Marketplace FAQs - Administrator Guide - EoL - 6.6 - Cortex XSOAR - Cortex - Security Operations

Cortex XSOAR Administrator Guide

Cortex XSOAR
Creation date
Last date published
Administrator Guide
End of Life > EoL

Frequently asked questions about Cortex XSOAR Marketplace content

Should Marketplace content always be updated?

Marketplace updates are a source for bug fixes and provide new commands for integrations and automations. It’s a best practice to update content packs to the newest available version. If you encounter any issue with content updates, you can revert to a previous version with one click.

When can Marketplace content be updated?

You can update content while the system is in use. If a playbook, for example, is running on an incident while you update that playbook, the original version of the playbook will continue to run without issues. If the playbook includes an integration command that has been updated, and the update occurs before the playbook reaches this task, the new version of the integration command will be used.

When should content items be duplicated versus detached?

To edit a content item, the item must be detached or be custom content. When content items are detached, they do not receive updates from the Marketplace. There are two options for editing content items:

  • Detach content item (playbook, automation, etc.) and edit the content item. If you want to receive content updates in the future, you can reattach the content item, but the modifications you made while the item was detached will be overwritten with the content update.

  • Duplicate the content item and edit the copy. When a content item is duplicated it becomes a custom content item, and therefore will not receive updates, but you can view updates to the original content item.

How does Marketplace content differ from custom content?

After Marketplace content is installed you can detach or duplicate the content and customize the content as needed. Custom content is, by definition, detached and does not receive updates.

How is content pushed to tenants in a multi-tenant deployment?

Content is pushed from the Main account to tenant accounts by using propagation labels. In order for a content item to be synced to a tenant account, both the content item and tenant account must have the same propagation label(s). Content is pushed to tenants by matching propagation labels, or if the content is labeled 'all'. By default, if no labels are assigned, the 'all' label is assigned to 'all' content.

How is Marketplace content installed on tenants in a multi-tenant deployment?

Marketplace content packs are installed on the main account and pushed to tenants based on propagation labels.

How can content updates be rolled back? Are dependencies automatically rolled back as well?

You can view all versions of a content pack in the Marketplace and revert to earlier versions there. When you revert a content pack, only the content pack is reverted, not the pack dependencies.