> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/detect-threats-and-analyze-data/forensic-investigations/data-collection/triage/create-a-triage.md).

# Create a triage

Use triage collections when a certain activity, group of activities, or the actions of a specific user on that endpoint have been identified, and additional information is required. The triage functionality collects detailed system information, including a full file listing for all of the connected drives, full event logs, and registry hives, to provide you with a complete, holistic picture of an endpoint.

Triage supports data collection from both online and offline hosts, on both Windows and macOS platforms.

1. In the **Triage Collection Name** field, enter a name that will be easy to find in the collections table.
2. Select the **Platform** either Windows or macOS.
3. In the **Description** field, enter information that is relevant to the collection you are creating .
4. For **Triage Type**, you can select **Offline** or **Online** or both.
5. Select **Offline** to upload archives containing forensic data collected by the Offline Collector. After the archive has been uploaded, the data is extracted and ingested into the Forensics tables on the tenant. Import Offline Triage supports uploading packages created on both the Windows and macOS platforms.
6. Click **Save Collection and Exit** or click **Next** to continue.
7. In the configuration page, select the options from the **Artifacts**, **Volatiles** and **File Collection** list.

   You can click **Add Custom** to add your own file to the File Collections.
8. You can select a preset from **Select Presets (Windows/macOS)** to copy the options of artifacts, volatiles and file collections from another collection.

   You can also click **Save new preset** to save the options of the current collection for prospective triage collections to use.
9. Click **Save Collection and Exit** or click **Next** to continue.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/detect-threats-and-analyze-data/forensic-investigations/data-collection/triage/create-a-triage.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.