> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/detect-threats-and-analyze-data/forensic-investigations/data-collection/triage/offline-triage-collection.md). # Offline triage collection The Forensics add-on provides a triage collection option for endpoints with no network connection or no Cortex XDR agent currently installed. Note that the procedure is different for Windows and macOS.
Windows 1. Select **Incident Response** → **Investigation** → **Forensics** → **Forensics Investigations**. 2. Click the investigation link and from the **Collections** tab, find the triage and click the menu options button (![menu\_options\_button.png](/files/iULtKzS9Pu6sKYwQtfrN))/ Depending on the system type of the endpoint, select **Download 32-bit Collector** or **Download 64-bit Collector** . 3. Copy the downloaded file to a destination of which is accessible from the targeted endpoint. 4. From the endpoint, open the folder containing the offline triage collector and right-click on the executable file **cortex-xdr-payload.exe** and select `Run as administrator`. The `cortex-xdr-payload.exe` opens a command window that displays the status of each artifact collection. After the collection is completed, a zip file with the hostname and a timestamp in the file name is created in the same directory as the executable. 5. From the the **Collections** page, select the triage and click the menu options button (![menu\_options\_button.png](/files/iULtKzS9Pu6sKYwQtfrN)) and select **Upload Offline Package**. 6. In the **Import Offline Triage** dialog, browse for or drag and drop the zip file and click **Done**. The triage file is ingested and the results are available for review.

Note

Security software running on the endpoint (including the Cortex agent) can interfere or block the execution of the offline triage collector. Disable any security software on the endpoint while the collector is running or whitelist the collector in your security software before running the offline triage collector.

macOS 1. Select **Incident Response** → **Investigation** → **Forensics** → **Forensics Investigations**. 2. Click the investigation link and from the **Collections** tab, find the triage and click the menu options button (![menu\_options\_button.png](/files/iULtKzS9Pu6sKYwQtfrN)) and select **Download Collector**. 3. Open the folder containing the zip file and run the command `xattr -c <triage_configuration_name>.zip`, to remove any extended attributes that macOS might have applied to the file. 4. Copy the downloaded zip file to a destination of which is accessible from the targeted endpoint. 5. From the endpoint, open the folder containing the offline triage collector and run the **cortex-xdr-payload.exe** file or from a command line, enter: `sudo cortex-xdr-payload`. After the collection is completed, a zip file with the hostname and a timestamp in the file name is created in the same directory as the executable. 6. From the the **Collections** page, select the triage and click the menu options button (![menu\_options\_button.png](/files/iULtKzS9Pu6sKYwQtfrN)) and select **Upload Offline Package**. 7. In the **Import Offline Triage** dialog, browse for or drag and drop the zip file and click **Done**. The triage file is ingested and the results are available for review.

Note

Security software running on the endpoint (including the Cortex agent) can interfere or block the execution of the offline triage collector. Disable any security software on the endpoint while the collector is running or whitelist the collector in your security software before running the offline triage collector.

--- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/detect-threats-and-analyze-data/forensic-investigations/data-collection/triage/offline-triage-collection.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.