Marketplace FAQs - Administrator Guide - Cortex XSIAM - Cortex - Security Operations

Cortex XSIAM Documentation

Product
Cortex XSIAM
Creation date
2024-03-06
Last date published
2024-12-12
Category
Administrator Guide
Abstract

Frequently asked questions about Cortex XSIAM Marketplace Content

Should Marketplace content always be updated?

Marketplace updates are a source for bug fixes and provide new commands for integrations and scripts. It’s a best practice to update content packs to the newest available version. If you encounter any issue with content updates, you can revert to a previous version with one click.

When can Marketplace content be updated?

You can update content while the system is in use. If a playbook, for example, is running on an incident while you update that playbook, the original version of the playbook will continue to run without issues. If the playbook includes an integration command that has been updated, and the update occurs before the playbook reaches this task, the new version of the integration command will be used.

When should content items be duplicated versus detached?

To edit a content item, the item must be detached or be custom content. When content items are detached, they do not receive updates from Marketplace. There are two options for editing content items:

  • Detach content item ( such as playbooks, and automations) and edit the content item. If you want to receive content updates in the future, you can reattach the content item, but the modifications you made while the item was detached will be overwritten with the content update.

  • Duplicate the content item and edit the copy. When a content item is duplicated it becomes a custom content item, and therefore will not receive updates, but you can view updates to the original content item.

How does Marketplace content differ from custom content?

After Marketplace content is installed you can detach or duplicate the content and customize the content as needed. Custom content is, by definition, detached and does not receive updates.

How can content updates be rolled back? Are dependencies automatically rolled back as well?

You can view all versions of a content pack in Marketplace and revert to earlier versions there. When you revert a content pack, only the content pack is reverted, not the pack dependencies.