Manage content packs - Administrator Guide - Cortex XSIAM - Cortex

Manage content packs - Administrator Guide - Cortex XSIAM - Cortex - Security Operations

Cortex XSIAM Documentation

Product

Cortex XSIAM

Creation date

2024-03-06

Last date published

2024-12-04

Dependencies

In Cortex XSIAM content packs, some objects are dependent on other objects. For example, an alert may be dependent on a playbook, an alert type, and an alert field. A script may be dependent on another script, or an integration. When you place a content pack in your cart, mandatory dependencies including required content packs are added automatically to ensure that the content pack installs correctly.

Optional content packs are used by the content pack you want to install but are not necessary for installation. When you place a content pack in your cart, you can choose which optional content pack to install. When you install optional content packs, mandatory dependencies in the optional content pack are automatically included.

Note

Optional content packs that are already installed are treated like they are required content packs to preserve content integrity.

You can only install one content pack at a time. Cortex XSIAM automatically adds any content that is required to install the content pack. You can also add any optional content packs that use the content pack you want to install.

If you receive an error message when you try to install a content pack, you need to fix the error before installing. If a warning message is issued, you can still download the content pack, but you should fix the problem otherwise the content may not work correctly.

Go to Marketplace → Browse and locate the content pack you want to install.
Click the required content pack and review the contents.
Click Install to add the content pack to the Cart.
(Optional) If the content pack includes optional content, select the content packs you want to add.
The Cart displays the number of items you are installing including any required content packs. You can log in and out, but the content packs remain in the Cart until you click either Empty cart or Install.
Click Install.
After installation, click Refresh content.

When you delete a content pack, all content is deleted including all detached and customized content.

Caution

If another content pack is dependent on the content pack you want to delete, it may break the other content pack. You can reinstall the content pack, but you cannot restore detached and customized content.

Go to Marketplace → Installed Content Packs.
In the Content Packs Library section, search for the content pack and select the content pack you want to delete.
Click the trash can icon.
Review the warning message and click Delete.

Content packs are updated for bug fixes, enhancements, and more. Marketplace is updated every 2 hours and when there is an update available for a content pack, you will see a notification in the Installed Content Packs tab in Marketplace.

In the Version History tab of a content pack, you can see the currently installed version, earlier versions, and available updates. You can revert to a previous version of a content pack if required.

If you have made any customizations, these are automatically included in any update. All dependent content packs update automatically with the content pack.

Note

Third party product Integrations are developed and tested against a specific product version. For products which are on-prem or cloud based with specific API versions, the version developed and tested against will be included in the integration's documentation. Newer versions of the product are not always immediately tested and it is expected that products maintain API compatibility upon release of newer product versions. When upgrading to a newer product version, it is highly recommended to test the integration in a dev environment before deploying to production.

Caution

If you want to downgrade, any content that depends on the content pack including any customizations may be deleted if it does not exist in the target content pack version.

In the Show field of the Installed Content Packs tab, select Update available to display the content packs that are available to update.
Click the content pack you want to update.
In the Version History tab of the content pack, view the updates that are available.
Click Update. If there is more than one update available, click the version to update.
If you choose to install the latest version it includes the previous version. If you have made any customizations these are included in any update. If any dependencies require updating, these are automatically added.
Click Install.
After the content pack installs, click Refresh content.

You can revert to an earlier version of an installed content pack. Items that are not included in the version are also deleted, such as detached playbooks, or scripts that use other scripts from the content pack. This may cause other content packs to stop working

In the Installed Content Packs tab, click the content pack you want to revert.
In the Version History tab, select the version to which you want to revert.
Click Revert to this version. The version will be added to your Cart.
In the Cart, click Downgrade.