Configure engines - Configure Cortex XSOAR engines by editing the d1.conf file or modifying the configuration in the UI (for shell installations). - Administrator Guide - 8 - Cortex XSOAR - Cortex - Security Operations

Cortex XSOAR SaaS Documentation
Product
Cortex XSOAR
Version
8
Creation date
2024-03-07
Last date published
2025-12-14
Category
Administrator Guide
Solution
SaaS
Abstract

Configure Cortex XSOAR engines by editing the d1.conf file or modifying the configuration in the UI (for shell installations).

When installing an engine, a d1.conf file is installed on your machine. Some configurations can only be done by editing the d1.conf file. If you install via Shell, you can edit the configuration in the UI as well as edit the file directly.

A use case for modifying the engine configuration is if you want to generate engine logs for a specific log level.

Edit the d1.conf file

  1. On the machine on which you installed the engine, navigate to the d1.conf file:

    Installation Type

    Location

    RPM, DEB, Shell

    /usr/local/demisto

    If using multiple engines, the location is /usr/local/demisto/name of the engine>. For example, /usr/local/demisto/d1_e1

    ZIP

    Same folder as the binary.

  2. Modify the file as required. See Common properties when editing an engine configuration

    You can also Configure the engine to use a web proxy.

Modify the configuration in Cortex XSOAR (Shell installations only)

Ensure that the data is in JSON format. The properties that you specify override the values defined in the d1.conf file.

  1. From the engines table, select the engine for which you want to modify the configuration.

  2. Click Edit Configuration.

  3. In the JSON formatted configuration dialog box, modify the properties as required. For more information, see Common properties when editing an engine configuration.

    edit_engine_config.png

Common properties when editing an engine configuration

The following table describes the common properties when editing an engine configuration using the d1.conf file (located by default at /usr/local/demisto/) or in the JSON formatted configuration dialog box in Cortex XSOAR.

Property

Type

Values

Edit

http_proxy

String

The IP address of the HTTP proxy through which the engine communicates.

For an example, see Configure the engine to use a web proxy.

The engine d1.conf file.

https_proxy

String

The IP address of the HTTP/s proxy through which the engine communicates.

For an example, see Configure the engine to use a web proxy.

The engine d1.conf file.

LogLevel

String

  • debug

  • info

  • warning

The engine d1.conf file or in the JSON formatted configuration dialog box.

log.rolling.maxfilesize

String

The maximum size in MB to retain log files based. Default is 20 MB.

log.rolling.backups

String

The maximum number of log files to retain. Default is 3.

log.rolling.maxage

String

The maximum number of days to retain old log files based on the time stamp encoded in the file name. Default is 0 (not to retain old log files based on age).

Note

A day is defined as 24 hours and may not exactly correspond to calendar days due to daylight savings, leap seconds, etc.

BindAddress

String

The port on which the engine listens for agent connection requests and communication task responses.

The engine d1.conf file.

EngineURLs

String array

An array of tenant addresses to which the engine tries to connect. If you change the tenant URL, you need to update this parameter.

Note

In addition, to support engine upgrades from the UI, edit the /usr/local/demisto/upgrade.conf file on the engine to include the SERVER_URLS setting with the new tenant's address. Include only the host, without https:// or any additional path at the end of the host name. For example: SERVER_URLS="api-example.us.paloaltonetworks.com"

The engine d1.conf file.

LogFile

String

Path to the d1.log file. If you change the name or location of the d1.log file, you need to update this parameter.

The engine d1.conf file.

engine.handshake.max.retries.slow

String

The maximum time in minutes the engine will try to reconnect after losing communication. Default is 600 (10 hours).

Note

If the engine loses communication for longer than this time, it will disconnect and you need to restart the service.

The engine d1.conf file.