Contents

Introduction

This document describes how to remotely fetch diagnostic data to troubleshoot the XDR Forensics module in its console.

Fetching logs remotely

Note: Currently, DART logs do not contain XDR Forensics logs.

Step 1. Open XDR and navigate to Investigate > Forensics console.

Step 2. Verify the hostname of the endpoint is visible on the Assets page by navigating to Assets page. To do this:

a) Open CMD on the given machine and execute hostname command.

C:\Users\Admin\hostname

lenovo-laptop-amp

b) In XDR Forensics console main page click View all Assets (or use Assets menu on the left).

c) Localize the endpoint on the list and click the Device name to enter its details.

Step 3. In the Asset info page, click More Actions > Collect Logs to start gathering information from the endpoint.

Note: If the asset is online, this takes a few seconds to complete.

Step 4. Go to Logs section to see if logs has been gathered already. In Asset Logs section, click the icon to start logs download.

Step 5. Acquired *.zip file contains three files required to troubleshoot the module:

- AIR.Log.txt

- AIR.Process.Log.txt

- TACTICAL-Legacy.Log.txt