> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/multi-tenant/onboard-cortex-xsoar-multi-tenant/step-3.-set-up-an-engine.md).

# Step 3. Set up an engine

Engines created on child tenants use a different encryption handshake for each child tenant and connect back to the child tenant through the main tenant.

{% hint style="info" %}

### Note

This process is optional. Follow the steps if required.
{% endhint %}

1. Download and install the engine.

   1. On the main tenant, go to **Settings & Info** → **Settings** → **Integrations** → **Engines**.
   2. **Create New Engine**.
   3. Select and download the appropriate installer file.
   4. Install the engine on the appropriate remote machine.

   For detailed engine installation instructions, see [Install an engine](/cortex-xsoar-8-on-prem/8.12/configure-cortex-xsoar/engines/install-an-engine.md).
2. Propagate the engine to tenants.
   1. On the main tenant, go to **Settings & Info** → **Settings** → **Integrations** → **Engines**, and select the engine.
   2. Click **Load-Balancing and Propagation**.
   3. Assign one or more engine propagation labels.

      <div data-gb-custom-block data-tag="hint" data-style="info" class="hint hint-info"><h3>Note</h3><p>By default, engines do not have a propagation label. You must define a propagation label (such as <strong>all</strong>) in the engine to successfully sync it to a child tenant, unless you configured the system to auto-propagate everything.</p></div>
   4. If you want to allow the use of the engine for tenant-specific integration instances, select **Allow tenants to use this engine for custom integration instances**.

      If you do not select this option, the engine can only be used with integration instances that were assigned to the engine on the main tenant level and were propagated to tenants.

      <div data-gb-custom-block data-tag="hint" data-style="info" class="hint hint-info"><h3>Note</h3><p>If an engine is shared among several tenants, the integration instances configured to work on that engine must have unique names across all the tenants. If they do not have unique names, subsequent instances will error out due to how the platform internally references each instance's Docker container.</p></div>
   5. Go to **Settings & Info** → **Settings** → **Tenant Management**, and **Sync** your selected tenant(s).
3. Verify that the engine is connected, by going to Settings & Info → **Settings** → Integrations → **Engines**.

   Ensure that the engine machine can communicate with the main tenant. You can use Telnet, or any similar tool to check the engine has access to the main tenant before you install it. If there is a firewall you may need to allow access from the machine that hosts the engine, so that it can communicate back on port 443 (or any other port the main host may use) or set an `ANY ANY` rule.

   <div data-gb-custom-block data-tag="hint" data-style="info" class="hint hint-info"><h3>Important</h3><p>Avoid setting up integration instances, such as a Generic Webhook, in the Main tenant of a multi-tenant environment. This configuration is not supported because the Main tenant cannot fetch data. If you configure an instance in the Main tenant and set it to use an engine, the engine will not run and the required TCP port will not start.</p></div>


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/multi-tenant/onboard-cortex-xsoar-multi-tenant/step-3.-set-up-an-engine.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.