While Cortex XDR does not have a native “push-button” feature within the management console to directly synchronize Indicators of Compromise (IOCs) between separate tenants, continuous sharing between tenants in different regions can be achieved using automation through Cortex XSOAR or via the Public API.

Recommended Solution: Automation via Cortex XSOAR:

Palo Alto Networks provides an official Cortex XDR Content Pack for Cortex XSOAR/XSIAM that enables automated synchronization of IOCs from a central repository to one or more XDR tenants, regardless of their geographical region.

How to configure continuous sharing:

Centralize Intelligence:
Manage your threat intelligence within XSOAR (typically using the Threat Intelligence Management/TIM module).]
Multi-Instance Setup:
Configure multiple instances of the Cortex XDR - IOC integration in XSOAR. Each instance must point to the unique URL of the target XDR tenants (e.g., tenants in different regions).
Automated Playbooks:
Use the following official playbooks to push indicators continuously:
- Cortex XDR IOCs - Push new IOCs to XDR (Main): Automatically synchronizes active indicators from XSOAR to the linked XDR tenants.
- Cortex XDR IOCs – Disable expired IOCs in XDR: Ensures that when an indicator expires in your central list, it is also disabled in the XDR tenants.
Integration Command:
The underlying command used by these playbooks to programmatically insert indicators is xdr-iocs-push.

Alternative: Public API Synchronization:

If you do not use XSOAR, you can develop a custom script to periodically sync IOCs between tenants using the Cortex XDR Public API.

Export from Source:
Use the Get Indicators API to retrieve IOCs from the primary tenant.
Import to Destination:
Use the following endpoint to bulk add IOCs to the secondary tenant:

/public_api/v1/indicators/insert_jsons
Regional Accessibility:
API requests are directed to the specific regional FQDN of the tenant (e.g., api-<xdr-tenant>.xdr.<region>.paloaltonetworks.com), allowing synchronization across different geographical boundaries.

This approach provides flexibility but requires custom development and maintenance, whereas XSOAR offers a more structured and scalable automation framework for continuous IOC sharing.

topic Cortex XDR - Sharing IOC with Other Tenant in Cortex XDR Discussions

Cortex XDR - Sharing IOC with Other Tenant

Re: Cortex XDR - Sharing IOC with Other Tenant

Recommended Solution: Automation via Cortex XSOAR:

Alternative: Public API Synchronization:

Re: Cortex XDR - Sharing IOC with Other Tenant

Re: Cortex XDR - Sharing IOC with Other Tenant