Install an engine - Administrator Guide - Cortex XSIAM - Cortex - Security Operations

Create an engine.

1. Select Settings → Configurations → Data Broker → Engines → Create New Engine.

2. In the Engine Name field, add a meaningful name for the engine.

3. Select one of the installer types from the list.

4. (Optional) (Shell only) Select the checkbox to enable multiple engines to run on the same machine.

   If you have an existing engine, and you did not select the checkbox, and now you want to install another engine on the same machine, you need to delete the existing engine.

5. (Optional) Add any required configuration in JSON format.

6. Click OK to create the engine.

For shell installation, do the following:

1. Move the .sh file to the engine machine using a tool such as SSH or PuTTY.

2. On the engine machine, grant execution permission by running the following command:

   chmod +x /<engine-file-path>

3. Install the engine by typing one of the following commands:

   With tools: sudo <engine-file-path>

   Without tools: sudo <engine-file-path> -- -tools=false

   If you receive a permissions denied error, it is likely that you do not have permission to access the /tmp directory.

For RPM/DEB installation, do the following:

1. Move the file to the required machine using a tool such as SSH or PuTTY.

2. Type one of the following installation commands:

   Machine Type	Install Command
   RHEL (RPM)	sudo rpm -Uvh d1-2.5_15418-1.x86_64.rpm
   Ubuntu (DEB)	sudo dpkg --install d1_xxx_amd64.deb

3. Start the engine by running one of the following commands:

   Machine Type	Start Command
   RHEL (RPM)	sudo systemctl start d1
   Ubuntu (DEB)	sudo service d1 restart

For Zip installation on Amazon Linux 2, run the following commands:

1. Create the engine folder.

   mkdir /usr/local/demisto

2. Unzip the engine files to the folder created in the previous step.

   unzip ./d1.zip -d /usr/local/demisto

3. Allow the process to bind to low numbered ports.

   setcap CAP_NET_BIND_SERVICE=+eip /usr/local/demisto/d1_linux_amd64

4. Change the owner of /usr/local/demisto to the demisto user.

   chown -R demisto:demisto /usr/local/demisto

5. In /etc/systemd/system edit the d1.service file las follows (adjust the directory and the name of the binaries file if needed).

    [Unit]
   Description=Demisto Engine Service
   After=network.target
   [Service]
   Type=simple
   User=demisto
   WorkingDirectory=/usr/local/demisto
   ExecStart=/usr/local/demisto/d1_linux_amd64
   EnvironmentFile=/etc/environment
   Restart=always
   [Install]
   WantedBy=multi-user.target

6. Run the following commands:

   chown root:root /etc/systemd/system/d1.service

   chmod 644 /etc/systemd/system/d1.service

7. Run the engine process.

   systemctl start d1

8. Verify that the engine is running.

   systemctl status d1

Verify that the engine you created is connected.

1. Select Settings → Configurations → Data Broker → Engines.

2. Locate your engine on the Engines page and check that it is connected.

When the engine is connected, you can add the engine to a load-balancing group by clicking Load-Balancing Group on the Engines page.

If you want to add the engine to a new group, click Add to new group from the list.

When the engine is in the load-balancing group, it cannot be used as an individual engine and does not appear when configuring an engine from the list.

(Optional) After installing the engine, you may want to set up a proxy, set up Docker hardening, configure the number of workers for the engine, or perform other related engine configurations. For more information, see Configure Engines. You can also configure an integration instance to run on the engine you created.