> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/investigate-issues/issue-investigation-actions/retrieve-additional-issue-details.md). # Retrieve additional issue details To help you with issue analysis, Cortex XSIAM can provide related files and memory content analysis. 1. From the **Issues** page, locate the issue for which you want to retrieve information. 2. Right-click anywhere in the issue, and select one of the following options: * **Retrieve Additional Data:** Cortex XSIAM can provide related files and additional analysis of the memory contents when an exploit protection module raises an issue. * Select **Retrieve issue data and analyze** to retrieve issue data consisting of the memory contents at the time the issue was raised. You can also enable Cortex XSIAM to automatically retrieve issue data for every relevant issue. After Cortex XSIAM receives the data and performs the analysis, it issues a verdict for the issue. You can monitor the retrieval and analysis progress from the **Action Center** (pivot to view **Additional data**). When the analysis is complete, it displays the verdict in the **Advanced Analysis** field. * **Retrieve related files:** To further examine files that are involved in an issue, you can request the agent send them to the Cortex XSIAM tenant. If multiple files are involved, the tenant supports up to 20 files and 200MB in total size. The agent collects all requested files into one archive and includes a log in JSON format containing additional status information. When the files are successfully uploaded, you can download them from the **Action Center** for up to one week. * **Pivot to views** → **View in source system**: For issues ingested from third-party vendors, this option pivots to the issue in the third-party system. To enable this feature, ensure that Cortex XSIAM has a correlation rule that contains the **External URL** field. For more information, refer to [Create a correlation rule](/cortex-xsiam/detect-investigate-and-respond-to-threats/threat-management/detection-rules/what-are-detection-rules/whats-a-correlation-rule/create-a-correlation-rule.md). * (For **PAN NGFW** source type issues) **Download triggering packet:** Download the session PCAP containing the first 100 bytes of the triggering packet directly from Cortex XSIAM. To access the PCAP, you can download the file from the Issues table, Cases, or Causality view. 3. Navigate to Investigation & Response+Response → **Action Center** to view the retrieval status. 4. Download the retrieved files locally. In the **Action Center**, wait for the data retrieval action to complete successfully. Then, right-click the action row and select **Additional Data**. From the **Detailed Results** view, right-click the row and select **Download Files**. A ZIP folder with the retrieved data is downloaded locally.

Tip

If you require assistance from Palo Alto Networks support to investigate the issue, make sure to provide the downloaded ZIP file.

--- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/investigate-issues/issue-investigation-actions/retrieve-additional-issue-details.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.