> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/generic-on-premise-data-collectors/broker-vm-data-collector-applets/activate-csv-collector.md). # Activate CSV Collector {% hint style="info" %} **License** * Requires a Data Collection add-on. * This data source is only available in your tenant if the tenant was activated before October 1, 2025 with an active Data Collection add-on. {% endhint %} The Broker VM provides a CSV Collector applet that enables you to monitor and collect CSV (comma-separated values) log files from a shared Windows directory directly to your log repository for query and visualization purposes. After you activate the CSV Collector applet on a Broker VM in your network, you can ingest CSV files as datasets by defining the list of folders mounted to the Broker VM and setting the list of CSV files to monitor and upload to Cortex XDR using a username and password. ### Prerequisite * [Set up and configure Broker VM](/cortex-xdr-5.x/configure-cortex-xdr/data-management/broker-vm/set-up-and-configure-broker-vm.md). * Ensure that you share the applicable CSV files. * Know the complete file path for the Windows directory. ### How to activate the CSV Collector 1. Select Settings → Configurations → Data Broker → Broker VMs. 2. Do one of the following: * On the Brokers tab, find the Broker VM, and in the APPS column, left-click Add → CSV Collector. * On the Clusters tab, find the Broker VM, and in the APPS column, left-click Add → CSV Collector. 3. Configure your CSV Collector by defining the list of folders mounted to the Broker VM and specifying the list of CSV files to monitor and upload to Cortex XDR. You must also specify a username and password. * **Mounted Folders:** Define the folders mounted onto the Broker VM: Define the folders mounted onto the Broker VM: | Field | Description | | ----------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Folder Path | Specify the complete file path to the Windows directory containing the shared CSV files using the format: `//host/`. For example, `//testenv1pc10/CSVFiles`. | | Username | Specify the username for accessing the Windows directory. | | Password | Specify the password for accessing the Windows directory. | After you configure the mounted folder details, Add (![plus\_sign\_add\_icon.png](data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAACIAAAAhCAYAAAC803lsAAAACXBIWXMAAA7EAAAOxAGVKw4bAAAAB3RJTUUH5QMHChgFr8yL+AAAArtJREFUWIXNmD9MGmEYxh+Rip7hQLjUNtbURGs6lMHc4EhjaLqVuaN26VYT2xLaVTuxkNTBoelGVzVpUlsXNA5NJEfQkIZIQkNB+VcLZw4FzNvBwImicoel99vuz/fl+Z773rvnvQ4iImgAfbM3Fg6Psbydh39HhJCQEMuVsF+sAAD6evQYsnZhbICBfcSIJw9MYLs7FQnpuMqRrd0ivP40Pn7PwmkzwzHKgh9kMMwZYGFO1vFbqiCaPUIgLmE1UsDS1h9MjnN4Yb8J2+2e5pTQJcwsxol1CTS7kqTMQfmyW+vIHJRpdiVJJpdAM4vxpsY0FBJKSsR7wjTliykS0EjQlC9GvCdMoaSkTMhaVCSLO0jz62nVAs4yv54miztIa1GxOSGhpEQWd5B8gdy1iajiC+TI4g5e6EydEN4TvlYnzjK/nibeE254rVY1L5d+YV86xoendxWVnVKeffqJPqYTHued81UTSkpkcgktbcxmyRyUiXUJ5x6RDgC8/jReTfSD6236/aYarleP1xP98PrT9RfyxQrppjfb4sZpV3TTm5QvVmRHlrfzcNrMbXHjtCtOmxnL2/naOZ1/R4RjlG2biCqOURb+HVEWIiQk8IOMqsnefdtDSiyrGssPMhASkiwklithmDOomqwVhjkDYrmSLGS/WKl9RduJhdHXYgSgII9USYllPHwfwY/UIQDg7ecEAODL83t4fL+FvWZ1B1WX7tzXXdorlFSXsNUdlMt3yNqFaPZI/UpUEs0eYcjaVTvWjQ0wCMSlS4ZczJtHt9BvvKFqbCAuYWxArladfcSI1UhB1WStsBopwD5ilE9o5hXPdndicpzDwkambW4sbGQwOc7VJ32ikxjAtjEGmBrEAG0Foyr/MypqMzwTaaSdqKKJBus0M4txMrXQcrIKWk7NNOFXCqnyr39L/AVsHW93+e7UfgAAAABJRU5ErkJggg==)) details to the applet. * **Mounted CSV Files** | Field | Description | | ------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Folder Path + Name |

Select the monitored Windows directory and specify the name of the CSV file. Use a wildcard file search using these characters in the name of the directory, CSV file name, and Path Exclusion.

### Note When you implement a wildcard file search, ensure that the CSV files share the same columns and header rows as all other logs that are collected from the CSV files to create a single dataset.

| | Path Exclusion (Optional) | Specify the complete file path for any files from the Windows directory that you do not want included. The same wildcard file search characters are allowed in this field as explained above for the FOLDER PATH +NAME field. For example, if you want to exclude any CSV file prefixed with '`exclude_`' in the directory and subdirectories of `//host/`, use the syntax `//host//**/exclude_*.csv`. | | Tags (Optional) | To easily query the CSV data in the database, you can add a tag to the collected CSV data. This tag is appended to the data using the format `_`. | | Target Dataset | Either select the target dataset for the CSV data or create a new dataset by specifying the name for the new dataset. | 4. Activate the CSV Collector applet. After a successful activation, the APPS field displays CSV with a green dot indicating a successful connection. {% hint style="info" %} **Note:** The CSV Collector checks for new CSV files every 10 minutes. {% endhint %} 5. (Optional) To view metrics about the CSV Collector, left-click the CSV connection in the APPS field for your Broker VM.Cortex XDR displays Resources, including the amount of CPU, Memory, and Disk space the applet is using. 6. Manage the CSV Collector. After you activate the CSV Collector, you can make additional changes as needed. To modify a configuration, left-click the CSV connection in the APPS column to display the CSV settings, and select: * Configure to redefine the CSV Collector configurations. * Deactivate to disable the CSV Collector. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/generic-on-premise-data-collectors/broker-vm-data-collector-applets/activate-csv-collector.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.