Share Indicators Overview - EoL - Multi-Tenant Guide - 6.11 - Cortex XSOAR - Cortex - Security Operations

Cortex XSOAR Multi-Tenant Guide

Product
Cortex XSOAR
Version
6.11
Creation date
2022-12-12
Last date published
2024-07-16
Category
End of Life > EoL
Multi-Tenant Guide
Abstract

Share indicators between tenant accounts by exporting a tenant’s indicators to a shared index and configuring tenants to ingest from shared index.

The share indicators feature requires a Cortex XSOAR Threat Intel Management license and that Cortex XSOAR runs using Elasticsearch.

Each tenant account has a dedicated shared index in Elasticsearch. When you share a tenant’s indicators, either manually or using the Cortex XSOAR Indicators Share integration, the indicators are stored in the index. Other tenants ingest from this index, using the Elasticsearch Feed integration.