> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.8/onboard-cortex-xsoar/back-up-and-restore-cortex-xsoar/set-up-backup-and-restore-in-cortex-xsoar.md). # Set up backup and restore in Cortex XSOAR Backup saves the state of the cluster with all of its data at the time the backup is taken. To save storage space, backups are saved with de-duplication and incremental backup methods. Currently, Cortex XSOAR supports backup to a Network File System (NFS) server. {% hint style="info" %} ### Note Backups can be restored only if the current version of Cortex XSOAR is the same **major** version as the backup. For example, if the current version is 8.8.2, you can restore to a backup of 8.8.1. {% endhint %} #### Before you begin Ensure you have the following: * A second cluster with the same configurations and hardware specifications as the original cluster. For more information, see [Restore backups between clusters](/cortex-xsoar-8-on-prem/8.8/onboard-cortex-xsoar/back-up-and-restore-cortex-xsoar/restore-backups-between-clusters.md). * An installed NFS server (with a static IP address). Cortex XSOAR supports NFS version 4.1 or later. * A dedicated disk on the NFS server with the minimum disk space required to store backups. For more information, see [Hardware requirements](/cortex-xsoar-8-on-prem/8.8/onboard-cortex-xsoar/cortex-xsoar-installation/system-requirements/hardware-requirements.md). * Separate backup storage space for each Cortex XSOAR deployment. * Authentication for the NFS server. Authentication methods vary depending on the customer, and password authentication is currently not supported. The officially supported set of permissions under the `/etc/exports` file on the NFS server includes allowing an IP address to access a specific path with specified permissions as follows: `/path/to/nfsshare (rw,sync,no_root_squash,no_subtree_check)` The set of NFS options and user permissions should allow any client user to connect to the NFS mount point. User mapping is possible as long as it allows read-write permissions to any user from the client. Execution is recommended to be disallowed. Chroot is recommended and supported. * A dedicated partition or disk for the NFS mount point. The mount point should be on a dedicated partition or disk to separate any critical file system from the NFS operation. Using only one mount point per partition or disk is also recommended. * Access to the NFS server from the Cortex XSOAR cluster via ports 2049 and 111. When an NFS server is installed with a new formatted disk dedicated for backup and restore, run the `backup-cli install` command to connect to the server. {% hint style="info" %} ### Note For multi-tenant/MSSP, you need to configure the backup feature for each tenant, regardless if the tenant is a parent or a child tenant. {% endhint %} How to set up backup and restore in Cortex XSOAR 1. Ensure you have the following parameters available: * The NFS server IP address * The path of the directory to store backups on the NFS server (ending with a forward slash) * The size of the intended backup directory in GB 2. Log in using SSH to the Cortex XSOAR cluster with the **viewer** user. 3. Run the `backup-cli install` command to connect the NFS server to the cluster.

Note

For High Availability, you can log in as a viewer to any node in the cluster and run the backup commands from that node.

```programlisting # sudo /home/viewer/sbin/backup-cli install [nfs-server-ip] [nfs-path] [size-limit (GB)] # Example: sudo /home/viewer/sbin/backup-cli install 1.1.1.1 /some/path/to/nfs/ 1024 ``` The CLI shows a list of tasks performed to connect the NFS server to the cluster. This can take a few minutes. For example: ![opp-backup-restore-nfs-install.png](/files/EJjEl5oEOelzQfoHgf1T) Once the connection is established, perform backup and restore actions, including: * Schedule a backup with the `schedule create` command. * See details of existing backup schedules with the `schedule show` command. * See a list of backups and their statuses with the `backup list` command. * Restore a specific backup with the `restore` command. * See a list of past restore operations with the `history` command. For more information about the backup and restore options, see [Run backup and restore operations from the CLI](/cortex-xsoar-8-on-prem/8.8/onboard-cortex-xsoar/back-up-and-restore-cortex-xsoar/run-backup-and-restore-operations-from-the-cli.md). --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.8/onboard-cortex-xsoar/back-up-and-restore-cortex-xsoar/set-up-backup-and-restore-in-cortex-xsoar.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.