> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/manage-data/store-incidentartifact-files-in-the-cloud.md).

# Store Incident/Artifact Files in the Cloud

Cortex XSOAR provides the ability to save incident attachments and artifact files (for example, attachments uploaded to the War Room, or added via a Playbook) in a cloud storage bucket, as opposed to working with the standard local file system. The cloud artifact file URL is added to the context data, providing a way for you to access the file from outside of Cortex XSOAR as well.

Cloud storage can be helpful if your environment has performance issues, such as high disk I/O utilization or a high storage volume. This feature is supported for GCP (using Google Cloud Storage), AWS (using Amazon S3), as well as Amazon S3-compatible products.

{% hint style="info" %}

### Note

If you choose to save incident attachments and artifact files to the cloud, existing files are not migrated to the cloud and these files are no longer available within Cortex XSOAR. For this reason, we recommend using cloud storage for new deployments or in cases where you do not need access to previously saved files.
{% endhint %}

( Multi-tenant) - For multi-tenant deployments, the configuration needs to be added separately for each tenant. For multi-tenant high availability deployments, the configuration does not need to be added on each app server of the tenant. We recommend a separate bucket for each tenant, but multiple tenants can be assigned to the same bucket, if necessary.

( Multi-tenant) - If the tenant app server (the tenant folder on each host machine) was previously configured with cloud storage, via file configuration, the file configuration should be removed.

1. Go to Settings → ABOUT → **Troubleshooting**.
2. In the Server Configuration section, click **Add Server Configuration**.
3. Add the **`Server.CloudStorage`** key and the value for **`GCP`** or **`S3`**:
   * GCP

     ```programlisting
     {
         "Platform": "Google-Storage",
         "BucketName": "bucket-name",
         "ArtifactsPath": "artifacts"
     }
                                 
     ```
   * S3

     ```programlisting
     {
         "Platform": "AWS-S3",
         "BucketName": "bucket-name",
         "ArtifactsPath": "artifacts",
         "Endpoint": "example-objects-internal.com:443",
         "PerProviderOptions": {
             "Region": "eu-north-1",
             "AccessKeyID": "abcdefg",
             "AccessKeySecret": "abcdefg"
             }
     }
                                 
     ```

     <div data-gb-custom-block data-tag="hint" data-style="info" class="hint hint-info"><h3>Note</h3><p>Endpoint is required for Amazon S3-compatible products only, and not for a standard S3 environment. For example, if you are using MinIO, set this value to the machine IP (“x.x.x.x:9000"). If you omit this field, communication will be with the official AWS service.</p><p>The bucket's access key secret can be plaintext or encrypted by the utility. See step 4 below.</p></div>
4. To authenticate Cortex XSOAR to the cloud provider, do one of the following:
   1. **For GCP:** Authentication is based on the service account set on the machine. Refer to the [relevant GCP documentation](https://cloud.google.com/docs/authentication/production#automatically) GCP documentation for more information.
   2. **For S3:** The credentials are set in the server configuration. The bucket's access key secret can be encrypted using a utility installed with XSOAR.
      1. Run the following **`tom util`** command, including the bucket’s access key secret in plaintext:

         **`/usr/local/demisto/tom <plain text secret>`**
      2. Copy and paste the encrypted output into the AccessKeySecret field.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/manage-data/store-incidentartifact-files-in-the-cloud.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.