Install a Cortex XSOAR Engine Offline

Install a Cortex XSOAR 6.14 engine in an offline environment.

Use these instructions when using the Cortex XSOAR installer script for engine installation with no internet connectivity.

You need to download Cortex XSOAR Dependencies for Offline Installation and Docker images on a machine that has internet access, and then transfer them to a machine where you want to install the engine. After installing the engine, install the dependencies and images.

Always verify that your Cortex XSOAR dependencies are updated and take into account that they might change across releases.

Install an engine offline

1

Download the required dependencies

1. On a machine with internet access, download the Dependencies for Offline Installation for your deployment type.

   • Ubuntu/Debian: Run sudo apt-get install --download-only <package> , which saves the package and its dependencies in /var/cache/apt/archives. If the latest package version is already installed, run sudo apt-get download <package>. The command saves the package in your current directory. If you need to download dependencies on Ubuntu, you can also use the command sudo apt-get download.
   • RHEL/Rocky/Oracle/Amazon: Run sudo yumdownloader --resolve <package> or sudo yum install --downloadonly <package>.

2. Copy all .deb files over to the offline machine into a folder.

2

Download Docker images

While the Cortex XSOAR installer sets up Docker automatically, it does not include the images required to run integrations. You must obtain them manually. On a machine with internet access, do one of the following:

• Targeted Download (Recommended): Use the download_packs_and_docker_images.py script to download the Docker image according to the content pack integration you want to use, such as AWS-ILM, Cybereason, and EWS. The script is located in the Utils folder in the GIT Content repository. If you do not have access to the GIT Content repository, you can download the script from here. For detailed information and how to download the Docker images, see download packs offline. This is the preferred method as it allows you to download only the images for the specific content packs you plan to use.
• Full Library download: Download the Docker images by appending downloadName=dockerimages to the download URL you copied from the installer download. For example: https://download.demisto.com/download-params?token=xxxxxxx email=[e-mail] downloadName=dockerimages eula=accept The Docker images file is approximately 75 GB.

3

Create an engine

1. Select Settings → INTEGRATIONS → Engines → Create New Engine.
2. In the Engine Name field, add a meaningful name for the engine.
3. Select one of the installer types from the dropdown list.

   For Linux systems, it is recommended to use the Shell installer.
4. (Optional) If you want to add the engine to a load balancing group, from the dropdown list, select the group you want to add.

   The dropdown list only appears after you have created and connected an engine and created a load balancing group. To add the engine to a new group, select Add new group from the dropdown list.

   The engine cannot be used as an individual engine and does not appear when configuring an engine from the dropdown list.
5. (Optional) (Shell only) Select the checkbox to enable multiple engines to run on the same machine.

   If you have an existing engine, you did not select the checkbox, and you want to install another engine on the same machine, you need to delete the existing engine.
6. (Optional) Add any required configuration in JSON format.
7. Click Create New Engine.

4

Transfer and verify the downloaded files

1. On a machine with internet access, transfer the files downloaded in steps 1 to 3.
2. Install all dependencies:

   • Ubuntu/Debian: sudo dpkg -i *
   • RHEL/Rocky/Oracle/Amazon Linux: sudo yum localinstall *

5

Install the engine

The installer automatically installs and configures the container (Docker/Podman) for Ubuntu, RHEL 8+, Rocky Linux 9+, and Amazon Linux 2023 using the dependencies you installed in Step 4.

For Oracle Linux and Amazon Linux 2, install Docker before running the installer.

1. Grant execution permission by running the following command:

   chmod +x /<engine-file-path>
2. Install the engine by running the following command:

   sudo ./d1-<engine-name>-<XSOAR-version>-xxxxxxx.sh -- -tools=false -do-not-start-engine=true

   For example, sudo ./d1-engine1-6.6-2458567.sh -- -tools=false -do-not-start-engine=true

   If you receive an permissions denied error, it is likely that you do not have permission to access the /tmp directory.

6

Load Docker images

• (Ubuntu, Oracle, and Amazon 2/2023 (Docker) Run the following command:

  sudo docker load -i <YOUR_DOCKER_FILE>.tar
• (Red Hat v8+ and Rocky Linux 9+ (Podman) Do the following:

  1. Ensure the file is owned by the demisto user: sudo chown demisto:demisto <FILENAME>.tar
  2. Ensure that you are in the root directory (cd /).
  3. Run the following command:

     sudo -su demisto podman load -i <PATH TO FILE>/<FILENAME>.tar
  4. (Optional) To verify that images can run, use the podman images command. You can also run the podman images -q "demisto/python:1.3-alpine" command to validate specific images and identify any issues.

7

Start the engine

Start the server by running the following command: sudo systemctl start d1

For multiple engines, the D1 service name may differ.

8

Verify the engine is active

(Optional) After installation has completed, do the following:

1. Confirm that the Cortex XSOAR engine status is active by running the systemctl status d1 command.

   

   engines-offline.png
2. Validate that the engine is connected and running by going to Settings >INTEGRATIONS > Engines.

   

   engines-off-xsoar.png

   3. Run the engine on a sample integration. For example, in the Hello World (Community Contribution) integration set the integration to run on the engine.

   

   engines-off-intg.png

   4. Run a simple command to test that the engine is working properly using the integration.

   

   engines-off-test.png
3. Run the engine on a sample integration. For example, in the Hello World (Community Contribution) integration set the integration to run on the engine.

   

   engines-off-intg.png
4. Run a simple command to test that the engine is working properly using the integration.

   

   engines-off-test.png