> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/configure-cortex-xsoar/incident-configuration/export-cortex-xsoar-incidents-to-cloud-storage/configure-access-to-external-storage.md).

# Configure access to external storage

Before exporting incidents to Azure Blob, Amazon S3, or an S3-compatible bucket, you need to configure egress in the Cortex Gateway and add the storage bucket to the **External Storage** settings in Cortex XSOAR.<br>

{% hint style="info" %}
The Azure Blob Storage feature is disabled by default. To enable Azure Blob Storage, contact Customer Support.
{% endhint %}

{% hint style="warning" %}

### Prerequisite

Before you begin, you need the following information from your external storage solution:

* **Azure Blob:**
  * If you are using a SAS token, you need the account name, container name, and the SAS token.
  * If you are using a Service Principal, you need the account name, container name, tenant ID, client ID, and client secret.
  * The following permissions are required:
    * Read (r): get\_container\_properties, download\_blob
    * List (l): list\_blobs
    * Write (w): upload\_blob
    * Delete (d): delete\_blob
* **Amazon S3**: bucket name, region, access key, and secret key. In addition, the following Amazon S3 bucket policies must be allowed:
  * s3:PutObject
  * s3:GetObject
  * s3:DeleteObject
  * s3:ListBucket
* **S3-Compatible**: domain name or IP address of the path, bucket name, URL, access key, and secret key.

[Example: Retrieve information from Amazon S3](/cortex-xsoar-8-saas/configure-cortex-xsoar/incident-configuration/export-cortex-xsoar-incidents-to-cloud-storage/amazon-s3-configuration-example.md)
{% endhint %}

### **How to configure access to external storage**

#### **Task 1: Configure egress in Cortex Gateway**

{% hint style="info" %}

### Note

Only a user with Account Admin or Instance Admin permissions can configure egress. For more information, see [Egress configurations](/gateway-guide/egress-configurations.md).
{% endhint %}

1. In the Cortex Gateway, go to **Permission Management** → **Egress Configurations** → **Path**.
2. Select the account name and tenant.
3. In the **Flow** field:
   * For Azure Blob, select **Data Exporter Azure Blob Storage Account Name** or **Data Exporter Azure Blob Container Name.**
   * For Amazon S3, select **External Storage: AWS S3.**
   * For S3-compatible storage, select **External Storage: S3-compatible**.
4. In the **Path** field:
   * For Amazon S3 storage, enter only the bucket name for the **Path**.
   * For S3-compatible storage, enter the domain name or IP address of the path.
   * For Azure Blob storage, enter the **Storage Account Name** if you selected the **Data Exporter Azure Blob Storage Account Name** flow option. Enter the **Blob Container Name** if you selected the **Data Exporter Azure Blob Container Name** flow option.

#### **Task 2: Configure external storage in the Cortex XSOAR tenant**

1. Go to **Settings & Info** → **Settings** → **System** → **External Storage** → **New**.
2. Enter a storage name of your choice and select if the storage is **AWS S3** or **S3-Compatible**.
   * For Azure Blob, choose SAS Token or Service Principal.
     * For **SAS Token** authentication, enter the **Account name**, **Container name**, and **SAS token**.
     * For **Service Principal** authentication, enter the **Account name**, **Container name**, **Tenant ID**, **Client ID**, and **Client secret**.
   * For Amazon S3, enter the **Bucket name**, **Region**, **Access key**, and **Secret key**.
   * If you are instead using a storage option such as GCP configured to be S3-compatible, enter the **Bucket name**, **URL**, **Access key**, and **Secret key**.
3. **Test connection**.

   If the connection fails, confirm that you configured egress in the Cortex Gateway, the credentials are correct, and you have write permissions to the bucket.
4. **Save** the configuration.

You can now schedule incident exports or export incidents on demand to your cloud storage solution.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/configure-cortex-xsoar/incident-configuration/export-cortex-xsoar-incidents-to-cloud-storage/configure-access-to-external-storage.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.