The following provides instructions for installing a new Cortex XSOAR environment with Elasticsearch.
Verify the following information and requirements before you install Cortex XSOAR with Elasticsearch.
Your deployment meets the Elasticsearch System Requirements.
You have root access.
Elasticsearch is installed. Elasticsearch should not be installed on the same server as Cortex XSOAR.
The production server has Python 2.7 or 3.x.
If you are installing on an Oracle Linux operating system, you need to manually Install Docker.
If you are installing on CentOS v7, you need Mirantis Container Runtime (formerly Docker Engine - Enterprise) or Red Hat's Docker distribution to run specific Docker-dependent integrations and automations. For more information see Install Docker Distribution for Red Hat on Cortex XSOAR.
If you are deploying a signed installer, you need to import the public key to the operating system. The public key is valid for six months.
It is recommended to install the Elasticsearch Monitoring content pack from the Marketplace to monitor Elasticsearch. After installation, add the Elasticsearch Monitoring dashboard, which includes various widgets to monitor Elasticsearch cluster status and track statistics.
Installation File Structure
For information about the default installation file structure, see Installation File Structure.
For the list of supported installer flags, see Elasticsearch Installer Flags
Download Cortex XSOAR from the link that you received from Cortex XSOAR Support by running the following command.
wget -O demisto.sh “
When you receive a link to download, ensure that the
downloadLinklink refers to
wget -O demisto.sh “https://firstname.lastname@example.org&eula=accept”
To download the latest vendor affirmed FIPS version, append
&downloadName=fips. For example,
wget -O demisto.sh “https://email@example.com&eula=accept&downloadName=fips”
(Optional) If you are deploying Cortex XSOAR using a signed installer (GPG), you need to import the GPG public key that was provided with the signed installer.
For example, you can use the
rpm --import public.keycommand to import the public key into the local GPG keyring. Note that each operating system has specific requirements.
(Optional) If you are deploying Cortex XSOAR using a signed installer (GPG) you might need to manually install the
makeselfpackage by running the
yum install makeselfcommand.
chmod +x demistoserver-xxxx.shcommand to convert the
.shfile to an executable file.
To install the app server with Elasticsearch, run one of the following commands:
If using username and password authentication:
sudo ./demisto.sh -- -elasticsearch-url=<elastic search url address> -elasticsearch-username=<the elasticsearch user name> -elasticsearch-password=<the elasticsearch password>
If using API key authentication:
sudo ./demisto.sh -- -elasticsearch-url=<elastic search url address> -elasticsearch-api-key=<the elasticsearch API key>
Accept the EULA and add the information when prompted.
(Optional) After the installation has completed, do the following:
Confirm that the Cortex XSOAR server status is active, by running the
systemctl status demistocommand.
If the server is not active, run the
systemctl start demistocommand to start the server.
Confirm that the Docker service status is active, by running the
systemctl status dockercommand.
In a web browser, go to the
https://to verify that Cortex XSOAR was successfully installed.
When you open Cortex XSOAR for the first time you need to add the license.