Content Pack Installation - Administrator Guide - 8 - Cortex XSOAR - Cortex - Security Operations

Cortex XSOAR Administrator Guide

Product
Cortex XSOAR
Version
8
Creation date
2024-02-14
Last date published
2024-05-30
Category
Administrator Guide
Solution
Cloud
Abstract

Cortex XSOAR content pack dependencies, errors and warning messages.

Before you install a content pack, you should review the content pack to see what it includes, any dependencies that are required, etc. When selecting a content pack, you can view the following information:

  • Details: general information about the content pack including installation, content, version, author, status, etc.

  • Content: information about the content pack such as playbooks, integrations, etc.

  • Dependencies: details of any Required Content Packs and Optional Content Packs that may need to be installed with the content pack.

  • Version History: contains information about each version including fixes, improvements, etc.

Dependencies

In Cortex XSOAR, some objects are dependent on other objects. For example, a playbook may be dependent on other playbooks, scripts, integrations, and incident fields, etc.

dependencies-flow-new.png

In the figure above, you can see that an incident type is dependent on a playbook, an incident layout, and an incident field. A widget is dependent on an incident field and a script. A script is dependent on another script, and an integration, etc.

When you install a content pack, mandatory dependencies including Required Content Packs are added automatically to ensure that it installs correctly.

Some content, while not essential for installation, ensures that the content runs successfully. These dependencies include Optional Content Packs, which can be added or removed in the Cart.

Warning

If you delete a content pack, which depends on other content packs, these content packs may not run correctly. Also, if you roll back to an earlier version of a content pack, other content packs might be affected. For example, if content pack A depends on layouts from content pack B Version 2, reverting to content pack B Version 1 could cause content pack A to stop working.

Required Content Packs

Required content packs are mandatory content packs, which download automatically with the content pack. These content packs are dependent on the required content pack and without them installation fails.

If a content pack is dependent on one or more content packs, you have to install all of them. For example, if content pack A requires content pack B and content pack B requires content pack C, when you install content pack A, all of the other content packs are installed.

Note

You cannot remove the Required Content Packs when installing a content pack.

In this example, the Ransomware content pack requires:

Base, Common Types, and Rasterize content packs (which are installed).

Cryptocurrency content pack (which needs to be installed).

market-required-2.png
Optional Content Packs

Optional Content Packs are used by the content pack you want to install, but are not necessary for installation. You can choose which optional content pack to install in the Cart. When you install optional content packs, mandatory dependencies are automatically included.

For example, in the Active Directory Query content pack, there are various optional content packs used by the content pack, such as Microsoft Graph Mail. You can install the content pack without Microsoft Graph Mail, if your organization does not need it.

market-optional-active-2.png
market-cart-active-2.png
Errors and Warning Messages

You may receive an error message when you try to install a content pack. If you receive an error message, you need to fix the error before installing the content pack. If a warning message is issued, you can still download the content pack, but you should fix the problem otherwise the content may not work correctly.

market-install-fail-2.png

The error message is initially shown after the failed installation, and when clicking view errors, you can also see it: