As a prerequisite to export incidents to your external storage, add your storage solution to the external storage configuration settings.
Before exporting incidents, you must have an external storage option configured. You can use an Amazon S3 bucket, any S3 compatible bucket, or NFS. Verify that your firewall allows traffic from Cortex XSOAR to your chosen storage solution, and then add your external storage to the External Storage settings in Cortex XSOAR.
Note
If you are only deleting incidents, without exporting, no external storage or firewall configuration is required.
If you are using Amazon S3, you will need the bucket name, region, access key, and secret key. In addition, the following Amazon S3 bucket policies must be allowed:
s3:PutObject
s3:GetObject
s3:DeleteObject
s3:ListBucket
If you are using an S3 compatible bucket, you will need the bucket name, URL, access key, and secret key.
Configure external storage in the Cortex XSOAR tenant
Go to → → → → .
Enter a storage name of your choice and select if the storage is NFS, AWS S3 or S3-Compatible.
If you are using NFS, enter the server IP address and the full path to the storage directory. Enter a username and password if required to access the NFS.
If you are using Amazon S3, enter the Bucket name, Region, Access key, and Secret key.
If you are using an S3-compatible storage option, enter the Bucket name, URL, Access key, and Secret key.
Test connection.
If the connection fails, confirm that your firewall permits traffic from Cortex XSOAR to your storage solution, the credentials are correct, and you have write permissions to the bucket.
Save the configuration.