> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-installation-guides/6.14/cortex-xsoar-installation-guide/readme/multi-tenant-installation-overview.md). # Multi-Tenant Installation Overview Cortex XSOAR multi-tenant deployments are designed for MSSPs (managed security service providers) and enterprises that require strict data segregation, but also need the flexibility to share and manage critical security practices across tenant accounts. Multi-tenancy enables you to manage multiple tenants from a single console. From the main account, you have a bird’s-eye view of all incidents and indicators across all tenants. You can create integrations and scripts for use across multiple tenant accounts, run commands across multiple tenant accounts, and switch easily between tenant environments. Cortex XSOAR provides complete data segregation between customers in a multi-tenant deployment, and no incident data is stored on the main account. Each tenant runs as a separate process, and the data separation meets data privacy standards and compliance requirements. In a multi-tenant deployment, content is either created or modified at the main account level and pushed to tenants or is created within individual tenant accounts. Marketplace content packs are always installed on the main account and pushed to tenant accounts. You can define propagation labels per tenant, which allow you to selectively push content to one or more tenants. With a Threat Intel Management license and Elasticsearch, indicators can be shared across tenant accounts, saving investigation time and making it easy to block bad actors across your MSSP or enterprise. For most large enterprises, we recommend Cortex XSOAR Enterprise with RBAC implementation since this deployment can accomplish the majority of data segregation requirements. In some cases, however, a large enterprise with multiple divisions but with one centralized SOC managing those divisions may want to consider a multi-tenant deployment. We encourage you to consult with Cortex XSOAR product managers and the customer success team to discuss your business use case. Multi-tenancy architecture is based on the platform’s ability to run multiple instances (processes and data) of XSOAR on a single server. Each deployment consists of a main server and tenant accounts. All tenant accounts can reside on the same (main) server or you can choose to run tenants on additional hosts. While tenant incidents can be searched from the main account, no incident data is stored on the main account. Multi-tenant can be deployed with the Bolt database or Elasticsearch (which offers the option of High Availability, using multiple app servers). When using Cortex XSOAR multi-tenancy in an enterprise setting there are several limitations: * Data is not easily shared between tenants. For example, collaborating on an incident requires extra steps (such as mirroring between tenants). The exception is indicator data which can be shared if you have a Cortex XSOAR Threat Intel Management license and have a multi-tenant deployment with Elasticsearch. * Multi-tenancy architecture is more complex than Cortex XSOAR Enterprise server architecture and requires greater IT and computing resources. Also, server maintenance is more complex, since all accounts on a server may be affected when maintenance is performed on the server. #### Installation with Bolt Database Out of the box, Cortex XSOAR is installed with the app server and Bolt database on the same machine. When deploying Cortex XSOAR with Bolt database, we recommend a limit of 1 million indicators for the development environment and 5-7 million indicators for the production environment. If you will have more indicators, we recommend using Elasticsearch. ![mt-overview-boltdb.png](/files/F7nVQozHtJXYUyGF76ZS) To install Cortex XSOAR for a multi-tenant deployment with the Bolt database, review the [Multi-Tenant System Requirements](/cortex-xsoar-6-installation-guides/6.14/cortex-xsoar-installation-guide/system-requirements/multi-tenant-system-requirements.md) and then follow the instructions in [Install Multi-Tenant with Bolt Database](/cortex-xsoar-6-installation-guides/6.14/cortex-xsoar-installation-guide/multi-tenant-installation/install-multi-tenant-with-bolt-database.md). #### Installation with Elasticsearch Database Out of the box, Cortex XSOAR is installed with the app server and Bolt database on the same machine. If you will have more than 1 million indicators for the development environment and 5-7 million indicators for the production environment, we recommend using Elasticsearch. ![mt-overview-elastic.png](/files/oK5YtVbzDWkEhTrCnnKh) To install Cortex XSOAR for a multi-tenant deployment with the Elasticsearch database, review the [Multi-Tenant System Requirements](/cortex-xsoar-6-installation-guides/6.14/cortex-xsoar-installation-guide/system-requirements/multi-tenant-system-requirements.md) and [Elasticsearch System Requirements](/cortex-xsoar-6-installation-guides/6.14/cortex-xsoar-installation-guide/system-requirements/elasticsearch-system-requirements.md) and then follow the instructions in [Install Multi-Tenant with Elasticsearch](/cortex-xsoar-6-installation-guides/6.14/cortex-xsoar-installation-guide/multi-tenant-installation/install-multi-tenant-with-elasticsearch.md). --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-installation-guides/6.14/cortex-xsoar-installation-guide/readme/multi-tenant-installation-overview.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.