> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/install-cortex-xsoar/install-cortex-xsoar-on-a-vm-deployed-on-kvm/task-7.-install-cortex-xsoar-on-your-vm.md). # Task 7. Install Cortex XSOAR on your VM Install Cortex XSOAR 8.13 On-prem on your virtual machine. {% hint style="warning" %} ### **Prerequisite** **DNS record configuration**\ Ensure the following DNS records were added to your DNS server to resolve hostnames to the cluster IP address (only static, DHCP is not supported). These DNS records (for a given tenant) should all point to the same cluster IP address to ensure a single entry point. For MSSP, each tenant must have its own set of **`xsoar.*`**, **`api-*`**, and **`ext-*`** FQDNs pointing to the tenant cluster's single entry point. * **`xsoar..`**: The Cortex XSOAR DNS name for accessing the UI. For example, **`xsoar.mycompany.com`**. * **`api-.`**: The Cortex XSOAR DNS name mapped to the API IP address. For example, `api-xsoar.mycompany.com`. * **`ext-.`**: The Cortex XSOAR DNS name mapped to the external IP address. For example, `ext-xsoar.mycompany.com`. **Certificate requirements**\ If you use a custom TLS certificate, it must cover the cluster, API, and external addresses either in the Common Name (CN) or, preferably as Subject Alternative Names (SANs). Using a wildcard certificate (such as `*.mycompany.com`) is the simplest option. The installer does not verify if these hostnames are included in your certificate. If any address is missing, installation may complete successfully, but your engines, brokers, and APIs will fail to connect later with TLS host name verification errors. {% endhint %} 1. From the textual UI menu, select Cluster Installation. The virtual machine you use to run the installer will deploy Cortex XSOAR on all virtual machines in a cluster. For a single virtual machine (standalone), configure the settings for a single node. 2. Configure the following settings.

The IPs of all VMs (nodes) in a cluster as well as the virtual IP must be on the same subnet, they currently cannot be split across subnets.

You can only change these field values in the textual UI menu before installing. To change these values after installing, you need to redeploy your cluster and then reinstall. Contact support or engineering for assistance.

| Field | Description | | -------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Cluster Nodes | A list of IPs of all virtual machines/nodes in the cluster, separated by a space. For example, `10.196.37.10 10.196.37.11 10.196.37.12` | | Cluster FQDN |

The Cortex XSOAR environment DNS name. For example, \.\.\

For a single node: This field value must be registered in your DNS server so the FQDN will be resolved to the IP of the node.

Cortex XSOAR supports only static IP addresses for each virtual machine in the cluster, it does not support a DHCP (dynamic IP) network interface.

| | Virtual IP (optional) | The Cortex XSOAR environment virtual IP for the multi-node cluster. It is a virtual interface assigned to one of the nodes to provide a single access point to the cluster. The virtual IP address must be a dedicated, available IP address that is not assigned to any nodes in the cluster. | | Installation Mode |

The tenant installation type. Options to select from are:

  • Enterprise (for non-multi-tenant installation, including production and development tenants)
  • (Multi-Tenant) Parent Tenant
  • (Multi-Tenant) Child Tenant
| | Cluster Region | The region the cluster is located in. For example, US. | | Cortex XSOAR Admin Email, Password, and Confirm Password |

Credentials for the first user to log in to Cortex XSOAR.

The password must be at least eight characters long and contain at least:

  • One lower case letter
  • One upper case letter
  • One number, or one of the following special characters: !@#%
| | Migration Mode | Relevant for migration from Cortex XSOAR 6. If checked, the migration wizard starts in the Cortex XSOAR 8 tenant. This cannot be changed at a later stage. | 3. Select Install. Verify all nodes meet the required hardware and network requirements, and select Install again. The virtual machine you use to run the installer will deploy Cortex XSOAR on all virtual machines in a cluster. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/install-cortex-xsoar/install-cortex-xsoar-on-a-vm-deployed-on-kvm/task-7.-install-cortex-xsoar-on-your-vm.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.