Step 1. Install Cortex XSOAR for multi-tenant - Learn how to install Cortex XSOAR On-prem, including system requirements and adding a license. - Administrator Guide - 8.13 - Cortex XSOAR - Cortex - Security Operations

Cortex XSOAR On-prem Documentation
Product
Cortex XSOAR
Version
8.13
Creation date
2026-02-12
Last date published
2026-05-27
Category
Administrator Guide
Solution
On-prem
Abstract

Learn how to install Cortex XSOAR On-prem, including system requirements and adding a license.

To install a multi-tenant, you need to log into Cortex Gateway, a portal for downloading the relevant image file and license. The same image applies to the main tenant, the development tenant (if relevant), and child tenants. When installing the tenants, set up the main tenant first.

Important

We recommend configuring SSO for the main tenant and the child tenant. If the main tenant is configured with SSO and the child tenant is not, you can't log into the child tenant directly. Accessing the child tenant will only be possible from the main tenant.

Before you begin

  • Plan whether to install a standalone or a cluster.

    Cortex XSOAR supports standalone or cluster installation.

    Cluster installation is suitable for large-scale data production environments, offering scalability and High Availability. Standalone is ideal for small-scale data scenarios. For more information, see Installation.

    You can deploy a single node (standalone) or a cluster (three or more nodes).

  • Review the System Requirements.

    Note

    If you want to use the extra-small scale, you can’t use the Threat Intel Management (TIM) module. If you are using TIM, you need to use the small scale and above.

    You don't need to follow the same sizing requirements for all tenants. For example, a main tenant can use a small scale while a child tenant can use a medium scale.

  • Have a basic understanding of how to deploy OVA or VHD file formats.

  • For each tenant, add DNS records that point the following host names to the cluster IP address.

    • Cluster FQDN: The Cortex XSOAR DNS name for accessing the UI. For example, xsoar.mycompany.com.

    • API-FQDN: The Cortex XSOAR DNS name mapped to the API IP address. For example, api-xsoar.mycompany.com.

    • ext-FQDN: The Cortex XSOAR DNS name mapped to the external IP address. For example, ext-xsoar.mycompany.com.

Cortex XSOAR supports the following installation file packages, which you download from Cortex Gateway:

Image file

Platform

OVA

Deploy on the following supported platforms:

  • AWS

  • OCI

  • VMWare

VHD

Deploy on Microsoft Hyper-V.

To set up your multi-tenant deployment, you must have a multi-tenant/MSSP license, such as PAN-DEMISTO-MSSP. After downloading the installation package from Cortex Gateway, you can install it on development and child tenants.

Although the order in which you install the tenants doesn't matter, this procedure installs the main tenant, the development tenant (if relevant), and the child tenant. When you reach the Cluster installation stage on each tenant, you must select the relevant Installation Mode.

Task 1. Install the main tenant

  1. From Cortex Gateway, in the Available for Activation section, use the serial number to locate the tenant to download.

    1. Click Download On Prem.

    2. Select one of the following:

      • Production - Multi-Tenant

      • Dev

        Select Dev if you want to use a production and development tenant with a private remote repository. If you don't select a development tenant now, you can install one later.

    3. Download one of the following image files.

      • OVA: Supported by VMWare, AWS, and OCI.

      • VHD: Supported by Microsoft Hyper-V.

  2. Depending on the image file and the platform you want to deploy on, do one of the following:

    Important

    When installing Cortex XSOAR on your virtual machine, from the textual UI, in the Installation Mode field, you must select Parent Tenant. For more information, see Task 6. Install Cortex XSOAR on your VM for your installation platform.

  3. After installation, add the license.

    1. Go to Settings & Info → Cortex XSOAR License.

    2. In the Upload License section, drag and drop the production license file.

      The license file is in JSON format.

    For more information, see Post-installation.

  4. (Optional) Perform post-installation maintenance, including scaling up hardware resources and using your X.509 certificate for a secure HTTP connection.

Task 2. Install the development tenant (if required)

  1. Do one of the following:

    • If you select Dev when downloading the installation package for the main tenant, install Cortex XSOAR, as described in step 2 below.

    • If you didn't select Dev when downloading the installing package in Cortex Gateway, do the following:

      1. In the Available for Activation section, find the tenant you downloaded in Task 1 above.

      2. Click Download On Prem.

      3. Select Dev.

      4. Click Next.

      5. Download one of the following image files:

        • OVA

        • VHD

        Note

        You are not restricted to using the platform installed on the main tenant. For example, if you have downloaded an OVA file and installed the VM on AWS on the main tenant, you can install the VM on OCI in the development tenant.

  2. Depending on the image file and the platform you want to deploy on, do one of the following:

    Important

    In the textual UI menu, when you reach the Cluster Installation stage, in the Installation Mode field, select Enterprise.

  3. After installation, add the non-production license.

    1. Go to Settings & Info → Cortex XSOAR License.

    2. In the Upload License section, drag and drop the non-production license file.

      The license file is in JSON format.

    For more information, see Post-installation.

  4. (Optional) Perform post-installation maintenance, including scaling up hardware resources and using your own X.509 certificate for a secure HTTP connection.

    For more information, see Post-installation.

Task 3. Install the child tenant

  1. Do one of the following:

    • If you want to use the same installation package as the main/development tenant, install Cortex XSOAR, as described in step 2 below.

    • If you want to install a different installation package, do the following:

      1. In the Available for Activation section, find the tenant you downloaded in task 1.

      2. Click Download On Prem.

      3. Select Production - Multi-Tenant

      4. Click Next.

      5. Download one of the following image files:

        • OVA

        • VHD

        Note

        You are not restricted to using the platform installed on the main tenant. For example, if you have downloaded an OVA file and installed the VM on AWS on the main tenant, you can install the VM on OCI in the child tenant.

  2. Depending on the image file and the platform you want to deploy on, do one of the following:

    Important

    In the textual UI menu, when you reach the Cluster Installation stage, do the following:

    • In the Cluster FQDN field, add the child tenant FQDN.

      The child tenant must have the same tenant name as the child tenant in Cortex XSOAR 6. if the names are different, data transfer fails in the pre-migration wizard.

    • In the Installation Mode field, select Child Tenant.

  3. (Optional) Perform post-installation maintenance, including scaling up hardware resources and using your own X.509 certificate for a secure HTTP connection.

    For more information, see Post-installation.

    Note

    You don't need to add a license. The license page is available only on the main and development tenants.

  4. After installing both the main tenant and child tenants, you can pair the child tenant to the main tenant.