> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/configure-cortex-xsoar/incident-configuration/export-cortex-xsoar-incidents-to-cloud-storage/configure-access-to-external-storage.md).

# Configure access to external storage

Configure Azure Blob, Amazon S3, or S3-compatible storage for Cortex XSOAR 8 SaaS incident exports.

Configure external cloud storage before exporting Cortex XSOAR incidents. Set up egress in Cortex Gateway, then add Azure Blob, Amazon S3, or S3-compatible storage in Cortex XSOAR.

{% hint style="info" %}
The Azure Blob Storage feature is disabled by default. To enable Azure Blob Storage, contact Customer Support.
{% endhint %}

### Before you begin

Before you begin, you need the following information from your external storage solution:

* **Azure Blob:**
  * **SAS token:** If you are using a SAS token, you need the account name, container name, and the SAS token.
  * **Service Principal:** If you are using a Service Principal, you need the account name, container name, tenant ID, client ID, and client secret.
  * The following permissions are required:
    * **Read (r):** get\_container\_properties, download\_blob
    * **List (l):** list\_blobs
    * **Write (w):** upload\_blob
    * **Delete (d):** delete\_blob
* **Amazon S3**
  * Bucket name, region, access key, and secret key.
  * The following Amazon S3 bucket policies must be allowed:
    * s3:PutObject
    * s3:GetObject
    * s3:DeleteObject
    * s3:ListBucket
* **S3-Compatible**
  * Domain name or IP address of the path, bucket name, URL, access key, and secret key.

[Example: Retrieve information from Amazon S3](/cortex-xsoar-8-saas/configure-cortex-xsoar/incident-configuration/export-cortex-xsoar-incidents-to-cloud-storage/amazon-s3-configuration-example.md)

### Configure external storage access

Complete these tasks in order. First, allow outbound traffic in Cortex Gateway. Then add the storage connection in Cortex XSOAR.

#### Configure egress in Cortex Gateway

{% hint style="info" %}
Only a user with Account Admin or Instance Admin permissions can configure egress. For more information, see [Egress configurations](/gateway-guide/egress-configurations.md).
{% endhint %}

1. In the Cortex Gateway, go to **Permission Management** → **Egress Configurations** → **Path**.
2. Select the account name and tenant.
3. In the **Flow** field:
   * For Azure Blob, select **Data Exporter Azure Blob Storage Account Name** or **Data Exporter Azure Blob Container Name.**
   * For Amazon S3, select **External Storage: AWS S3.**
   * For S3-compatible storage, select **External Storage: S3-compatible**.
4. In the **Path** field:
   * For Amazon S3 storage, enter only the bucket name for the **Path**.
   * For S3-compatible storage, enter the domain name or IP address of the path.
   * For Azure Blob storage, enter the **Storage Account Name** if you selected the **Data Exporter Azure Blob Storage Account Name** flow option. Enter the **Blob Container Name** if you selected the **Data Exporter Azure Blob Container Name** flow option.

#### Configure external storage in the Cortex XSOAR 8 SaaS tenant

1. Go to **Settings & Info** → **Settings** → **System** → **External Storage** → **New**.
2. Enter a storage name of your choice and select whether the storage is **AWS S3** or **S3-Compatible**.
   * For Azure Blob, choose SAS Token or Service Principal.
     * For **SAS Token** authentication, enter the **Account name**, **Container name**, and **SAS token**.
     * For **Service Principal** authentication, enter the **Account name**, **Container name**, **Tenant ID**, **Client ID**, and **Client secret**.
   * For Amazon S3, enter the **Bucket name**, **Region**, **Access key**, and **Secret key**.
   * If you are instead using a storage option such as GCP configured to be S3-compatible, enter the **Bucket name**, **URL**, **Access key**, and **Secret key**.
3. **Test connection**.

   If the connection fails, confirm that you configured egress in the Cortex Gateway, the credentials are correct, and you have write permissions to the bucket.
4. **Save** the configuration.

### Next steps

After configuration, export incidents to your cloud storage solution:

* [Export Cortex XSOAR incidents to cloud storage](/cortex-xsoar-8-saas/configure-cortex-xsoar/incident-configuration/export-cortex-xsoar-incidents-to-cloud-storage.md)
* [Schedule incident export](/cortex-xsoar-8-saas/configure-cortex-xsoar/incident-configuration/export-cortex-xsoar-incidents-to-cloud-storage/schedule-incident-export.md)
* [Export incidents on demand](/cortex-xsoar-8-saas/investigate-and-respond-to-threats/incidents-and-indicators-investigation/incident-management/export-incidents/export-incidents-on-demand.md)


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/configure-cortex-xsoar/incident-configuration/export-cortex-xsoar-incidents-to-cloud-storage/configure-access-to-external-storage.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.