Abstract
Learn more about collecting logs from a Broker VM to review them as part of an investigation.
Cortex XDR enables you to collect your Broker VM logs directly from the Cortex XDR management console.
You can collect logs by either regenerating the most up-to-date logs and downloading them once they are ready, or downloading the current logs from the last creation date reflected in the TIMESTAMP.
Select → → → to view the Broker VMs table in the Brokers tab.
Locate your Broker VM, right-click and select one of these options depending on the type of logs you want to download.
Logs are generated automatically, but can take up to a few minutes depending on the size of the logs.