> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/onboard-cortex-xsoar/onboarding-in-cortex-xsoar/elasticsearch/disaster-recovery-for-elasticsearch.md).

# Disaster Recovery for Elasticsearch

Any Cortex XSOAR installation that uses an Elasticsearch database does not run automatic backups. Instead, you create and restore backups in Elasticsearch using snapshots.

**Backup**

Snapshots can include the entire database or specific indices. You can schedule snapshots to run automatically or take manual snapshots as needed. Snapshots usually take only a few minutes to complete and can be stored in a remote or local repository.

To create Elasticsearch snapshots, you will need a repository, preferably remote, to store the backup snapshots in a secure and available location for disaster recovery.

{% hint style="info" %}

### Note

If you are using AWS Managed Elasticsearch, every Elasticsearch cluster is created with a default repository configured with a backend S3 bucket.
{% endhint %}

**Restore**

In an Elasticsearch environment, one or more nodes can fail and as a result one or more primary shards may become unavailable. When this happens, data may be unavailable and in some cases, depending on what was stored on the node, it may not be possible to access the Cortex XSOAR login page.

{% hint style="info" %}

### Note

Depending on your Elasticsearch configuration, if any primary shards become inactive, Elasticsearch may try to automatically move the primary shards to any available node. To see whether Elasticsearch is attempting to move the primary shards automatically, use the Elasticsearch API to view all pending tasks: **`GET /_cluster/pending_tasks`**. This method can take an extended period of time, and you might want to proceed with partial disaster recovery steps (restoring a snapshot) instead.
{% endhint %}

For disaster recovery, you can restore a snapshot of your entire active database or specific indices. If, for example, node 1 has failed and it contained the incidents index, you can restore only the incidents index to an already active node or to a new node. If all Elasticsearch nodes or an entire Elasticsearch cluster fail, you can immediately restore the latest snapshot on any Elasticsearch cluster. This process will restore all indices required for XSOAR to run.

Besides disaster recovery, snapshots can also be used to limit storage size. You can backup a specific index and then [archive](/xsoar-6-administrator-guide/6.12/onboard-cortex-xsoar/onboarding-in-cortex-xsoar/elasticsearch/disaster-recovery-for-elasticsearch/archive-data-with-elasticsearch.md) the data by deleting it from the database.

{% hint style="info" %}

### Note

Elasticsearch [security privileges](https://www.elastic.co/guide/en/elasticsearch/reference/current/security-privileges.html) must be configured to allow backups and restores. For example, **`manage`** is required to create snapshots and to restore.
{% endhint %}

**Server**

For comprehensive disaster recovery, we recommend scheduling automated backups, using your preferred enterprise backup solution, of all folders and files in **`/var/lib/demisto/`**, with the exception of **`/var/lib/demisto/temp`**. In addition, we recommend scheduling automated backups of the configuration file located at **`/etc/demisto.conf`**.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/onboard-cortex-xsoar/onboarding-in-cortex-xsoar/elasticsearch/disaster-recovery-for-elasticsearch.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.