Manage the child tenants and it's content from the main tenant.
After you have set up and configured Cortex XSOAR multi-tenant you can manage the following:
Manage investigations: From the main tenant, you can see all tenants' incidents and indicators. You do not need to switch between tabs or screens to view data for child tenants. You can also pivot to any child tenant, subject to permission for those tenants.
Run a command on multiple tenants: Run a batch command on the main tenant for all child tenants.
In the main tenant, you can pivot to a child tenant from specific pages, such as Incidents, and Dashboards. For example, on the Dashboards page, click Main Tenant and then click the child tenant you want to navigate to.
In Cortex XSOAR, you can use the Tenant Management for the following options:
Add propagation labels to child tenants, remote repositories, and content, and then sync the content from the main tenant to child tenants.
Pair the main to a child tenant. In Pair new tenant, add the child tenant URL, the pairing token copied from the child tenant, and the tenant name, which must be unique.
Note
During the pairing process, content is not synced.
Unpair a connected child tenant from the main tenant. The status of the child tenant changes to Unpaired. If you click the child tenant link from the main tenant, you are navigated to the Pair with main screen of the child tenant. You might need to re-login to the child tenant to access the Pair with main screen.
Note
You cannot use a child tenant unless it is paired to the main tenant.
You can click Remove to remove the tenant from the list of tenants in Tenant Management. If you want to pair the child tenant back to the main tenant after it's been removed, you must Pair new tenant. The tenant name and tenant URL remains the same.
Re-pair a child tenant where status is Unpaired.
Select Sync to sync content from the main tenant to the selected child tenant. You can also sync content to all tenants by selecting Sync all tenants.
In case of a potential security issue, you can disconnect a child tenant from the main tenant. This option revokes the valid pairing token and generates a new token for the child tenant. From the child tenant go to → → and from Revoke access to tenant, click Revoke. The pairing token remains active for 24h before a new token is generated. The status of the child tenant in the main tenant updates to Unauthorized. To repair the child tenant, from the child tenant go to → → and from Pair with main tenant, click Copy Pairing Token. In the main tenant, select the child tenant and click Re-Pair Token and paste the pairing token. The status is updated to Paired.
If a child tenant is not available, the connection between the main and child tenant becomes Disconnected. Content is propagated to the child tenant once the child tenant is reconnected to the main tenant and Sync is selected.