Content Pack Installation - Administrator Guide - 6.5 - Cortex XSOAR - Cortex - Security Operations

Cortex XSOAR Administrator Guide

Product
Cortex XSOAR
Version
6.5
Creation date
2022-09-28
Last date published
2024-11-12
End_of_Life
EoL
Category
Administrator Guide
Abstract

Cortex XSOAR content pack dependencies, errors and warning messages. Troubleshooting content pack installation.

Before you install a content pack, you should review the content pack to see what it includes, any dependencies that are required, reviews, etc. When selecting a content pack, you can view the following information:

  • Details: general information about the content pack including installation, content, version, author, status, etc.

  • Content: information about the content pack such as automations, integrations, etc.

  • Release Notes: contains information about each version including fixes, improvements, etc.

  • Dependencies: details of any Required Content Packs and Optional Content Packs that may need to be installed with the content pack.

  • Review: You can view or add a review to the content pack. To add a review, you need to be logged in.

If you experience timeout issues when downloading content, see Marketplace Troubleshooting.

Dependencies

In Cortex XSOAR, some objects are dependent on other objects. For example, a playbook may be dependent on other playbooks, scripts, integrations, and incident fields, etc.

dependencies-flow-new.png

In the figure above, you can see that an incident type is dependent on a playbook, an incident layout, and an incident field. A widget is dependent on an incident field and a script. A script is dependent on another script, and an integration, etc.

When you install a content pack, mandatory dependencies including Required Content Packs are added automatically to ensure that it installs correctly.

Some content, while not essential for installation, ensures that the content runs successfully. These dependencies include Optional Content Packs, which can be added or removed in the Cart.

Warning

If you delete a content pack, which depends on other content packs, these content packs may not run correctly. Also, if you roll back to an earlier version of a content pack, other content packs might be affected. For example, if content pack A depends on layouts from content pack B Version 2, reverting to content pack B Version 1 could cause content pack A to stop working.

Required Content Packs

Required content packs are mandatory content packs, which download automatically with the content pack. These content packs are dependent on the required content pack and without them installation fails.

If a content pack is dependent on one or more content packs, you have to install all of them. For example, if content pack A requires content pack B and content pack B requires content pack C, when you install content pack A, all of the other content packs are installed.

Note

You cannot remove the Required Content Packs when installing a content pack.

Optional Content Packs

Optional Content Packs are used by the content pack you want to install, but are not necessary for installation. You can choose which optional content pack to install in the Cart. When you install optional content packs, mandatory dependencies are automatically included.

For example, in the Active Directory Query content pack, there are various optional content packs used by the content pack, such as Microsoft Graph Mail. You can install the content pack without Microsoft Graph Mail, if your organization does not need it.

market-optional-active.png
market-cart-active.png

Errors and Warning Messages

You may receive an error message when you try to install a content pack. If you receive an error message, you need to fix the error before installing the content pack. If a warning message is issued, you can still download the content pack, but you should fix the problem otherwise the content may not work correctly.

Error Message Example

In this example, we want to install the Impossible Traveler pack, but we already have a custom playbook with the same name/ID. When we try to install the pack, installation fails:

market-install-fail.png

When clicking view errors, you can see the error:

market-error.png

Warning Message Example

In this example, we want to update the Custom Scripts pack.

When we try to install, the following message is issued about a missing Docker image:

market-warning-docker.png

If you click Install Anyway, the pack installs, but you need to add the missing Docker image for the content to run correctly.