Abstract
You can review alert details offline by exporting alerts to a TSV file.
To archive, continue investigation offline, or parse alert details, you can export alerts to a tab-separated values (TSV) file:
From the Alerts page, adjust the filters to identify the alerts you want to export.
When you are satisfied with the results, click the download icon (
).The icon is grayed out when there are no results.
Cortex XSIAM exports the filtered result set to the TSV file.