Exporting threat hunting logs

For on-premise deployments, when you submit a support ticket about issues with Threat Hunting Repository installation, upgrade, or general functioning, you must include the threat hunting logs.

To collect threat hunting logs:

1. Run the following command:

   sudo bash /opt/FortiEDR/deployments/latest/deployment/ci-tools/get_logs.sh

   The script will create logs archive in the /tmp/ directory.

   

2. Use the SCP client to download the .tgz file.

   You can then attach the file to the support ticket.

To retrieve Collector, Core, and Aggegator logs, see the following: Exporting logs for Collectors Exporting logs for Cores Exporting logs for Aggregators