Sync Content to Child Tenants - Multi-Tenant Guide - 8 - Cortex XSOAR - Cortex - Security Operations

Cortex XSOAR Multi-Tenant Guide
Product
Cortex XSOAR
Version
8
Creation date
2024-02-14
Last date published
2024-04-14
Category
Multi-Tenant Guide
Solution
Cloud
Abstract

Sync content to each child tenant individually or sync content to all child tenants in a single operation in a Cortex XSOAR multi-tenant deployment.

The content that you sync from the main tenant to the child tenants might add, override, or remove content from the child tenants. New content items, which do not currently exist on the child tenants, are added. When you sync content to child tenants, there can potentially be content items added.

  • Add: New content items, which do not currently exist on the child tenants, will be added.

  • Override: For content items that are being pushed in the sync operation and which already exist on the child tenants, the sync operation overrides the existing content on the child tenants.

  • Remove: For content items that were removed from the main tenant and which already exist on the child tenants, the sync operation removes the existing content from the child tenants.

You must review each content item and its dependencies before syncing the content. You have the option to remove items before executing the sync operation for a single tenant.

Before you begin, ensure that you have the necessary permissions to sync tenants.

  1. In the main tenant, go to Settings & Info → Settings → Tenant Management.

  2. Select one of the following options to sync content.

    1. (Option 1) To review the content you want to sync to a child tenant, select the required tenant checkbox and then click Sync.

      1. Review all content affected by the sync operation in the ADD, OVERRIDE, REMOVE tabs.

      2. If there are playbooks listed in the OVERRIDE tab, select or clear the checkbox to Override playbook inputs in the child tenant.

      3. If the Run on field has changed in the script, select or clear the Overwrite script run-on to override this field in the child tenant.

    2. (Option 2) To sync content to child tenants without manual review, select two or more child tenants and then click Sync.

      This option automatically updates new, and existing content to the child tenant, and removes outdated content. If there are playbooks and scripts select or clear the checkbox to Override playbook inputs and script run-on-settings in the child tenant.

  3. Click Sync.