Palo Alto Networks maintains backups of hosted Cortex XSOAR workloads. Backups are taken for both the hosted production and development workloads. One week’s worth of backups is maintained. In case of a business emergency or data loss, customers can request via support ticket to restore their instance from a backup. Data written after the restore point will not be available. The Cortex XSOAR hosted service operates under the Palo Alto Networks business continuity policy (BCP) (PDF), defined as 4HR/4HR RPO/RTO.
Backups are taken as system snapshots. To restore an individual file, the entire system must be restored. If you create custom content such as playbooks, automations, etc., we recommend regularly downloading and storing a copy of your custom content. This can be done manually or with a playbook such as JOB - XSOAR - Export Selected Custom Content.