> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/xsoar-migration-guide/cortex-xsoar-8-saas-multi-tenant-migration/migrate-from-cortex-xsoar-6-multi-tenant-to-cortex-xsoar-8-saas-multi-tenant-using-the-migration-wiz/step-2.-set-up-cortex-xsoar-8-multi-tenant-using-the-pre-migration-wizard.md).
# Step 2. Set up Cortex XSOAR 8 Multi-Tenant using the Pre-migration Wizard
When you log into each activated Cortex XSOAR 8 tenant for the first time, a pre-migration wizard sets up your tenant. After the pre-migration wizard steps have been completed, you start the data transfer (initial data sync) between Cortex XSOAR 6 and 8. When the initial data sync has finished, the tenant automatically restarts, and the migration wizard starts running.
{% hint style="info" %}
### Note
You need Account Admin permission to set up the Cortex XSOAR 8 tenant.
{% endhint %}
**Pre-migration wizard steps**
The pre-migration wizard automatically runs in each activated tenant when you log in to your tenant.
Although you can start the pre-migration wizard in each tenant in any order, when you reach the data transfer stage, start the data transfer (initial data sync) in the following order:
Task 1. Set up the development tenant
If you currently use a dev/prod environment with or without a remote repository and are migrating both the development and production instances, the pre-migration wizard steps must be performed on both the development and production tenants for Cortex XSOAR 8.
The pre-migration wizard includes the following steps:
| Step | Description |
| ----------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Migrate incident and indicator data | Select whether to migrate incident and indicator data.
We recommend not migrating incident and indicator data for a quicker and more efficient migration process. No data will be deleted from Cortex XSOAR 6 when you migrate your data.
Regardless of whether you migrate incident or indicator data, you can still access your Cortex XSOAR 6 instances after migration until EOL or the end of your contract term (whichever comes first), but you can't perform any automation.
If you don't migrate incident and indicator data, after migration, you can continue working on active incidents on Cortex XSOAR 6 until EoL or the end of your contract term (whichever comes first), until closure. For indicators, you have several options, such as exporting and importing indicators. For more information, see Post Migration Steps for Cortex XSOAR 6 Multi-Tenant to 8 SaaS Multi-Tenant.
|
| Enable Access | Ensure that you do the following:
For Cortex XSOAR 8, enable access to PANW resources. If you haven't done so already, enable access to PANW resources and update your firewall as required. For more information, see Enable access to Palo Alto resources.
The Wizard utilizes Chisel (an open-source tunneling application) to progress the migration flow. Layer 7 application-aware firewalls (such as Palo Alto Networks VM-Series) naturally block this traffic by default. You must explicitly allow the jpillora-Chisel application under app-id: chisel in your egress firewall rules to allow the wizard to connect.
After the initial data sync, the Cortex XSOAR instance is created. By default, the Cortex XSOAR FQDN is \.crtx.\.paloaltonetworks.com.
You can change the FDQN name in Cortex Gateway after the switchover date.
For Cortex XSOAR 6, allow the following URLs in your firewall.
To check, on your Cortex XSOAR 6 server, run: curl -v
To check, on your Cortex XSOAR 6 server, run: curl -v
Ensure that you create explicit exceptions for your Cortex XSOAR engine/server traffic to reach storage.googleapis.com and oauth2.googleapis.com. Otherwise, you may receive an Unexpected Error Occurred message if standard categories, such as content and delivery are blocked..
|
| Connect | Connect your Cortex XSOAR 6 development server to the Cortex XSOAR 8 development tenant. |
| Retention | Relevant if you decide to migrate incident and indicator data.
Set the retention timeframe for your development tenants.
Cortex XSOAR operates an incident retention policy, which keeps incidents for six months. Migrating customers receive an additional six months of retention until the end of the license term. If you select to migrate incidents and indicators, you can set the retention timeframe. For more information, see Retention Policy and Enforcement.
|
| Remote repository | Cortex XSOAR 8 supports built-in or private remote repositories. The pre-migration wizard detects whether you used a remote repository in Cortex XSOAR 6. If you were using a remote repository. You can do the following:
If using a single Git branch for dev/prod, you can use the built-in repository, or you can continue using your private repository by creating a new branch with a new branch name.
We recommend using the built-in remote repository.
- If using multiple Git branches and want to continue, you must select a private repository.
The dev and prod environments must use the same remote repository type. If using your remote repository, you must use the same repository name in dev and prod.
To see how to configure the remote repository, options, and the recommended workflow, see Configure a remote repository for multi-tenant using the pre-migration wizard.
|
| Start data transfer | When you start the data transfer, the following data is synced (the initial data sync) to the Cortex XSOAR 8 development tenant :
Users and Roles
- Creates and activates users in the Cortex Gateway who are responsible for the migration.
- Other users: All other users are created in the Cortex Gateway but deactivated.
- Includes user preferences for the initial users who are responsible for the migration.
- Content database and history
- Jobs: Migrates jobs and disables them in Cortex XSOAR 8.
- Engines
- Audit logs
- Syslog
- Docker images
- Integration instances
- Incidents and indicators (if selected): Includes attachments
|
Task 2. Set up the main tenant
As configuration and content propagate from the main tenant to the child tenants, start the data transfer on the main tenant before the child tenant. If you initially sync child tenants, they will not contain any data, as you have not yet synced the main tenant.
The pre-migration wizard includes the following steps:
| Step | Description |
| ----------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Migrate incident and indicator data | As no incident or indicator data is stored on the main tenant, you can't select whether to migrate incident and indicator data in your main tenant. You can decide whether to migrate incident and indicator data in your development and child tenants.
You can still access your Cortex XSOAR 6 main tenant instance after migration until EOL or the end of your contract term (whichever comes first), but you can't perform any automation.
|
| Enable Access | Ensure that you do the following:
For Cortex XSOAR 8, enable access to PANW resources. If you haven't done so already, enable access to PANW resources and update your firewall as required. For more information, see Enable access to Palo Alto Networks resources.
After the initial data sync, the Cortex XSOAR instance is created. By default, the Cortex XSOAR FQDN is \.crtx.\.paloaltonetworks.com.
You can change the FDQN name in Cortex Gateway after the switchover date.
For Cortex XSOAR 6, allow the following URLs in your firewall.
To check, on your Cortex XSOAR 6 server, run: curl -v
To check, on your Cortex XSOAR 6 server, run: curl -v
|
| Connect | Connect your Cortex XSOAR 6 main tenant server to the Cortex XSOAR 8 main tenant. |
| Data migration | By default, Cortex XSOAR enables you to migrate up to six months of data. You can extend or reduce the amount, depending on your Cortex XSOAR 6 resources. |
| Remote repository | The pre-migration wizard detects whether you use a remote repository in Cortex XSOAR 6. If so, you can select the built-in or private remote repository.
If using a single Git branch for dev/prod, you can use the built-in repository or continue using your private repository. We recommend using the built-in remote repository.
If using multiple Git branches and want to continue, you must select a private repository.
To see how to configure the remote repository, options, and the recommended workflow, see Configure a remote repository for multi-tenant using the pre-migration wizard.
|
| Start data transfer | When you start the data transfer, the following data is synced (the initial data sync) to the Cortex XSOAR 8 main tenant:
Users and Roles
- Creates and activates users in the Cortex Gateway who are responsible for the migration.
- Other users: All other users are created but deactivated.
- Includes user preferences for the initial users who are responsible for the migration.
- Roles that were created in the main tenant in Cortex XSOAR 6 are migrated to Cortex Gateway, so they can be propagated to your Cortex XSOAR 8 child tenants.
- Content database and history
- Engines
- Audit logs
- Syslog
- Docker images
- Integration instances
|
Task 3. Set up the child tenant
The pre-migration wizard includes the following steps:
| Step | Description |
| ----------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Migrate incident and indicator data | Select whether to migrate incident and indicator data in your child tenants.
We recommend not migrating incident and indicator data for a quicker and more efficient migration process. No data will be deleted from Cortex XSOAR 6 when you migrate your data.
Regardless of whether you migrate incident or indicator data, you can still access your Cortex XSOAR 6 instances after migration until EOL or the end of your contract term (whichever comes first), but you can't perform any automation.
If you don't migrate incident and indicator data, after migration, you can continue working on active incidents on Cortex XSOAR 6 until EoL or the end of your contract term (whichever comes first), until closure. For indicators, you have several options, such as exporting and importing indicators. For more information, see Post Migration Steps for Cortex XSOAR 6 Multi-Tenant to 8 SaaS Multi-Tenant.
|
| Enable Access | Ensure that you do the following:
For Cortex XSOAR 8, enable access to PANW resources. If you haven't done so already, enable access to PANW resources and update your firewall as required. For more information, see Enable access to Palo Alto resources.
After the initial data sync, the Cortex XSOAR instance is created. By default, the Cortex XSOAR FQDN is \.crtx.\.paloaltonetworks.com.
You can change the FDQN name in Cortex Gateway after the switchover date.
For Cortex XSOAR 6, allow the following URLs in your firewall.
To check, on your Cortex XSOAR 6 server, run: curl -v
To check, on your Cortex XSOAR 6 server, run: curl -v
|
| Connect | Connect your Cortex XSOAR 6 child tenant to the Cortex XSOAR 8 child tenant. |
| Retention | Relevant if you decide to migrate incident and indicator data.
Set the retention timeframe for your child tenants.
Cortex XSOAR operates an incident retention policy, which keeps incidents for six months. Migrating customers receive an additional six months of retention until the end of the license term. If you select to migrate incidents and indicators, you can set the retention timeframe. For more information, see Retention Policy and Enforcement.
|
| Start data transfer | When you start the data transfer, the following data is synced (the initial data sync) to the Cortex XSOAR 8 child tenant:
Users and Roles
- Creates and activates users in the Cortex Gateway who are responsible for the migration.
- Other users: All other users are created in the Cortex Gateway, but deactivated.
- Includes user preferences for the initial users who are responsible for the migration.
- Content database and history
- Jobs: Migrates jobs and disables them in Cortex XSOAR 8.
- Engines
- Audit logs
- Syslog
- Docker images
- Integration instances
- Incidents and indicators (if selected): Includes attachments
|
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://cortex-docs.paloaltonetworks.com/xsoar-migration-guide/cortex-xsoar-8-saas-multi-tenant-migration/migrate-from-cortex-xsoar-6-multi-tenant-to-cortex-xsoar-8-saas-multi-tenant-using-the-migration-wiz/step-2.-set-up-cortex-xsoar-8-multi-tenant-using-the-pre-migration-wizard.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.