Cortex XSOAR Engines Overview - Administrator Guide - 6.10 - Cortex XSOAR - Cortex - Security Operations

Cortex XSOAR engines enable the Cortex XSOAR server to access internal or external services that are otherwise blocked by a firewall or a proxy, etc. For example, if a firewall blocks external communication and you want to run the Rasterize integration, you need to install an engine to access the Internet.

Within the network, you need to allow the engine to access the Cortex XSOAR server's IP address and listening port (by default, TCP 443). The engine always initiates the communication to the server.

Engines can be part of a load-balancing group, which enables distribution of the command execution load. The load-balancing group uses an algorithm to efficiently share the workload for integrations that the group is assigned to, thereby speeding up execution time. In general, heavy workloads are caused by playbooks that run a high number of commands.

Before configuring an integration to run using multiple engines in a load-balancing group, it is recommended that you test the integration using a single engine in the load-balancing group.

You can Install a Cortex XSOAR Engine on Linux and Windows machines. After installing the engine, you can configure and manage engines, including setting a web proxy, adding and removing engines, configuring the number of workers, etc. Before installing, review the system requirements in Install a Cortex XSOAR Engine.