Share Indicators Overview

Share tenant indicators through shared Elasticsearch indexes in Cortex XSOAR 6.14 multi-tenant deployments.

The share indicators feature requires a Cortex XSOAR Threat Intel Management license and that Cortex XSOAR runs using Elasticsearch.

Each tenant account has a dedicated shared index in Elasticsearch. When you share a tenant’s indicators, either manually or using the Cortex XSOAR Indicators Share integration, the indicators are stored in the index. Other tenants ingest from this index, using the Elasticsearch Feed integration.