Cloud instance resources

The bottom section of the panel lists the individual cloud resources onboarded on this connector and their individual statuses. The section label and terminology depend on the cloud provider:

Cloud provider	Resource term
AWS	Account
GCP	Project
Azure	Subscription
OCI	Compartment
Alibaba Cloud	Account

For cloud instances with multiple resources (for example, organization or organizational unit scope), click an individual entry to filter the Security Capabilities section by that resource. This lets you see which capabilities are failing for a specific account, project, subscription, or compartment rather than across the entire cloud instance.

Investigating errors further

To investigate errors in more depth, run XQL queries against the cloud_health_auditing dataset. This dataset records error and recovery events for each security capability, including when the error started, how frequently it occurs, and whether it has recovered.

Note

Errors related to audit log collection are recorded in the collection_auditing dataset, not cloud_health_auditing.