> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/configure-cortex-xsoar/incident-configuration/export-cortex-xsoar-incidents-to-cloud-storage/schedule-incident-export.md).

# Schedule incident export

You can enable scheduled export of incidents. Incidents are exported based on your retention policy. By default, the retention policy is six months from the date of incident creation, and all incidents older than six months are exported once a day. If you have purchased additional retention, only incidents older than your total retention are exported. For example, if you have purchased an additional three months of retention and have nine months total, incidents older than nine months are exported once a day.

{% hint style="warning" %}

### Danger

Before exporting incidents, you must have an external cloud storage solution configured. For more information, see [Configure access to external storage](/cortex-xsoar-8-saas/configure-cortex-xsoar/incident-configuration/export-cortex-xsoar-incidents-to-cloud-storage/configure-access-to-external-storage.md)
{% endhint %}

1. Go to **Settings & Info** → **Settings** → **System** → **Export Incidents**.
2. Choose an existing external storage option from the dropdown.
3. Enter the relative path where the data is stored. For example, if the data is stored in the `export_incidents` top-level folder in an Amazon S3 bucket, the relative path is `export_incidents`.
4. Under **Export frequency**, toggle the button to **Enable scheduled exports**.
5. Select whether to **Include incident attachments**.
6. **Save**.

After you enable scheduled exports, the **Export Incidents** page displays the date and time of the next scheduled export. After an export is complete, the page displays the date and time of the last successful export. If an export is currently running, the status is displayed.

{% hint style="info" %}

### Note

* The first time incidents are exported, the process may take multiple days or weeks, depending on the number of incidents and the amount of data. The previous export must be completed before the system begins another export.
* To stop an existing export process, click the **Abort** button. The **Abort** button only appears when an export is in process.
* If an export fails, the Instance Admin receives an email notification. To enable or disable notification settings, click on your username and select **User Preferences** → **Notifications** → **Other Notifications** → **Scheduled export and delete failure**.
* Once an incident has been exported, it is not exported again, even if it remains in the system and is modified after the export.
  {% endhint %}


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/configure-cortex-xsoar/incident-configuration/export-cortex-xsoar-incidents-to-cloud-storage/schedule-incident-export.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.