> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/onboard-cortex-xsoar/single-server-deployment/install-the-server-with-elasticsearch.md).

# Install the Server with Elasticsearch

Install Cortex XSOAR 6.13 with Elasticsearch as the database. Prerequisites and instructions for installing a new Cortex XSOAR 6.13 environment with Elasticsearch.

Elasticsearch is a distributed, open-source search and analytics engine for all types of data. If you use Elasticsearch as your database, it stores all objects.

{% hint style="info" %}
Working with Elasticsearch for only indicators or audit logs is not supported.
{% endhint %}

The following diagram depicts a Cortex XSOAR environment with Elasticsearch.

![Cortex XSOAR environment with Elasticsearch](https://1226493512-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F1BTuP6WlLsNzo2wlKa5w%2Fuploads%2Fgit-blob-c246cad3c84c27a6940ebb4c94d7dfc498f7fc46%2Ffde8f96c090a1cbdba6c9e36fae71be8215ecd2f91ea535eca523d6ecc6c7a1d.png?alt=media)

{% hint style="info" %}
Install the **Elasticsearch Monitoring** content pack from Marketplace to monitor Elasticsearch. After installation, add the **Elasticsearch Monitoring** dashboard to monitor cluster status and statistics.
{% endhint %}

### Cortex XSOAR installation file structure

By default, the `.sh` file is in `/home/<user-name>`. The file installs `demistoserver_xxxxx.amd64.deb` in `/usr/local/demisto`. You can [change the default folder](/xsoar-6-administrator-guide/6.13/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/manage-data/move-data-folders-to-another-location-on-the-server.md), if necessary.

For more information, see [Cortex XSOAR installation file structure](/xsoar-6-administrator-guide/6.13/onboard-cortex-xsoar/single-server-deployment/install-the-server-for-a-single-server-deployment.md#cortex-xsoar-installation-file-structure).

### Prerequisites for installing Cortex XSOAR with Elasticsearch

Verify the following information and requirements before you install Cortex XSOAR with Elasticsearch:

* A Customer Support Portal (CSP) account
* The required CSP and Cortex Gateway roles
* A license assigned to your CSP account
* A deployment that meets the [minimum system requirements](/xsoar-6-administrator-guide/6.13/onboard-cortex-xsoar/single-server-deployment/system-requirements.md)
* An Elasticsearch deployment that meets the [Elasticsearch setup requirements](/xsoar-6-administrator-guide/6.13/onboard-cortex-xsoar/elasticsearch/elasticsearch-setup.md)
* Root access
* Elasticsearch 7.x installed on a separate server
* Python 2.7 or 3.x on the production server

Set up your CSP account. For more information, see [How to Create Your CSP User Account](https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClNVCA0).

The CSP Super User role is assigned to the account creator. The first CSP Super User to access Cortex Gateway receives Account Admin permissions. You can add Account Admin users as required.

### Install Cortex XSOAR with Elasticsearch

{% stepper %}
{% step %}

### Download the installation package and license

1. Log in to [Cortex Gateway](https://cortex-gateway.paloaltonetworks.com/accounts).
2. Locate the activation card for your license.

   By default, the **Production-Standalone** license is selected. You can also select **Dev**. If you want to use a production and development tenant with a private remote repository, select **Dev**. If you do not select it now, you can install a development tenant later.
3. Select **Download On Prem**.
4. Under **Choose Download Option**, select **Installer**.
5. Select the checkbox to agree to the license terms and conditions.
6. Select **Download**.

{% hint style="info" %}
In Google Chrome, to download the image and license files together, you may need to set **Settings** → **Privacy and security** → **Site settings** → **Additional permissions** → **Automatic downloads** to **Sites can ask to automatically download multiple files**.
{% endhint %}

Two files download: the `demistoserver-xxxxx.sh` installer file and a zipped JSON license file.

{% hint style="info" %}
You can copy the download link button from your browser's **Downloads** section. Use the token for offline installation.
{% endhint %}

7. Select **Next**.
8. Optional: Import the GPG public key when using a signed installer.

   For example, run `rpm --import public.key` to import the key into the local GPG keyring.
9. Optional: Install `makeself` when using a signed installer.

   Run `yum install makeself`.
   {% endstep %}

{% step %}

### Make the server package executable

Run the following command:

```shell
chmod +x demistoserver-xxxx.sh
```

{% endstep %}

{% step %}

### Run the installer

1. Run one of the following commands:

   * For username and password authentication:

     ```shell
     sudo ./demisto.sh -- -elasticsearch-url=<elasticsearch-url> -elasticsearch-username=<elasticsearch-username> -elasticsearch-password=<elasticsearch-password>
     ```
   * For API key authentication:

     ```shell
     sudo ./demisto.sh -- -elasticsearch-url=<elasticsearch-url> -elasticsearch-api-key=<elasticsearch-api-key>
     ```

   Use the following flags:

   | Flag                       | Type    | Description                                                         |
   | -------------------------- | ------- | ------------------------------------------------------------------- |
   | `-elasticsearch-url`       | String  | Elasticsearch URL addresses, separated by commas                    |
   | `-elasticsearch-api-key`   | String  | Elasticsearch API key. Do not use with username or password flags   |
   | `-elasticsearch-username`  | String  | Elasticsearch username. Use with `-elasticsearch-password`          |
   | `-elasticsearch-password`  | String  | Elasticsearch password. Use with `-elasticsearch-username`          |
   | `-elasticsearch-proxy=`    | Boolean | Use a proxy for Elasticsearch communication. The default is `false` |
   | `-elasticsearch-insecure=` | Boolean | Trust any Elasticsearch certificate. The default is `false`         |
   | `-elasticsearch-timeout`   | Integer | Elasticsearch timeout in seconds. The default is `20`               |
   | `-elasticsearch-prefix`    | String  | Prefix for Elasticsearch index names created by Cortex XSOAR        |
2. Accept the EULA.
   {% endstep %}

{% step %}

### Verify the installation

1. Confirm that the Cortex XSOAR server is active.

   ```shell
   systemctl status demisto
   ```

   If the server is inactive, run `systemctl start demisto`.
2. Confirm that the Docker service is active.

   ```shell
   systemctl status docker
   ```
3. Open `https://serverURL:port` in a web browser.

The Cortex XSOAR server is installed and ready for license activation.
{% endstep %}

{% step %}

### Add the license

1. Log in to the Cortex XSOAR server.
2. Upload the license file downloaded from Cortex Gateway.

For more information, see [Add a License](/xsoar-6-administrator-guide/6.13/onboard-cortex-xsoar/single-server-deployment/add-a-license.md).
{% endstep %}
{% endstepper %}


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/onboard-cortex-xsoar/single-server-deployment/install-the-server-with-elasticsearch.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.