> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/investigate-endpoints/retrieve-files-from-an-endpoint.md). # Retrieve files from an endpoint During an investigation, you can retrieve files from one or more endpoints by initiating a files retrieval request. For each file retrieval request, Cortex XSIAM supports up to: * 20 files * 500MB in total size * 10 different endpoints The request instructs the agent to locate the files on the endpoint and upload them to Cortex XSIAM. The agent collects all requested files into one archive and includes a log in JSON format containing additional status information. When the files are successfully uploaded, you can download them from the **Action Center**. ### How to retrieve files from an endpoint 1. Go to Investigation & Response → Response → Action Center → **New Action**. 2. Select **Files Retrieval**. 3. Select the operating system and enter the paths for the files you want to retrieve. Press **ADD** after each completed path.

You cannot define a path using environment variables on Mac and Linux endpoints.

4. Click **Next**. 5. Select the target endpoints (up to 10) from which you want to retrieve files and click **Next**. 6. Review the action summary and click **Done**. To track the status of a file retrieval action, return to the **Action Center**. Cortex XSIAM retains retrieved files for up to 30 days. If at any time you need to cancel the action, right-click, and select **Cancel for pending endpoint**. You can cancel the retrieval action only if the endpoint is still in **Pending** status and no files have been retrieved from it yet. The cancellation does not affect endpoints that are already in the process of retrieving files. 7. To view additional data and download the retrieved files, right-click the action and select **Additional data**. This view displays all endpoints from which files are being retrieved, including their **IP Address**, **Status**, and **Additional Data** such as error messages of names of files that were not retrieved. 8. When the action status is **Completed Successfully**, right-click the action and download the retrieved files logs.

If the Password Protection (for downloaded files) setting under Settings → Configuration → General → Server Settings is enabled, enter the password 'suspicious' to download the file.

### Disable file retrieval If you want to prevent Cortex XSIAM from retrieving files from an endpoint running the agent, you can disable this capability during agent installation or later on from the **All Endpoints** page. Disabling script execution is irreversible. If you later want to re-enable this capability on the endpoint, you must re-install the agent. See the XDR agent administrator’s guide for more information. {% hint style="info" %} Disabling File Retrieval does not take effect on file retrieval actions that are in progress. {% endhint %} --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/investigate-endpoints/retrieve-files-from-an-endpoint.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.