> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.7/onboard-cortex-xsoar/cortex-xsoar-installation/install-cortex-xsoar-on-a-vm-deployed-on-oci.md).

# Install Cortex XSOAR on a VM deployed on OCI

The following procedure describes the steps for deploying an OVA image on OCI and then installing Cortex XSOAR on your deployed virtual machines.

{% hint style="info" %}

### Important

The IPs of all VMs (nodes) in a cluster as well as the virtual IP must be on the same subnet, they currently cannot be split across subnets.
{% endhint %}

<details>

<summary>Task 1. Download the OVA image and license from Cortex Gateway</summary>

To install a Cortex XSOAR 8 tenant, you need to log into Cortex Gateway, which is a portal for downloading the relevant image file and license. Downloading a file image from Cortex Gateway ensures you have the latest pre-configured software package for easy deployment and updates. If you have multiple or development tenants, you must repeat these tasks for each tenant.

{% hint style="warning" %}

### Prerequisite

* A Customer Support Portal (CSP) account.

  You need to set up your CSP account. For more information, see [How to Create Your CSP User Account](https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClNVCA0).

  When you create a CSP account you can set up two-factor authentication (2FA) to log into the CSP, by using an Email, Okta Verify, or Google Authenticator (non-FedRAMP accounts). For more information, see [How to Enable a Third Party IdP](https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA14u000000sZ8mCAE).
* Have one of the following roles assigned:

  | Role        | Details                                                                                                                                                                                                                                                               |
  | ----------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
  | CSP role    | The Super User role is assigned to your CSP account. The user who creates the CSP account is granted the Super User role.                                                                                                                                             |
  | Cortex role | <p>You must have the Account Admin role.</p><p>If you are the first user to access Cortex Gateway with the CSP Super User role, you are automatically granted Account Admin permissions for the Cortex Gateway. You can also add Account Admin users as required.</p> |
* To download the Cortex XSOAR 8 images from Cortex Gateway, you need a license (or evaluation license via sales) assigned to your CSP account.
* Review the [System requirements](/cortex-xsoar-8-on-prem/8.7/onboard-cortex-xsoar/cortex-xsoar-installation/system-requirements.md) for deploying a Cortex XSOAR tenant.
* Have a basic understanding of how to deploy the OVA file format.
* For VMWare ESXi 6.5 and later, you need hardware version 13.
  {% endhint %}

How to download the image and license

1. Log in to [Cortex Gateway](https://cortex-gateway.paloaltonetworks.com/accounts).
2. In the **Available for Activation** section, use the serial number to locate the tenant to download.

   By default, the **Production-Standalone** license is selected. You can also select **Dev**.

   Production and development are separate Kubernetes clusters with no dependency between them. For example, you can deploy a three-node cluster for production and a standalone node for development, or you can support small-scale for development and large-scale for production.

   If you want to use a production and a development tenant with a private remote repository, select **Dev**. If you don't select it now, you can install a development tenant later.
3. Select **Download On Prem**.
4. Click **Next**.
5. Select the OVA image format to download.

   OVA is supported by AWS, Oracle Cloud Infrastructure (OCI), and VMWare (for example, VSphere).
6. Select the checkbox to agree to the terms and conditions of the license and click **Download**.

   <div data-gb-custom-block data-tag="hint" data-style="info" class="hint hint-info"><h3>Tip</h3><p>In Google Chrome, to download the image and license files together, you may need to set the the browser <strong>Settings</strong> → <strong>Privacy and security</strong> → <strong>Site settings</strong> → <strong>Additional permissions</strong> → <strong>Automatic downloads</strong> to the default behavior <strong>Sites can ask to automatically download multiple files</strong>.</p></div>

   Two files download: A zipped license file containing one or more JSON license files with instructions, and a zipped image file of the type you selected (.ova, .vhd)
7. Extract (unzip) the license and image files.

</details>

<details>

<summary>Task 2. Deploy your virtual machine on OCI</summary>

Currently, only Oracle Public Cloud is supported (not Government Cloud).

If you set your Cortex XSOAR environment as a standalone (single node), you cannot add nodes to it and switch to a cluster. If you deploy three nodes, you can later add nodes and expand the cluster. For more information, see [Manage nodes in a cluster](/cortex-xsoar-8-on-prem/8.7/onboard-cortex-xsoar/cortex-xsoar-installation/post-installation/optimize-performance-and-robustness-from-the-textual-ui.md#UUID-16e8f05d-3d05-3da9-7f90-00305ee4c18d).

{% hint style="info" %}

### Important

To implement built-in High Availability, deploy a cluster with three nodes (VMs), with each VM on a different hypervisor. This ensures that if one hypervisor fails, the other VMs continue to operate.

You then need to:

* Establish trust between all nodes in the cluster (Task 5).
* Set the **Cluster FQDN** to the reverse proxy/ingress controller IP address (Task 6). The reverse proxy/ingress controller serves as a single entry point to distribute traffic across the nodes in the cluster.
  {% endhint %}

1. In OCI, upload the OVA image file to a private bucket.

   <div data-gb-custom-block data-tag="hint" data-style="info" class="hint hint-info"><h3>Note</h3><p>Make sure the bucket is private and secure.</p></div>
2. Import the image from the bucket into the OCI environment.
3. Disable CPU logging and performance (DRS). For more information, see Oracle [Define or Edit Server Pool Policies](https://docs.oracle.com/cd/E50245_01/E50250/html/vmusg-svrpool-policy-configure.html).
4. Create the instance.
5. Create a block volume.

   The block volume size depends on the scale you want to use. For example, 1024 GB (1TB) corresponds to the hardware requirements for a small scale deployment with a 256 GB boot disk plus an additional separate 775 GB data disk.

   <div data-gb-custom-block data-tag="hint" data-style="warning" class="hint hint-warning"><h3>Important</h3><p>Every virtual machine is provided with a 256 GB hard disk to run the OS. However, you also need to add an extra hard disk for each virtual machine instance you want to deploy to run the application.</p><p>All virtual machines in a cluster must have the same storage size.</p><p>To ensure successful deployment, make sure the hard disks meet performance requirements detailed in the <a href="/spaces/nUU1VSuYCuN7HtSKxsVU/pages/pmv1fGC3mqmIY07X3XPs">System requirements</a>.</p></div>
6. Attach the block volume to the running instance.

   <div data-gb-custom-block data-tag="hint" data-style="info" class="hint hint-info"><h3>Note</h3><p>The attachment type needs to be Paravirtualized (and not iSCSI).</p></div>
7. Repeat these steps for each VM in a cluster.
8. For first time login, open an external terminal and use the `ssh admin<server ip address>` command to SSH log in. The default user name and password is `admin`.

   ![](https://paloaltonetworks.fluidtopics.net/api/khub/maps/VpFvGNmm_LKax62aqKBcmg/resources/3AZZ1UQP~k9aGL09P0bNug-VpFvGNmm_LKax62aqKBcmg/content?v=c7ebdd435a3f56c7\&Ft-Calling-App=ft/turnkey-portal)

   Give the admin a new password as follows.

   <div data-gb-custom-block data-tag="hint" data-style="warning" class="hint hint-warning"><h3>Important</h3><p>Save the SSH password securely. If you lose this password you cannot recover or change it, and to use SSH you will need to redeploy the cluster.</p></div>

   The password must be at least eight characters long and contain at least:

   * One lower case letter
   * One upper case letter
   * One number, or one of the following special characters: !@#%

   If this is not a first time login, you can log in from the web console or from a terminal using the `ssh admin@<server ip address>` command to SSH log in.

   The textual UI menu opens with all the configuration and installation options.

   <div data-gb-custom-block data-tag="hint" data-style="info" class="hint hint-info"><h3>Tip</h3><ul><li>To start using the textual UI, click anywhere on the screen.</li><li>To navigate between the menu items, use the up and down arrow keys. To select a menu item, press the Enter key.</li><li>To navigate between fields within a menu item, use the Tab key. To save settings, tab to the Save button and press the Enter key.</li><li>To go back to the menu from a specific menu item field, press the esc key.</li></ul></div>

</details>

<details>

<summary>Task 3. Validate tenant network and IP settings</summary>

Since the Cloud platform handles network and IP settings, you can skip the Host Configuration menu in the textual UI.

Confirm the following network and IP settings are added to the rules of the security group or the firewall rules for each node in a cluster (for standalone there is just a single node). If they are not added to the rules, the installation may fail.

**Port configurations**

**Communication ports**

For standalone (one VM) and a three-node cluster (three VMs):

| Port | Protocol | Purpose            |
| ---- | -------- | ------------------ |
| 22   | TCP      | SSH communication  |
| 8880 | TCP      | Node communication |

**Control plane ports**

A Kubernetes cluster consists of a control plane and one or more worker nodes. For Cortex XSOAR, in standalone (one VM), the VM acts as both control plane and as a worker node. In multi-node clusters, the first three nodes act as both control plane and as worker nodes, and any additional node added acts as a worker node.

| Name                    | Port  | Protocol |
| ----------------------- | ----- | -------- |
| etcd client port        | 2379  | TCP      |
| etcd peer port          | 2380  | TCP      |
| Kubernetes API          | 6443  | TCP      |
| Kubelet API             | 10250 | TCP      |
| kube-scheduler          | 10257 | TCP      |
| kube-controller-manager | 10259 | TCP      |

**Worker node port**

| Name                | Port        | Protocol |
| ------------------- | ----------- | -------- |
| kube nodeport range | 30000:32767 | TCP      |

**Intra-node port**

For a multi-node cluster (three VMs):

| Name                       | Port  | Protocol |
| -------------------------- | ----- | -------- |
| Calico with IPv4 Wireguard | 51820 | UDP      |

**URLs**

Check the following URLs to ensure Cortex XSOAR operates properly.

<table data-header-hidden="false" data-header-sticky><thead><tr><th>Function</th><th>Service</th><th>Port</th><th>Direction</th></tr></thead><tbody><tr><td>Web interface</td><td>HTTPS</td><td>443</td><td>Inbound</td></tr><tr><td>Engine connectivity</td><td>HTTPS</td><td>443 (configurable)</td><td>Inbound</td></tr><tr><td>Integrations</td><td>Integration-specific ports</td><td></td><td>Outbound</td></tr><tr><td>Unit42 Intel Inventory (TIM license)</td><td>https://unit42intel.xsoar.paloaltonetworks.com</td><td>443</td><td>Outbound</td></tr><tr><td>Marketplace</td><td><ul><li><p>https://marketplace.xsoar.paloaltonetworks.com/</p><p>Download content packs and view the Marketplace (to view content pack images, the domain should also be reachable from the browser).</p></li><li><p>storage.googleapis.com</p><p>Download content packs and view the Marketplace. This domain stores content pack artifacts (to view content pack images, the domain should also be reachable from the browser). It is possible to further limit the url prefix to: <a href="https://storage.googleapis.com/marketplace-dist/">https://storage.googleapis.com/marketplace-dist/</a></p></li><li><p>api.demisto.com</p><p>Download content Packs and view the Marketplace (this file maps the Marketplace URL to the Cortex XSOAR version).</p><p>You must add marketplace.xsoar.paloaltonetworks.com, storage.googleapis.com, and api.demisto.com otherwise you cannot access the Marketplace.</p></li><li><p>xsoar-contrib.pan.dev</p><p>Contribute content packs.</p></li></ul></td><td>443</td><td>Outbound</td></tr><tr><td>On-prem Gateway</td><td><p>onpremgw.crtx.[region].paloaltonetworks.com</p><p>Cortex XSOAR accesses new versions from and uploads licenses to this repository.</p></td><td>443</td><td>Outbound</td></tr><tr><td>Download packages required for installation</td><td><ul><li>deb.debian.org</li><li>security.debian.org</li></ul></td><td>80</td><td>Outbound</td></tr></tbody></table>

**NTP**

Ensure all nodes are synchronized with no NTP offset in order to prevent degraded storage performance.

</details>

<details>

<summary>Task 4. (Optional) Configure proxy settings</summary>

When a proxy is configured in Cortex XSOAR, the system by default routes internal node-to-node communication and other internal traffic through that configured proxy. If you do not configure a proxy, the system uses standard network routing and DNS resolution.

If you want to use a proxy, define the proxy address and port settings. The proxy can be set at any point, during Cortex XSOAR deployment or at a later stage.

1. From the textual UI menu, select Proxy Configuration.
2. Configure the following settings.
   * Proxy Address

     You can either enter the address as `IP:port` without a `http://` or `https://` prefix, or enter the host name.
   * Proxy Port
3. Select Save.

</details>

<details>

<summary>Task 5. Establish trust between all nodes in a cluster</summary>

This task is not relevant for a standalone deployment (single node).

For each VM (node) in a cluster, the nodes must have SSH connections between them, where all the nodes trust one another. To establish trusted connections in a cluster, one node is designated as the signing server host, generating a token for secure communication and authentication. Other nodes connect to the host using the token displayed on the host's screen.

The IPs of all VMs (nodes) in a cluster as well as the virtual IP must be on the same subnet, they currently cannot be split across subnets.

To implement built-in High Availability, after establishing trust between all nodes in a cluster, in the cluster installation step (Task 6) you need to set a single entry point to distribute traffic across the nodes in the cluster. Do this by setting the Cluster FQDN to either the virtual IP address or to the reverse proxy/ingress controller IP address.

1. In the textual UI menu for the VM you want to be the host, select Connect Nodes.
2. Select Host.

   ![](https://paloaltonetworks.fluidtopics.net/api/khub/maps/VpFvGNmm_LKax62aqKBcmg/resources/BYVbniBMypiX91tU1r0z5Q-VpFvGNmm_LKax62aqKBcmg/content?v=de436d249e4adcb4\&Ft-Calling-App=ft/turnkey-portal)

   A message displays that this action cancels prior trust established with other nodes. Select Yes to continue.

   This node becomes the host, and a token is generated on the screen. Copy the token, for example:

   ![](https://paloaltonetworks.fluidtopics.net/api/khub/maps/VpFvGNmm_LKax62aqKBcmg/resources/2uKeEik_S45WXZ7BKkLW3Q-VpFvGNmm_LKax62aqKBcmg/content?v=4d4f542d02b7292b\&Ft-Calling-App=ft/turnkey-portal)

   Keep this window open (do not select Stop) until trust is established between all nodes to enable the host to listen for the token from the other nodes.
3. In the textual UI for each additional node (VM) in the cluster:

   1. Select Connect Nodes.
   2. Select Join.
   3. Paste the Token generated for the host.
   4. Enter the Host IP Address.
   5. Select Submit.

   ![](https://paloaltonetworks.fluidtopics.net/api/khub/maps/VpFvGNmm_LKax62aqKBcmg/resources/HQJuCEvSxXaane_1Y9LeTA-VpFvGNmm_LKax62aqKBcmg/content?v=9ebb8856dc75d4a2\&Ft-Calling-App=ft/turnkey-portal)

   A message displays that this action cancels prior trust established with other nodes. Select Yes to continue.
4. Select OK.
5. After trust is established between all the nodes in the cluster, go back to the host node and select Stop to close the listening window.

</details>

<details>

<summary>Task 6. Install Cortex XSOAR on your VM</summary>

{% hint style="info" %}

### Prerequisite

Ensure the following DNS records were added to your DNS server to resolve hostnames to the cluster IP address. Only static records are supported. DHCP is not supported.

All DNS records for a tenant must point to the same cluster IP address.

* **`xsoar.<hostname>.<domain>`**: The Cortex XSOAR DNS name for accessing the UI. For example, **`xsoar.mycompany.com`**.
* **`api-<hostname>.<domain>`**: The Cortex XSOAR DNS name that is mapped for API access. For example, **`api-xsoar.mycompany.com`**. This should be a CNAME entry pointing to the same cluster IP address.
* **`ext-<hostname>.<domain>`**: The Cortex XSOAR DNS name that is mapped to access long running integrations. For example, **`ext-xsoar.mycompany.com`**. This should be a CNAME entry pointing to the same cluster IP address.
  {% endhint %}

1. From the textual UI menu, select Cluster Installation.

   The virtual machine you use to run the installer will deploy Cortex XSOAR on all virtual machines in a cluster.

   For a single virtual machine (standalone), configure the settings for a single node.
2. Configure the following settings.

   <div data-gb-custom-block data-tag="hint" data-style="warning" class="hint hint-warning"><h3>Important</h3><p>The IPs of all VMs and the virtual IP must use the same subnet.</p><p>You can only change these values before installation. To change them later, redeploy and reinstall the cluster. Contact Support or Engineering for assistance.</p></div>

   | Field                                                    | Description                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  |
   | -------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
   | Cluster Nodes                                            | <p>A list of IPs of all virtual machines/nodes in the cluster, separated by a space. For example, <code>10.196.37.10 10.196.37.11 10.196.37.12</code></p><p>Copy the IP of each VM from the Private IPv4 address in the OCI Instance information tab and paste it in this field, separated by a space.</p>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   |
   | Cluster FQDN                                             | <p>The Cortex XSOAR environment DNS name. For example, <code>\<subdomain>.\<domain name>.\<top level domain></code></p><p>Copy the FQDN from the Internal FQDN field in the OCI Instance information tab and paste it in this field.</p><p>For a single node: This field value must be registered in your DNS server so the FQDN will be resolved to the IP of the node.</p><p>For a multi-node cluster: To implement built-in HA using a reverse proxy/ingress controller, you need to set this field value to match the IP of the reverse proxy/ingress controller, and it must be registered in your DNS server so the FQDN will be resolved to the IP of the reverse proxy/ingress controller.</p><p>The reverse proxy/ingress controller IP address serves as a single entry point for the entire Cortex XSOAR cluster. The reverse proxy/ingress controller checks the health endpoint of the node for any issues. If the node is healthy it can be used to process requests. To use a reverse proxy/ingress controller IP address:</p><ul><li>Set access to the cluster nodes through port 443.</li><li>Use HTTP 10254 with the path <code>/healthz</code> as the health endpoint.</li></ul><p>Cortex XSOAR supports only static IP addresses for each virtual machine in the cluster, it does not support a DHCP (dynamic IP) network interface.</p> |
   | Virtual IP (optional)                                    | <p>The Cortex XSOAR environment virtual IP for the multi-node cluster. It is a virtual interface assigned to one of the nodes to provide a single access point to the cluster. The virtual IP address must be a dedicated, available IP address that is not assigned to any nodes in the cluster.</p><p>Do not fill in this field (Cortex XSOAR does not support virtual IPs in Cloud deployments).</p>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      |
   | Cluster Region                                           | The region the cluster is located in. For example, US.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       |
   | Cortex XSOAR Admin Email, Password, and Confirm Password | <p>Credentials for the first user to log in to Cortex XSOAR.</p><p>These fields can only be changed <strong>before</strong> installation, so it is important to keep this information secure. To change values like username or password after installation, you will need to redeploy your cluster and reinstall. Contact support or engineering for assistance.</p><p>For the Cortex XSOAR Admin Email, we recommend using a service account rather than a specific user email address since this cannot be changed after installation.</p><p>The password must be at least eight characters long and contain at least:</p><ul><li>One lower case letter</li><li>One upper case letter</li><li>One number, or one of the following special characters: !@#%</li></ul>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      |
3. Select Install.

   Verify all nodes meet the required hardware and network requirements, and select Install again.

   ![](https://paloaltonetworks.fluidtopics.net/api/khub/maps/VpFvGNmm_LKax62aqKBcmg/resources/gpnt0ugV8bI0Dr1S9I2ECw-VpFvGNmm_LKax62aqKBcmg/content?v=888696c54611ad52\&Ft-Calling-App=ft/turnkey-portal)

   The virtual machine you use to run the installer will deploy Cortex XSOAR on all virtual machines in a cluster.

</details>

<details>

<summary>Task 7. Verify you can log in to Cortex XSOAR</summary>

After the installation tasks run, an Installation completed successfully message displays in the textual UI. However, you need to wait until the installation process fully completes (approximately 30 minutes) and then check that you can log in to Cortex XSOAR. You then need to upload your license to enable all Cortex XSOAR pages.

1. Log in to Cortex XSOAR.

   When you log in for the first time, use the Admin password and email you set during installation.
2. Upload your license to Cortex XSOAR.

   For more information, see [Add the Cortex XSOAR license](/cortex-xsoar-8-on-prem/8.7/onboard-cortex-xsoar/cortex-xsoar-installation/post-installation/add-the-cortex-xsoar-license.md).

</details>


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.7/onboard-cortex-xsoar/cortex-xsoar-installation/install-cortex-xsoar-on-a-vm-deployed-on-oci.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.