Engine Installation

Review engine installation options in Cortex XSOAR 6.13.

You can install Cortex XSOAR engines on all Linux and Windows machines. Although Cortex XSOAR engines are intended for Linux operating systems, they can be used on Windows, but Docker on Windows machines must be configured to run Linux containers. Docker/Podman needs to be installed before installing an engine. If you are using the Shell installer for an engine, Docker/Podman is installed automatically.

Engine Hardware Requirements

If your hard drive is partitioned, we recommend a minimum of 50GB for the /var partition for your development environment, and 50GB for the /var partition for your production environment. If you are using RHEL 8.x and Podman, we recommend allocating a minimum of 50GB for the /home partition and 50GB for the /var partition.

Component	Dev Environment Minimum	Production Minimum
CPU	8 CPU cores	16 CPU cores
Memory	16GB RAM	32GB RAM
Storage	100GB	100GB

Note

If using Podman, we recommend reserving 150 GB for container storage, either in the /home partition or a different storage directory that you have set using the rootless_storage_path key. For more information, see Podman Overview.

Operating System Requirements

You can deploy a Cortex XSOAR engine on the following operating systems:

Operating System	Supported Versions
Ubuntu	18.04, 20.04, 22.04, 24.04
RHEL	8.x, 9.x Includes all minor versions.
Oracle Linux	7.x, 8.9, 9.3, 9.4. 10.1
Amazon Linux	2, Amazon Linux 2023
Rocky Linux	9.5, 9.6

Note

• Make sure the latest Cortex XSOAR version is installed.
• RHEL 7x reached End of Life (EOL) on June 30, 2024, and is no longer a supported operating system.
• CentOS 8.x reached EOL on December 31, 2021, and is no longer a supported operating system.
• CentOS 7.x reached EOL on June 30, 2024, and is no longer a supported operating system.

Engine Required URLs

You need to allow the following in the URLs for Cortex XSOAR engines to operate properly.

FUNCTION	SERVICE	PORT	DIRECTION
Integrations		Integration-specific ports	Outbound
Engine connectivity	HTTPS	443 (configurable)	Outbound
Docker/Podman	https://registry-1.docker.io https://registry.fedoraproject.org https://registry.access.redhat.com https://docker.io https://registry.docker.io https://docker-images-prod.6aa30f8b08e16409b46e0173d6de2f56.r2.cloudflarestorage.com https://auth.docker.io This URL may change according to Docker’s discretion. https://production.cloudflare.docker.com This URL may change according to Docker’s discretion. Note Docker URLs may change. For the current list, see https://docs.docker.com/desktop/setup/allow-list/. Note that some URLs in the allow list are for Docker Desktop and are not required for Cortex XSOAR.	443	Outbound

Engine Installation Types

Before you install the engine, you need to define the base URL in the Settings page so the engine can communicate with the server. The base URL is the external IP address of your Cortex XSOAR server. If you do not define the base URL, you need to add it to the d1.conf file after you create the engine.

• Shell: For all Linux deployments except RHEL 7.x (for example Ubuntu, RHEL 8.x, or later, etc.). Automatically installs Docker/Podman, downloads Docker/Podman images, enables remote engine upgrade, and allows installation of multiple engines on the same machine. For RHEL 7.x, see Install Docker Distribution for Red Hat on Cortex XSOAR.

  The installation file is selected for you. Shell installation supports the purge flag, which by default is false.

  Note

  When upgrading a Shell type engine, you can use the Upgrade Engine feature in the Engines page. For RHEL 7 type engines, you need to upgrade these engine types using a zip type engine and not use the Upgrade Engine feature.
• DEB: For Ubuntu operating systems.
• RPM: RHEL operating systems. If you require a signed RPM file for installation, Install a Signed Engine.

  Note

  Use DEB and RPM installation when shell installation is not available.
• Zip: Used for Windows machines.
• Configuration: Configuration file for download. When you install one of the other options, this config file (d1.conf) is installed on the engine machine.

Note

• For DEB/RPM and Windows engines, Python (including 3.x) and containerization platform (Docker/Podman) must be installed and configured.
• For Docker or Podman to work correctly on an engine, IPv4 forwarding must be enabled. If installing on RHEL v7 you need to install Mirantis Container Runtime. For more information, see System Requirements.
• For air-gapped users, you can Install a Cortex XSOAR Engine Offline. If you need a signed RPM file for installing an engine, follow the procedure in Install a Signed Engine.
• For engines installed on RHEL machines and using Podman as containerization platform Configure the SELinux Policy for PowerShell Integrations (add python.pass.extra.keys and powershell.pass.extra.keys configurations to the engine).

How to Install a Cortex XSOAR Engine

To install an engine, do one of the following:

• Install a Cortex XSOAR Engine
• Install a Signed Engine
• Install a Cortex XSOAR Engine Offline