> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.9/multi-tenant/multi-tenant/child-tenant-management/content-management-in-multi-tenant.md). # Content management in multi-tenant Content (including integrations) can be configured on the main tenant or child tenants. If creating content on the Main Tenant, you can push that content to child tenants. Usually, if the content applies to all child tenants, it should be configured on the main tenant and pushed to the child tenants. In some cases, you may need to configure an integration on the child tenant only. For example, the end-user has the information needed to configure a specific integration but does not want that information stored on the main tenant. Also, any integration that fetches incidents or indicators (feeds) must be configured on the child tenant, since incidents are not stored on the main tenant. **Content dependencies** Content that is synced from the main tenant, includes not just the content item but also dependencies. In Cortex XSOAR, there are multiple layers of dependency relationships. For example, a classifier depends on an incident type, an incident type depends on a layout, layouts depend on fields, and fields depend on scripts. For a basic example of content dependencies, see the **Phishing - Generic v3** playbook, which contains 43 scripts. The scripts are dependencies of the playbook, which needs them to execute properly. You can view playbook dependencies under the **Propagation Labels** field in the playbook **Settings**. When syncing content from the main tenant to child tenants, content includes these dependencies. {% hint style="info" %} ### Note Content dependencies are calculated recursively, so that if, for example, Playbook A uses Playbook B (dependency), which in turn uses scripts C and D (dependencies), all of the dependencies (Playbook B and scripts C and D) will be included along with Playbook A. {% endhint %} **Propagation labels** When syncing content from the Main Account, you can use propagation labels to decide what content to push and which child tenant you want to push content to. You can add propagation labels to the following: * Child tenants * Content items {% hint style="info" %} ### Tip We recommend that you first apply propagation labels to your child tenants and then add the corresponding labels to the content items that you want to sync to the child tenants. {% endhint %} For a content item to be synced to a child tenant, both the content and child tenant must have the same propagation label. For example, if you want Playbook ABC to sync to Tenant 123, they both need to have the same propagation label, such as **Premium**. Content is pushed to tenants by matching propagation labels. When creating or editing content, you can add the following propagation labels for syncing content to a child tenant: | Propagation label | Description | | ----------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | All | Content items with the **all** label are synced to all child tenants, regardless of whether the child tenants have labels. This is the default label for content items. | | Custom | Add custom labels by typing a label name in the **Propagation Labels** field when adding or editing a content item or when selecting the child tenant and clicking **Propagation Labels** on the **Tenant Management** page. | For more information about adding propagation labels to content, see [Add propagation labels to content](#add-propagation-labels-to-content). If an integration has the same settings for multiple child tenants, you can configure the integration on the main tenant and propagate it to multiple child tenants. For more information, see [Add propagation labels to a child tenant](#add-propagation-labels-to-a-child-tenant). {% hint style="info" %} ### Note If a content item does not have any labels, it will not be synced to any child tenants. If a child tenant does not have any labels, only content items with the **all** propagation label will sync to it. If there is no propagation label on your content, for example, a script or playbook, but it is a dependency of a package that you propagate to a tenant, the unlabeled content is still synced to the tenant. If the content includes dependencies, these dependencies appear during the sync process, even if their propagation labels don’t match that of the tenant, as long as the labels of the parent content match the child tenant labels. {% endhint %} When using a remote repository with a multi-tenant deployment, the remote repository must be configured and a machine must be set as the development environment, before you can view propagation labels. For more information, see [Manage content using a remote repository](#manage-content-using-a-remote-repository). Example 35. The following example demonstrates how propagation labels work with content dependencies. The playbook has a `test` propagation label, which matches the child tenant's label, but the scripts contained within the playbook have a propagation label of **`test1`**, which differs from that of the playbook. **Playbook** ![playbook-propagation.png](/files/JgwUIXIxUoWskv29IJWN) **Script** ![script-propagation-label-8.png](/files/z9CqYblHOc2xZrhTq405) Even though the script propagation label does not match that of the tenant, the content is still propagated to tenants during the sync process. If there is no relevant propagation tag on your content, for example, a script or playbook, but it is a dependency of a package that you propagate to a tenant, the unlabeled content is still synced to the tenant. **Add propagation labels to content** You can add propagation labels when creating a new content item or when editing an existing item. The default propagation label for all content items is **all**. {% hint style="info" %} ### Tip We recommend that you first apply propagation labels to your child tenants and then add the corresponding labels to the content items that you want to sync to the tenants. {% endhint %} The following content items support propagation labels: * Playbooks * Scripts * Integrations and integration instances * Indicator fields, types, and layouts * Incident fields, types, and layouts * Threat Intel Report types, fields, and layouts * Classifiers and mappers * Evidence fields * Pre-process rules * Lists * Widgets * Dashboards {% hint style="info" %} ### Note When installing a content pack from the Marketplace, the default propagation label is set to **`all`**. If you want to change the propagation label, after installation, go to the **INSTALLED CONTENT PACKS** tab on the **Marketplace** page and click the propagation button for the content pack. If a content item is part of a content pack and is not specifically labeled, it inherits the content pack’s propagation labels. If labels are specified, it propagates according to those labels. For a non-content item such as an integration instance, if you want to propagate the instance, you need to apply propagation labels both to the integration and to the integration instance. If a tenant does not have the integration installed, the instance will not be propagated even if the propagation label exists both on the main tenant and child tenant. {% endhint %} If you want to create new propagation labels or add existing ones, ensure that you have the required permissions. For more information, see [Role-based permissions](/cortex-xsoar-8-on-prem/8.9/configure-cortex-xsoar/users-and-roles-management/roles-management/role-based-permissions.md). 1. Go to the content item that you want to add a propagation label to. 2. In the **Propagation Labels** field, add the relevant labels by either selecting an existing label or typing a new label. After typing a new label and pressing **`Enter`**, the label is available immediately for use. If you instead keep the default **`all`** label, the content syncs to all child tenants. For example, when editing or creating a playbook, in the **PLAYBOOK SETTINGS** section, in the **Propagation Labels** field, add the label as required. **Add propagation labels to a child tenant** The propagation labels that you add to the child tenant determine which content items sync to the tenant. This information is intended for existing child tenants. If you want to create new propagation labels or add existing ones, ensure that you have the necessary permissions. For more information, see [Role-based permissions](/cortex-xsoar-8-on-prem/8.9/configure-cortex-xsoar/users-and-roles-management/roles-management/role-based-permissions.md). {% hint style="info" %} ### Tip We recommend that you first apply propagation labels to your child tenants and then add the corresponding labels to the content items that you want to sync to the child tenants. {% endhint %} 1. In the Main Tenant, go to **Settings & Info** → **Settings** → **Tenant Management**. 2. Select the tenant that you want to add propagation labels to and click **Propagation Labels**. 3. Select existing propagation labels or type new propagation labels. **Sync content to child tenants** The content that you sync from the main tenant to the child tenants might add, override, or remove content from the child tenants. New content items, that do not currently exist on the child tenants, are added. When you sync content to child tenants, there can potentially be content items added. {% hint style="info" %} ### Note There may be instances where a child tenant is disconnected for whatever reason when content is supposedly synced. The Cortex XSOAR on-prem main tenant displays the exact reason why the child tenant is disconnected and is unable to receive any updates. We recommend to review the **Tenant Management** page on the main tenant to resolve the issue. {% endhint %} | Option | Description | | -------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Add | New content items that do not currently exist on the child tenants will be added. | | Override | For content items that are being pushed in the sync operation and that already exist on the child tenants, the sync operation overrides the existing content on the child tenants | | Remove | For content items that were removed from the main tenant and which already exist on the child tenants, the sync operation removes the existing content from the child tenants. | You should review each content item and its dependencies before syncing the content. You have the option to remove items before executing the sync operation for a single tenant. **Before you begin** * Ensure that your user roles have view or view/edit permission to sync to child tenants. For more information, see [Role-based permissions](/cortex-xsoar-8-on-prem/8.9/configure-cortex-xsoar/users-and-roles-management/roles-management/role-based-permissions.md). * Add propagation labels to child tenants. * Add propagation labels to content. * From the **Tenant Management**, from the Main Tenant, you can click the link of the child tenant to access the child tenant. How to sync content 1. In the Main Tenant, go to **Settings & Info** → **Settings** → **Tenant Management**. 2. Select the tenant you want to sync. If you select one tenant, you can review which content sync. If you select two or more tenants, you can't review the content before syncing. 3. Select one of the following options to sync content. * To review the content before syncing to a child tenant, select a child tenant, and click **Sync**. 1. Review all content affected by the sync operation in the **ADD**, **OVERRIDE**, **and REMOVE** tabs. 2. If there are playbooks listed in the **OVERRIDE** tab, select or clear the checkbox to **Override playbook inputs** in the child tenant. 3. If the **Run on** field has changed in the script, select or clear the **Overwrite script run-on** to override this field in the child tenant. * To sync content to child tenants without manual review, select two or more child tenants and then click **Sync**. This option automatically updates new, and existing content to the child tenant, and removes outdated content. If there are playbooks and scripts, select or clear the checkbox to **Override playbook inputs and script run-on-settings** in the child tenant. 4. Click **Sync**. {% hint style="info" %} ### Note If you sync a content item from the main tenant to a child tenant, and a content item with that same name already exists on the child tenant, the content on the child tenant is overwritten. This applies to integrations, fields, incident types, and Threat Intel report types. {% endhint %} **Manage content using a remote repository** If you are working with remote repositories, and want to use selective propagation to add propagation labels to content, you need to follow the steps described in this task. Before you begin, if you haven't done so already, set up a remote repository, as described in [Content management in Cortex XSOAR](/cortex-xsoar-8-on-prem/8.9/configure-cortex-xsoar/remote-repository-management/content-management-in-cortex-xsoar.md). 1. In the development environment, do the following. 1. Add propagation labels to content as needed. 2. Push content to the production tenant. For more information, see [Push content from a development tenant](/cortex-xsoar-8-on-prem/8.9/configure-cortex-xsoar/remote-repository-management/push-content-from-a-development-tenant.md)

Note

Propagation labels added to content on your development tenant appear when pushing content to production

2. In the production tenant, do the following: 1. Install the content that is pushed from the development tenant. For more information, see [Install content on a production tenant](/cortex-xsoar-8-on-prem/8.9/configure-cortex-xsoar/remote-repository-management/install-content-on-a-production-tenant.md). 2. Confirm that the propagation labels were added to the content and that the labels are available for use, by going to Settings & Info → **Settings** → Tenant Management. 3. Add propagation labels to child tenants. For more information, see [Add propagation labels to a child tenant](#add-propagation-labels-to-a-child-tenant). 4. Sync content to child tenants. For more information, see [Sync content to child tenants](#sync-content-to-child-tenants). --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.9/multi-tenant/multi-tenant/child-tenant-management/content-management-in-multi-tenant.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.