Cortex XSOAR 8 On-Prem FAQs
FAQs for Cortex XSOAR 8x on-prem.
What is the timeline for the Cortex XSOAR 8 on-prem GA release?
Cortex XSOAR on-prem is now GA. The release does not support:
Migration from Cortex XSOAR 6 on-prem for Enterprise customers to Cortex XSOAR 8 on-prem.
Enterprise air-gapped environments
Installation
What are the required specifications for Cortex XSOAR 8 on-prem?
Cortex XSOAR 8 on-prem is delivered as a virtual appliance on a K8s cluster, available in VHD and OVA formats (MS Hyper-V and VMware hypervisors).
The Cortex XSOAR tenant has specific minimum VM hardware requirements depending on the scale. For more information, see Hardware requirements.
Can Cortex XSOAR 6 hardware/database be reused for Cortex XSOAR 8 on-prem?
Cortex XSOAR 8 on-prem does not share the same architecture and data structure as Cortex XSOAR 6.
In addition, Cortex XSOAR 8 will be delivered as a virtual appliance and cannot be connected to external DBs.
Do users need any basic knowledge of Kubernetes?
No. As part of the virtual appliance, users will not have access to the k8s level.
Is a dockerized/Kubernetes deployment an option? Can you use your own Kubernetes?
The Cortex XSOAR On-prem image-based appliance already includes a Kubernetes cluster, as such it is meant to be deployed in whole. The short answer is no.
What is the added value of using a 3-node cluster?
Using a 3-node cluster replicates the data between nodes. The Cortex XSOAR high availability solution requires at least three nodes.
You can choose between a standalone and a cluster, but you can't change between deployments. This is not yet available and will come later (no ETA).
Does scaling up or upgrading require downtime?
Yes, both actions involve downtime of Cortex XSOAR (both standalone and cluster).
How many control plane node failures can a cluster sustain while ensuring the application is still available?
For a cluster of three or more nodes, the system can tolerate only one node failing, it does not matter which one fails.
Can a cluster be split across data centers?
We recommend deploying all nodes in a single data center.
Can two clusters be connected across data centers?
Two clusters cannot be connected across data centers, they are deployed separately with no shared resources. You can perform backup and recovery by connecting both clusters to the same external storage (for example, an NFS server).
What is the purpose of the outbound on-prem Gateway connection to onpremgw.crtx.[region].paloaltonetworks.com?
This connection is used for the following:
Marketplace
Telemetry
Upgrade content packs
What is the purpose of the textual UI (TUI)?
The textual UI (TUI), accessed via the Admin user, provides a comprehensive interface for performing all required installation and maintenance tasks for Cortex XSOAR on-prem.
To access the TUI, open an external terminal and use the ssh admin@<server-ip-address> command.
The textual UI menu opens with all the configuration and installation options.
SSH access
Can I SSH into the backend hosts?
Yes, you can SSH into the backend hosts.
For example, to sign in as an Admin user, open an external terminal and use the ssh admin@<server-ip-address> command.
The textual UI menu opens with all the configuration and installation options.
What user accounts are available for SSH access?
Admin user: Use the Admin user with the initial password set during installation to access the textual UI (TUI).
Viewer user: Use the viewer user (same password as the Admin user) to access a limited CLI for tasks like downloading log bundles. The viewer user provides a secure way to retrieve log files without full administrator access, ensuring minimal exposure of the system's backend while supporting troubleshooting tasks.
High Availability
How is High Availability implemented for Cortex XSOAR 8 on-prem?
For a single data center, Cortex XSOAR is deployed with HA out-of-the-box. Cortex XSOAR on-prem currently supports an HA solution for a use case of node failure, in which the system experiences downtime and then restores automatically.
For cross-data centers, Cortex XSOAR provides the backup and restore solution, where you can periodically back up your production Cortex XSOAR environment on a standby cluster in a secondary data center. When the primary data center is down, you can restore the Cortex XSOAR environment from the backup. To reduce failover time, the secondary environment should be maintained with the same Cortex XSOAR version as production.
Is there downtime with Cortex XSOAR High Availability?
If a node goes down, workloads on the failed node are automatically distributed to the other nodes. There may be several minutes of downtime until the other nodes take over and the pods get moved to other nodes.
Backup and restore
What is backup and restore, and how is it implemented for Cortex XSOAR 8 on-prem?
With backup and restore, you can periodically back up your production Cortex XSOAR environment on a standby cluster in a secondary data center. When the primary data center is down, you can restore the Cortex XSOAR environment from the backup.
Backup and restore functionality is implemented in the Cortex XSOAR tenant.
Does Cortex XSOAR have the ability to schedule backup and restore data without downtime?
Backup will not require downtime. Restore will involve downtime.
Engines
Do engines connect directly to the Cortex XSOAR on-prem nodes, or do they connect via the cloud?
The connection between the engines and Cortex XSOAR On-prem is done directly and not through the cloud.
Remote Repositories
Do the dev and prod environments need to match, such as standalone and cluster, and node counts and sizes?
No. Each one is being managed as a separate tenant and does not need to match.
How does user licensing work for a development tenant?
In the development tenant, we do not impose user licensing restrictions. Users can log in above their licensed user limit.
Troubleshooting
How do I download a log bundle from the textual UI?
If the textual UI is not open, launch the web console from your VM or SSH login from an external terminal as a viewer user.
In the textual UI menu, select Log Bundle.
Use scp/sftp to download the log bundle to your home directory.
Use the viewer account to download the log bundle after it is generated.
Is the system diagnostics data available through the API, or exportable to support automated monitoring of system health? Or are there already provisions for automated monitoring in place?
The System Diagnostics page in Cortex XSOAR 8 On-prem provides visibility on Cortex XSOAR cluster health and enables downloading log bundles. We don't yet have API support.
Last updated
Was this helpful?