Run a Command on Multiple Tenants - Multi-Tenant Guide - 6.12 - Cortex XSOAR - Cortex - Security Operations

Cortex XSOAR Multi-Tenant Guide

Product
Cortex XSOAR
Version
6.12
Creation date
2023-04-30
Last date published
2023-12-18
Category
Multi-Tenant Guide

In some cases, you might need to run a command across multiple tenants. For example, you might want to enrich certain IOCs across all tenant accounts.

From the main account, you can batch run a command on incidents from different tenant accounts. Running a command at the main account runs it locally on each tenant account.

If the command doesn’t exist on a particular tenant or if the user running the command from the main account doesn’t have the correct permissions, the command execution will fail and the output will be written to the incident’s war room. You will not see the error in the main account.

In some cases, tenants may have different versions of the same command. The local version of the command runs on the tenant.

  1. On the Main AccountAccount Management - Incidents page, select one or more incidents.

  2. Click Run Command.

  3. Enter ! and the command and press enter.