External notifications are reported in XML format and contain information about analyzed malware behavior. The Carbon Black App Control Server parses these XML notifications for efficient storage of key information in its database.

In addition, the entire content of each XML notification is stored in a separate store folder for each network security device vendor in the Bit9 installation directory on the Carbon Black App Control Server (Bit9\Integrations\PAN\store). Other folders containing XML can display under Bit9\Integrations for custom or previously supported connectors.

Note:
  • Opening very large XML details files can cause browser performance and navigation issues. One alternative is to right-click the link and Save Target As or Save Link As to a location where you can open the file with a different viewer.
  • If a notification from Palo Alto Networks includes reports for multiple Analysis Environment types, using Show XML shows only the XML details for the Analysis Environment of the current notification.

To access the full XML details for an External Notification, on the External Notification Details page for the notification, click Show XML Details in the External Pages menu. The full details appear in a separate browser window.