Activate the Files and Folders Collector - Administrator Guide - Cortex XDR - Cortex - Security Operations

Select Settings → Configurations → Data Broker → Broker VMs.

In either the Brokers tab or the Clusters tab, locate your Broker VM.

You can either right-click the Broker VM and select Add App → Files and Folder Collector, or hover in the APPS column, and select Add → Files and Folder Collector.

Configure the Files and Folders Collector settings.

1. Configure the Shared Folder Connection settings.

   • Folder Path—Specify the path to the files and folders that you want Cortex XDR to monitor continuously to collect the files. The following formats are available based on the type of machine you are using.

     • Windows—\\<hostname>\<shared_folder> or smb://<hostname>/<shared_folder>

     • Linux—/<srv>/<shared_folder> or nfs://<srv>/<shared_folder>

       Note

       When using the Linux file share, including the Linux share with nfs, a Username and Password is not required, so these fields are grayed out in the screen.

   • Recursive—Select this checkbox to configure the Files and Folders Collector applet to recursively examine any subfolders for new files as long as the folders are readable. This is not configured by default.

   • Username—Specify the username to access the shared resource using a User Principal Name (UPN) format.

   • Password—Specify the password to access the shared resource.

   • Test Connection—Select to validate the connection and permissions.

2. Configure the File and Folder Settings.

   • Mode—Select the mode to use for collecting logs, where the fields displayed change depending on your selection.

     • Tail—Continuously monitors files for new data (default).

     • Batch—Reads entire file and then renames/deletes uploaded files.

       Note

       In Batch mode, the Files and Folders Collector supports collecting logs from a network share for a maximum file size of 500 MB.

   • Collect Every—Specify the execution frequency of collection by designating a number and then selecting the unit as either Minutes, Hours, or Days. This option is only displayed in Batch Mode.

   • After Files Uploaded—Select what to do with the files after they are uploaded to the Cortex XDR server. You can either select Rename files with a suffix (default) and then you must specify the Suffix or Delete files. When adding a suffix, the suffix is added at the end of the original file name using the format <file name>.<suffix>, which becomes the new name of the file. This option is only displayed in Batch Mode.

   • Include—Specify the files and folders that must match to be monitored by Cortex XDR . Multiple values are allowed with commas separating the values and are case-sensitive.

     Allowed wildcard:

     • '?' matches a single alphabet character in a specific position.

     • '*' matches any character or set of characters, including no character.

     Example: log*.json includes any JSON file starting with 'log'.

   • Exclude—(optional) Specify the files and folders that must match to not be monitored by Cortex XDR . Multiple values are allowed with commas separating the values.

     Allowed wildcard:

     • '?' matches a single alphabet character in a specific position.

     • '*' matches any character or set of characters, including no character.

     Example: *.backup excludes any file ending with '.backup'.

   • Log Format—Select the Log Format from the list as either Raw (default), JSON, CSV, TSV, PSV, CEF, LEEF, Corelight, or Cisco. This setting defines the parser used to parse all the processed files as defined in the Include and Exclude fields, regardless of the file names and extension. For example, if the Include field is set * and the Log Format is JSON, all files (even those named file.log) in the specified folder are processed by the Files and Folders Collector as JSON, and any entry that does not comply with the JSON format are dropped.

     Note

     When uploading JSON files, Cortex XDR only parses the first level of nesting and only supports single line JSON format, such that every new line means a separate entry.

   • # of Lines to Skip—(optional) Specify the number of lines to skip at the beginning of the file. This is set to 0 by default.

3. Configure Data Source Mapping settings.

   Vendor and Product—Specify the Vendor and Product for the type of data being collected. The vendor and product are used to define the name of your Cortex Query Language (XQL) dataset (<Vendor>_<Product>_raw).

   Note

   The Vendor and Product defaults to Auto-Detect when the Log Format is set to CEF or LEEF.

4. Generate Preview.

   Select Generate Preview to display up to 10 rows from the first file and Preview the results. The Preview works based on the Files and Folders Collector settings, which means that if all the files that were configured to be monitored were already processed, then the Preview returns no records.

(optional) Add Connection to define another Files and Folders connection for collecting logs from files and folders in a shared resource.

(optional) Other available options.

As needed, you can return to your Files and Folders Collector settings to manage your connections. Here are the actions available to you.

Activate the Files and Folders Collector applet.

After a successful activation, the APPS field displays File with a green dot indicating a successful connection.

(Optional) To view metrics about the Files and Folders, hover over the File connection in the APPS field for your Broker VM.

Cortex XDR displays Resources, including the amount of CPU, Memory, and Disk space the applet is using.

Manage the Files and Folders Collector.

After you activate the Files and Folders Collector, you can make additional changes as needed. To modify a configuration, hover over the File connection in the APPS column to display the Files and Folder Collector settings, and select:

You can also Ingest Logs in a Network Share as Datasets.