Task 7. Install Cortex XSOAR on your VM

Install Cortex XSOAR 8.10 On-prem on your virtual machine.

Prerequisite

DNS record configuration Ensure the following DNS records were added to your DNS server to resolve hostnames to the cluster IP address (only static, DHCP is not supported). These DNS records (for a given tenant) should all point to the same cluster IP address to ensure a single entry point. For MSSP, each tenant must have its own set of xsoar.*, api-*, and ext-* FQDNs pointing to the tenant cluster's single entry point.

• xsoar.<hostname>.<domain>: The Cortex XSOAR DNS name for accessing the UI. For example, xsoar.mycompany.com.

• api-<hostname>.<domain>: The Cortex XSOAR DNS name mapped to the API IP address. For example, api-xsoar.mycompany.com.

• ext-<hostname>.<domain>: The Cortex XSOAR DNS name mapped to the external IP address. For example, ext-xsoar.mycompany.com.

Certificate requirements If you use a custom TLS certificate, it must cover the cluster, API, and external addresses either in the Common Name (CN) or, preferably as Subject Alternative Names (SANs). Using a wildcard certificate (such as *.mycompany.com) is the simplest option.

The installer does not verify if these hostnames are included in your certificate. If any address is missing, installation may complete successfully, but your engines, brokers, and APIs will fail to connect later with TLS host name verification errors.

1. From the textual UI menu, select Cluster Installation.

   The virtual machine you use to run the installer will deploy Cortex XSOAR on all virtual machines in a cluster.

   For a single virtual machine (standalone), configure the settings for a single node.

2. Configure the following settings.

   The IPs of all VMs (nodes) in a cluster must be on the same subnet, they currently cannot be split across subnets.

   You can only change these field values in the textual UI menu before installing. To change these values after installing, you need to redeploy your cluster and then reinstall. Contact support or engineering for assistance.

   Field	Description
   Cluster Nodes	A list of IPs of all virtual machines/nodes in the cluster, separated by a space. For example, 10.196.37.10 10.196.37.11 10.196.37.12 Copy the IP of each VM from the Private IPv4 address in the OCI Instance information tab and paste it in this field, separated by a space.
   Cluster FQDN	The Cortex XSOAR environment DNS name. For example, <subdomain>.<domain name>.<top level domain> Copy the FQDN from the Internal FQDN field in the OCI Instance information tab and paste it in this field. For a single node: This field value must be registered in your DNS server so the FQDN will be resolved to the IP of the node. Cortex XSOAR supports only static IP addresses for each virtual machine in the cluster, it does not support a DHCP (dynamic IP) network interface.
   Installation Mode	The tenant installation type. Options to select from are: Enterprise (for non-multi-tenant installation, including production and development tenants) (Multi-Tenant) Parent Tenant (Multi-Tenant) Child Tenant
   Cluster Region	The region the cluster is located in. For example, US.
   Cortex XSOAR Admin Email, Password, and Confirm Password	Credentials for the first user to log in to Cortex XSOAR. The password must be at least eight characters long and contain at least: One lower case letter One upper case letter One number, or one of the following special characters: !@#%
   Migration Mode	Relevant for migration from Cortex XSOAR 6. If checked, the migration wizard starts in the Cortex XSOAR 8 tenant. This cannot be changed at a later stage.

3. Select Install.

   Verify all nodes meet the required hardware and network requirements, and select Install again.

   The virtual machine you use to run the installer will deploy Cortex XSOAR on all virtual machines in a cluster.