Install an Engine - User Guide - 2 - Cortex XPANSE - Cortex - Security Operations

Cortex Xpanse Expander User Guide
Product
Cortex XPANSE
Version
2
Creation date
2024-05-22
Last date published
2024-09-03
Category
User Guide
Solution
Cloud
Abstract

Install, deploy and configure Cortex Xpanse engines.

When you install the engine, the d1.config is installed on the engine machine, which contains engine properties such as proxy, log level, log files, etc. If Docker/Podman is already installed, the python.engine.docker and powershell.engine.docker key is set to true. If Docker or Podman is not available when the engine is installed, the key is set to false. If so, you need to set the key to true. Verify that python.engine.docker and powershell.engine.docker configuration key is present in the d1.conf file.

For engines running on a Windows machine, add the following keys to the d1.config file:

  • The python.runner.loop.script.path configuration key with the path to the _script_docker_python_loop.py file (located in the engine’s installation folder). The path to the _script_docker_python_loop.py must be taken from WSL installed on the Windows machine (for example, /mnt/c/Users/<customer user>/Desktop/<customer engine folder>/_script_docker_python_loop.py).

  • The powershell.runner.loop.script.path configuration key with the WSL path to the _script_docker_powershell_loop.ps1 file (also located in engine’s installation folder).

After you install and deploy an engine, there are several ways that you can Manage Engines.

Before you begin

f you are using DEB, RPM or Zip installation, install Docker/Podman. To run Docker dependent integrations and scripts on CentOS v7, install Mirantis Container Runtime. If using RHEL v7, follow the steps in Install Docker Distribution for Red Hat on an Engine.Install Docker Distribution for Red Hat on an Engine

  1. Create an engine.

    1. Select Settings → Configurations → Data Collections → Engines → Create New Engine.

    2. In the Engine Name field, add a meaningful name for the engine.

    3. Select one of the installer types from the drop down list.

      • Shell

      • DEB

      • RPM

      • Zip

      • Configuration

      Tip

      For Linux systems it is recommended to use the Shell installer. If using CentOS 7.x, or Amazon Linux 2, use the Zip installer (see step 5).

    4. (Optional) (Shell only) Select the checkbox to enable multiple engines to run on the same machine.

      If you have an existing engine, you did not select the checkbox, and you want to install another engine on the same machine, you need to delete the existing engine.

    5. (Optional) Add any required configuration in JSON format.

    6. Click OK to create the engine.

  2. For Shell installation, do the following:

    1. Move the .sh file to the engine machine using a tool like SSH or PuTTY.

    2. On the engine machine, grant execution permission by running the following command:

      chmod +x /<engine-file-path>

    3. Install the engine by typing one of the following commands:

      With tools: sudo <engine-file-path>

      Without tools: sudo <engine-file-path> -- -tools=false

      If you receive a permissions denied error, it is likely that you do not have permission to access the /tmp directory.

  3. For RPM/DEB installation do the following:

    1. Move the file to the required machine using a tool like SSH or PuTTY.

    2. Type one of the following installation commands:

      Machine Type

      Install Command

      RHEL (RPM)

      sudo rpm -Uvh d1-2.5_15418-1.x86_64.rpm

      Ubuntu (DEB)

      sudo dpkg --install d1_xxx_amd64.deb

    3. Start the engine by running one of the following commands:

      Machine Type

      Start Command

      RHEL (RPM)

      sudo systemctl start d1

      Ubuntu (DEB)

      sudo service d1 restart

  4. For Zip file installation on Windows, do the following.

    1. Move the d1 zip file to the engine machine using a tool like WinSCP.

    2. Unzip the file and move it to any location you require.

    3. Open the file and run the d1_windows_amd64.exe file.

      Every time you want to connect to you need to run the D1 Application file.

  5. For Zip installation on CentOS 7.x or Amazon Linux 2, run the following commands:

    1. Create the engine folder.

      mkdir /usr/local/demisto

    2. Unzip the engine files to the folder created in step 2.

      unzip ./d1.zip -d /usr/local/demisto

    3. Allow the process to bind to low numbered ports.

      setcap CAP_NET_BIND_SERVICE=+eip /usr/local/demisto/d1_linux_amd64

    4. Run the engine process.

      /usr/local/demisto/d1_linux_amd64

  6. When the engine is connected, you can add the engine to a load balancing group by clicking Load-Balancing Group.

    If you want to add the engine to a new group, click Add to new group from the dropdown list.

    When the engine is in the load-balancing group, it cannot be used as an individual engine and does not appear when configuring an engine from the drop down list.

  7. (Optional) After installing the engine, you may want to set up a proxy, set up Docker hardening, configure the number of workers for the engine, etc. For more information, see Configure Engines.