Content management in multi-tenant
Manage multi-tenant content in Cortex XSOAR 8.10 On-prem.
Content (including integrations) can be configured on the main tenant or child tenants.
If creating content on the Main Tenant, you can push that content to child tenants. Usually, if the content applies to all child tenants, it should be configured on the main tenant and pushed to the child tenants. In some cases, you may need to configure an integration on the child tenant only. For example, the end-user has the information needed to configure a specific integration but does not want that information stored on the main tenant. Also, any integration that fetches incidents or indicators (feeds) must be configured on the child tenant, since incidents are not stored on the main tenant.
Content dependencies
Content that is synced from the main tenant, includes not just the content item but also dependencies. In Cortex XSOAR, there are multiple layers of dependency relationships. For example, a classifier depends on an incident type, an incident type depends on a layout, layouts depend on fields, and fields depend on scripts.
For a basic example of content dependencies, see the Phishing - Generic v3 playbook, which contains 43 scripts. The scripts are dependencies of the playbook, which needs them to execute properly. You can view playbook dependencies under the Propagation Labels field in the playbook Settings.
When syncing content from the main tenant to child tenants, content includes these dependencies.
Note
Content dependencies are calculated recursively, so that if, for example, Playbook A uses Playbook B (dependency), which in turn uses scripts C and D (dependencies), all of the dependencies (Playbook B and scripts C and D) will be included along with Playbook A.
Propagation labels
When syncing content from the Main Account, you can use propagation labels to decide what content to push and which child tenant you want to push content to. You can add propagation labels to the following:
Child tenants
Content items
Tip
We recommend that you first apply propagation labels to your child tenants and then add the corresponding labels to the content items that you want to sync to the child tenants.
For a content item to be synced to a child tenant, both the content and child tenant must have the same propagation label. For example, if you want Playbook ABC to sync to Tenant 123, they both need to have the same propagation label, such as Premium. Content is pushed to tenants by matching propagation labels.
When creating or editing content, you can add the following propagation labels for syncing content to a child tenant:
All
Content items with the all label are synced to all child tenants, regardless of whether the child tenants have labels. This is the default label for content items.
Custom
Add custom labels by typing a label name in the Propagation Labels field when adding or editing a content item or when selecting the child tenant and clicking Propagation Labels on the Tenant Management page.
For more information about adding propagation labels to content, see Add propagation labels to content.
If an integration has the same settings for multiple child tenants, you can configure the integration on the main tenant and propagate it to multiple child tenants. For more information, see Add propagation labels to a child tenant.
Note
If a content item does not have any labels, it will not be synced to any child tenants. If a child tenant does not have any labels, only content items with the all propagation label will sync to it.
If there is no propagation label on your content, for example, a script or playbook, but it is a dependency of a package that you propagate to a tenant, the unlabeled content is still synced to the tenant.
If the content includes dependencies, these dependencies appear during the sync process, even if their propagation labels don’t match that of the tenant, as long as the labels of the parent content match the child tenant labels.
When using a remote repository with a multi-tenant deployment, the remote repository must be configured and a machine must be set as the development environment, before you can view propagation labels. For more information, see Manage content using a remote repository.
Example
The following example demonstrates how propagation labels work with content dependencies.
The playbook has a test propagation label, which matches the child tenant's label, but the scripts contained within the playbook have a propagation label of test1, which differs from that of the playbook.
Playbook
Script
Even though the script propagation label does not match that of the tenant, the content is still propagated to tenants during the sync process.
If there is no relevant propagation tag on your content, for example, a script or playbook, but it is a dependency of a package that you propagate to a tenant, the unlabeled content is still synced to the tenant.
Add propagation labels to content
You can add propagation labels when creating a new content item or when editing an existing item.
The default propagation label for all content items is all.
Tip
We recommend that you first apply propagation labels to your child tenants and then add the corresponding labels to the content items that you want to sync to the tenants.
The following content items support propagation labels:
Playbooks
Scripts
Integrations and integration instances
Indicator fields, types, and layouts
Incident fields, types, and layouts
Threat Intel Report types, fields, and layouts
Classifiers and mappers
Evidence fields
Pre-process rules
Lists
Widgets
Dashboards
Note
When installing a content pack from the Marketplace, the default propagation label is set to all. If you want to change the propagation label, after installation, go to the INSTALLED CONTENT PACKS tab on the Marketplace page and click the propagation button for the content pack. If a content item is part of a content pack and is not specifically labeled, it inherits the content pack’s propagation labels. If labels are specified, it propagates according to those labels.
For a non-content item such as an integration instance, if you want to propagate the instance, you need to apply propagation labels both to the integration and to the integration instance. If a tenant does not have the integration installed, the instance will not be propagated even if the propagation label exists both on the main tenant and child tenant.
If you want to create new propagation labels or add existing ones, ensure that you have the required permissions. For more information, see Role-based permissions.
Go to the content item that you want to add a propagation label to.
In the Propagation Labels field, add the relevant labels by either selecting an existing label or typing a new label. After typing a new label and pressing
Enter, the label is available immediately for use. If you instead keep the defaultalllabel, the content syncs to all child tenants. For example, when editing or creating a playbook, in the PLAYBOOK SETTINGS section, in the Propagation Labels field, add the label as required.
Add propagation labels to a child tenant
The propagation labels that you add to the child tenant determine which content items sync to the tenant. This information is intended for existing child tenants.
If you want to create new propagation labels or add existing ones, ensure that you have the necessary permissions. For more information, see Role-based permissions.
Tip
We recommend that you first apply propagation labels to your child tenants and then add the corresponding labels to the content items that you want to sync to the child tenants.
In the Main Tenant, go to Settings & Info → Settings → Tenant Management.
Select the tenant that you want to add propagation labels to and click Propagation Labels.
Select existing propagation labels or type new propagation labels.
Sync content to child tenants
The content that you sync from the main tenant to the child tenants might add, override, or remove content from the child tenants. New content items, that do not currently exist on the child tenants, are added. When you sync content to child tenants, there can potentially be content items added.
Note
There may be instances where a child tenant is disconnected for whatever reason when content is supposedly synced. The Cortex XSOAR on-prem main tenant displays the exact reason why the child tenant is disconnected and is unable to receive any updates. We recommend to review the Tenant Management page on the main tenant to resolve the issue.
Add
New content items that do not currently exist on the child tenants will be added.
Override
For content items that are being pushed in the sync operation and that already exist on the child tenants, the sync operation overrides the existing content on the child tenants
Remove
For content items that were removed from the main tenant and which already exist on the child tenants, the sync operation removes the existing content from the child tenants.
You should review each content item and its dependencies before syncing the content. You have the option to remove items before executing the sync operation for a single tenant.
Before you begin
Ensure that your user roles have view or view/edit permission to sync to child tenants. For more information, see Role-based permissions.
Add propagation labels to child tenants.
Add propagation labels to content.
From the Tenant Management, from the Main Tenant, you can click the link of the child tenant to access the child tenant.
How to sync content
In the Main Tenant, go to Settings & Info → Settings → Tenant Management.
Select the tenant you want to sync.
If you select one tenant, you can review which content sync. If you select two or more tenants, you can't review the content before syncing.
Select one of the following options to sync content.
To review the content before syncing to a child tenant, select a child tenant, and click Sync.
Review all content affected by the sync operation in the ADD, OVERRIDE, and REMOVE tabs.
If there are playbooks listed in the OVERRIDE tab, select or clear the checkbox to Override playbook inputs in the child tenant.
If the Run on field has changed in the script, select or clear the Overwrite script run-on to override this field in the child tenant.
To sync content to child tenants without manual review, select two or more child tenants and then click Sync.
This option automatically updates new, and existing content to the child tenant, and removes outdated content. If there are playbooks and scripts, select or clear the checkbox to Override playbook inputs and script run-on-settings in the child tenant.
Click Sync.
Note
If you sync a content item from the main tenant to a child tenant, and a content item with that same name already exists on the child tenant, the content on the child tenant is overwritten. This applies to integrations, fields, incident types, and Threat Intel report types.
Manage content using a remote repository
If you are working with remote repositories, and want to use selective propagation to add propagation labels to content, you need to follow the steps described in this task.
Before you begin, if you haven't done so already, set up a remote repository, as described in Content management in Cortex XSOAR.
In the development environment, do the following.
Add propagation labels to content as needed.
Push content to the production tenant.
For more information, see Push content from a development tenant
In the production tenant, do the following:
Install the content that is pushed from the development tenant. For more information, see Install content on a production tenant.
Confirm that the propagation labels were added to the content and that the labels are available for use, by going to Settings & Info → Settings → Tenant Management.
Add propagation labels to child tenants. For more information, see Add propagation labels to a child tenant.
Sync content to child tenants. For more information, see Sync content to child tenants.
Last updated
Was this helpful?