A tenant, or account, is a single instance of Cortex XSOAR that you connect to a host. You populate tenants with users by specifying user roles. Any user who belongs to a selected role is automatically added to the account. All nested roles (both directions) must be explicitly assigned. When you create the tenant account you can specify the propagation labels, which determines which content items are eligible for syncing to the tenant.
Note
When adding a role, by default, the administrator with read and write permissions is added automatically.
Each tenant machine must meet the multi-tenant sizing requirements.
In Cortex XSOAR, go to → → .
Click the Add account button.
Enter a meaningful name for the account.
The account name cannot contain white space.
Choose the host or high availability group.
(Optional) Select existing propagation labels or type new propagation labels.
Select at least one role to add to the account.
The administrator with read and write permissions is added to the account by default. You can change this if required.
Click Create account.
You can access the tenant account via the main account URL or via the host URL, depending on your specific needs. If you access a tenant account via the main account, the main account must have a public URL. If you access a tenant account via the host, the host must have a public URL. Keep in mind that if you access the tenant account via the host URL, the entry will not be recorded in the main account.
In the Main Account, you can also select which tenant account’s dashboard, incidents, and indicators (Threat Intel page) to view and take action as necessary without having to switch accounts. This enables you to view information quickly and more efficiently.
Location may be a factor when planning how to access accounts. If a user is in Europe, the main account is in the United States, and the tenant account is in Europe, accessing the tenant account through the main account requires going from Europe to the United States and back to Europe, and is less efficient than directly accessing the host URL.
Note
To delete a tenant, go to → → . Select the tenant, Stop the tenant, and then Delete account.