> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-multi-tenant-guides/6.15/onboard-multi-tenant/multi-tenant-deployment-installation/install-cortex-xsoar-for-a-multi-tenant-deployment-with-elasticsearch.md). # Install Cortex XSOAR for a Multi-Tenant Deployment with Elasticsearch Install Cortex XSOAR 6.15 for a multi-tenant deployment with an Elasticsearch database. ### Cortex XSOAR installation file structure By default, the `.sh` file is in `/home/`. The file installs `demistoserver_xxxxx.amd64.deb` in `/usr/local/demisto`. You can [change the default folder](/xsoar-6-administrator-guide/6.15/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/manage-data/move-data-folders-to-another-location-on-the-server.md), if necessary. For more information, see [Cortex XSOAR installation file structure](/xsoar-6-administrator-guide/6.15/onboard-cortex-xsoar/single-server-deployment/install-the-server-for-a-single-server-deployment.md#installation-file-structure). ### Prerequisites for installing Cortex XSOAR with Elasticsearch Verify the following information and requirements before you install Cortex XSOAR with Elasticsearch. * A Customer Support Portal account. Set up your account. For more information, see [How to Create Your CSP User Account](https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClNVCA0). When you create an account, you can set up two-factor authentication using email, Okta Verify, or Google Authenticator for non-FedRAMP accounts. For more information, see [How to Enable a Third Party IdP](https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA14u000000sZ8mCAE). * Have the following roles assigned: | Role | Details | | ---------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Customer Support Portal role | The Super User role is assigned to your account. The account creator is granted the Super User role. | | Cortex role | If you are the first user to access Cortex Gateway with the Super User role, you are automatically granted Account Admin permissions. You can add Account Admin users as required. | After creating the account, log in to Cortex Gateway to download the image file and license. Downloading an image file from Cortex Gateway ensures you have the latest pre-configured software package for deployment and updates. If you have multiple or development tenants, repeat these tasks for each tenant.

To download Cortex XSOAR images from Cortex Gateway, you must have a license, or an evaluation license through sales, assigned to your account.

* Your deployment meets the [minimum system requirements](/xsoar-6-administrator-guide/6.15/onboard-cortex-xsoar/single-server-deployment/system-requirements.md). * Your Elasticsearch deployment meets the [Elasticsearch System Requirements](/xsoar-6-administrator-guide/6.15/onboard-cortex-xsoar/elasticsearch/elasticsearch-setup/elasticsearch-system-requirements.md). * You have root access. * Elasticsearch 7.x is installed. Elasticsearch should not be installed on the same server as Cortex XSOAR. * The production server has Python 2.7 or 3.x. ### Install Cortex XSOAR Multi-Tenant with Elasticsearch {% stepper %} {% step %} ### Download the installation package and license 1. Log in to [Cortex Gateway](https://cortex-gateway.paloaltonetworks.com/accounts). 2. In the **Available for Activation** section, use the serial number to locate the tenant to download. By default, the **Production-Standalone** license is selected. You can also select **Dev**. If you want to use a production and a development tenant with a private remote repository, select **Dev**. If you don't select it now, you can install a development tenant later. 3. Select **Download On Prem**. 4. Under **Choose Download Option**, select **Installer**. 5. Select the checkbox to agree to the license terms and conditions. Select **Download**. {% hint style="info" %} In Google Chrome, you may need to allow automatic downloads. Select **Settings** → **Privacy and security** → **Site settings** → **Additional permissions** → **Automatic downloads**. Select **Sites can ask to automatically download multiple files**. {% endhint %} Two files download: the `demistoserver-xxxxx.sh` installer file and a zipped JSON license file. {% hint style="info" %} Copy the download link button from your browser downloads to get the token for an offline installation. {% endhint %} 6. Select **Next**. 7. Optional: If you deploy Cortex XSOAR using a signed installer (GPG), import the provided GPG public key. For example, run `rpm --import public.key` to import the public key into the local GPG keyring. Each operating system has specific requirements. 8. Optional: If you deploy Cortex XSOAR using a signed installer (GPG), you might need to install `makeself`. Run `yum install makeself`. {% endstep %} {% step %} ### Make the server package executable Run `chmod +x demistoserver-xxxx.sh` to make the `.sh` file executable. {% endstep %} {% step %} ### Run the installer Run one of the following commands: * If using username and password authentication: `sudo ./demisto.sh -- -multi-tenant -elasticsearch-url= -elasticsearch-username= -elasticsearch-password=` * If using API key authentication: `sudo ./demisto.sh -- -multi-tenant -elasticsearch-url= -elasticsearch-api-key=` | Flag | Type | Description | | ------------------------- | ------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `-multi-tenant` | String | Indicates that the installation is for a Multi-tenant deployment. | | `-elasticsearch-url` | String | Elasticsearch URL addresses (comma-separated). For example, `http://test1:9200,http://test2:9200` | | `-elasticsearch-api-key` | String |

The Elasticsearch API key, which should be used in licensed versions.

Note: If you use this flag, you do not need to use the -elasticsearch-username and -elasticsearch-password flags.

| | `-elasticsearch-username` | String |

The Elasticsearch username. This flag is used with the -elasticsearch-password flag.

Note: If you use this flag, you do not need to use the -elasticsearch-api-key flag.

| | `-elasticsearch-password` | String |

The Elasticsearch password. This flag is used with the -elasticsearch-username flag.

Note: If you use this flag, you do not need to use the -elasticsearch-api-key flag.

| | `-elasticsearch-proxy` | Boolean | Whether to use a proxy when communicating with Elasticsearch. Can be `true` or `false`. Default is `false`. | | `-elasticsearch-insecure` | Boolean | Whether to trust any certificate when communicating with Elasticsearch. Can be `true` or `false`. Default is `true`. | | `-elasticsearch-timeout` | Integer | The amount of time (in seconds) before Elasticsearch times out. Default is 20 seconds. | | {% endstep %} | | | {% step %} ### Verify the installation After the installation completes, verify the following: 1. Run `systemctl status demisto` to confirm that the Cortex XSOAR server is active. If the server is not active, run `systemctl start demisto`. 2. Run `systemctl status docker` to confirm that the Docker service is active. 3. Open `https://:` in a web browser to verify the installation. {% endstep %} {% step %} ### Add the license After installation completes, activate the license. 1. Log in to the Cortex XSOAR server. 2. Upload the **license** file that you downloaded from Cortex Gateway. For more information, see [Add a License](/xsoar-6-administrator-guide/6.15/onboard-cortex-xsoar/single-server-deployment/add-a-license.md). {% endstep %} {% endstepper %} To continue with a high availability configuration, you must [install an additional app server](/xsoar-6-administrator-guide/6.14/onboard-cortex-xsoar/high-availability/install-additional-app-servers.md). --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-multi-tenant-guides/6.15/onboard-multi-tenant/multi-tenant-deployment-installation/install-cortex-xsoar-for-a-multi-tenant-deployment-with-elasticsearch.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.