https://live.paloaltonetworks.com/t5/cortex-xsoar-articles/creating-custom-docker-images-in-xsoar-8/ta-p/1219467 <DIV class="lia-message-template-content-zone"> <H1 class="c0 lia-align-center"><FONT color="#ff6600">By&nbsp;</FONT><FONT color="#FF6600">Brad Semma</FONT><FONT color="#FF6600">, Cortex XSOAR Customer Success Architect</FONT></H1> <P>&nbsp;</P> <P>&nbsp;</P> <H3 id="h.t4zswrieiw08" class="c12"><STRONG><FONT color="#FF6600"><SPAN class="c9">When to customize and when not to customize</SPAN></FONT></STRONG></H3> <P>&nbsp;</P> <P class="c6"><SPAN class="c13">Cortex XSOAR customers love to customize their instances. If a customer decides to customize an integration, they may find the assigned docker image is not configured to handle the additional actions. In events such as these, you may need to consider creating a custom docker image. Before going down this road, however, you do have some considerations to make. First, you should review the<SPAN>&nbsp;</SPAN></SPAN><SPAN class="c14 c13"><A class="c5" href="https://www.google.com/url?q=https://github.com/demisto/dockerfiles-info/blob/master/used_packages.csv&amp;sa=D&amp;source=editors&amp;ust=1738727714233534&amp;usg=AOvVaw0GM4IHpl3yBw96BWmySYi1" target="_blank" rel="noopener">XSOAR image repository<SPAN>&nbsp;</SPAN></A></SPAN><SPAN class="c8">&nbsp;and confirm there are no existing images available that meet your needs.</SPAN></P> <P class="c4">&nbsp;</P> <span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="image4.png" style="width: 999px;"><img src="https://live.paloaltonetworks.com/t5/image/serverpage/image-id/65852i27D2003CCF67BF8B/image-size/large?v=v2&amp;px=999" role="button" title="image4.png" alt="image4.png" /></span> <P><FONT color="#FF6600"><SPAN class="c13">Figure 1: xsoar-image-repository</SPAN><SPAN class="c13">_PaloAltoNetworks</SPAN></FONT></P> <P class="c4">&nbsp;</P> <P class="c6"><SPAN class="c13">Secondly, a missing feature can often be remediated by our content team via a feature request made on our</SPAN><SPAN class="c14 c13"><A class="c5" href="https://www.google.com/url?q=https://xsoar.ideas.aha.io/&amp;sa=D&amp;source=editors&amp;ust=1738727714233953&amp;usg=AOvVaw1srKL1j750lWwXxonF6Qnw" target="_blank" rel="noopener">&nbsp;Aha! Portal</A></SPAN><SPAN class="c13">. It is a good idea to check the Aha! Portal and see if a request already exists for the missing feature (you can upvote existing feature requests to assist in getting them prioritized). If you decide you need to create a custom image, remember, it is not a piece of content that will be supported by Palo Alto Networks, you will be responsible for maintaining it.</SPAN></P> <P class="c6">&nbsp;</P> <H3 id="h.xg1k7iualbt6" class="c12"><STRONG><FONT color="#FF6600"><SPAN class="c9">Differences between XSOAR 6 and XSOAR 8 Processes</SPAN></FONT></STRONG></H3> <P>&nbsp;</P> <P class="c6"><SPAN class="c13">If you have experience creating custom docker images in XSOAR 6, you may have tried to create a new custom image following the<SPAN>&nbsp;</SPAN></SPAN><SPAN class="c14 c13"><A class="c5" href="https://www.google.com/url?q=https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.13/Cortex-XSOAR-Administrator-Guide/Create-a-Docker-Image-In-Cortex-XSOAR&amp;sa=D&amp;source=editors&amp;ust=1738727714234243&amp;usg=AOvVaw13qaDaHR20oJP3mfkyITjx" target="_blank" rel="noopener">previous version’s process</A></SPAN><SPAN class="c8">. In XSOAR 8, the /docker_image_create command is no longer available. In XSOAR 8, in order to use custom docker images, you will need to use a separate image repository to store your custom images.</SPAN></P> <P>&nbsp;</P> <span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="image2.png" style="width: 999px;"><img src="https://live.paloaltonetworks.com/t5/image/serverpage/image-id/65853i5991989F2D573A99/image-size/large?v=v2&amp;px=999" role="button" title="image2.png" alt="image2.png" /></span> <P><FONT color="#FF6600"><SPAN class="c8">Figure 2: xsoar6-docker-image-create_PaloAltoNetworks</SPAN></FONT></P> <P class="c6">&nbsp;</P> <H3 id="h.lzzl1niz7sh" class="c12"><STRONG><FONT color="#FF6600"><SPAN class="c9">Creating a Custom Docker Image</SPAN></FONT></STRONG></H3> <P class="c4">&nbsp;</P> <H4 class="c6"><STRONG><FONT color="#FF6600"><SPAN class="c2">Starting with a base image</SPAN></FONT></STRONG></H4> <P>&nbsp;</P> <P class="c6"><SPAN class="c13">The default Docker images used for XSOAR are available on the<SPAN>&nbsp;</SPAN></SPAN><SPAN class="c14 c13"><A class="c5" href="https://www.google.com/url?q=https://hub.docker.com/u/demisto/&amp;sa=D&amp;source=editors&amp;ust=1738727714234579&amp;usg=AOvVaw1jcEhpnmt5Ssw-hr5DYJFz" target="_blank" rel="noopener">Demisto Docker hub</A></SPAN><SPAN class="c8">. This is a &nbsp;good place to start if you only have to make a slight change to an existing image rather than creating a whole new one. You can simply download the needed image from the Demisto Docker hub.</SPAN></P> <P>&nbsp;</P> <span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="image3.png" style="width: 999px;"><img src="https://live.paloaltonetworks.com/t5/image/serverpage/image-id/65854i3D19F3074A338A34/image-size/large?v=v2&amp;px=999" role="button" title="image3.png" alt="image3.png" /></span> <P class="c6"><FONT color="#FF6600"><SPAN class="c8">Figure 3:&nbsp;demisto-docker-hub_PaloAltoNetworks</SPAN></FONT></P> <P class="c4">&nbsp;</P> <H4 class="c6"><STRONG><FONT color="#FF6600"><SPAN class="c2">Customize the image</SPAN></FONT></STRONG></H4> <P>&nbsp;</P> <P class="c6"><SPAN class="c8">If you downloaded a copy of a Docker image from the Demisto Docker hub, use your preferred customization tool to edit the image. Remember, you can always make changes to the image later during testing.</SPAN></P> <P class="c4">&nbsp;</P> <H4 class="c6"><STRONG><FONT color="#FF6600"><SPAN class="c2">Upload your image</SPAN></FONT></STRONG></H4> <P>&nbsp;</P> <P class="c6"><SPAN class="c8">Unlike with XSOAR 6, your custom images can no longer be stored on your XSOAR instance. You will need to use either an on-prem or cloud-based image repository. You should check with your organization and confirm if there are approved private image repositories you should use or other policies you will need to follow in order to use an image repository.</SPAN></P> <P class="c4">&nbsp;</P> <H3 id="h.7qba0e7de19c" class="c12"><STRONG><FONT color="#FF6600"><SPAN class="c9">Should I use an engine?</SPAN></FONT></STRONG></H3> <P>&nbsp;</P> <P class="c6"><SPAN class="c8">Before configuring the private docker image settings on your XSOAR instance, you should decide if you need to use an engine. For example, if your image repository is located in your company’s data center, you may want to limit access to only internal IP addresses, such as those of your engines. &nbsp;</SPAN></P> <P class="c4">&nbsp;</P> <P class="c6"><SPAN class="c8">Another consideration is the amount of resources your image requires. While processes are containerized in XSOAR 8 SaaS, you may want to have more control over the specific resources available to run your image.</SPAN></P> <P class="c4">&nbsp;</P> <H4 class="c6"><STRONG><FONT color="#FF6600"><SPAN class="c2">Using an Engine</SPAN></FONT></STRONG></H4> <P class="c6">&nbsp;</P> <P class="c6"><SPAN class="c13">You can find the official steps to configure your image to connect to your image repository<SPAN>&nbsp;</SPAN></SPAN><SPAN class="c14 c13"><A class="c5" href="https://www.google.com/url?q=https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Connect-an-engine-to-an-image-registry&amp;sa=D&amp;source=editors&amp;ust=1738727714235516&amp;usg=AOvVaw1ejo_ru6uVNMi1eVuqevmK" target="_blank" rel="noopener">here</A></SPAN><SPAN class="c8">&nbsp;on the Cortex XSOAR Cloud Documentation. This document is living and &nbsp;is updated to reflect any system changes/updates. Follow the steps outlined in the document.</SPAN></P> <P class="c4">&nbsp;</P> <P class="c6"><SPAN class="c8">Make sure to perform the optional Search for or pull a Docker image (step 3) items. It is important to confirm your engine can reach your repository and see your custom image(s). This will help reduce your troubleshooting efforts if you encounter a problem with pulling your image after you have configured your tenant to use your image repository.</SPAN></P> <P class="c4">&nbsp;</P> <P class="c6"><SPAN class="c8">If you are intending to or use a load balancing group for your engines, make sure to perform this check on all of the engines located in the group.</SPAN></P> <P class="c4">&nbsp;</P> <P class="c6"><SPAN class="c8">Additional steps may be required to allow your engine(s) or XSOAR 8 instance to connect to your image repository. Check with your Github admin/team and/or networking admin/team to confirm your engine(s) or XSOAR 8 instance will not be blocked by network security tools, rules, or other settings.</SPAN></P> <P class="c4">&nbsp;</P> <H3 id="h.z71kce2au43h" class="c12"><FONT color="#FF6600"><STRONG><SPAN class="c9">Pull Your Custom Images</SPAN></STRONG></FONT></H3> <P>&nbsp;</P> <span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="image1.png" style="width: 999px;"><img src="https://live.paloaltonetworks.com/t5/image/serverpage/image-id/65855i570BF2D187966CF6/image-size/large?v=v2&amp;px=999" role="button" title="image1.png" alt="image1.png" /></span> <P class="c6"><SPAN class="c8"><FONT color="#FF6600">Figure 4:&nbsp;xsoar-image-registry-settings_PaloAltoNetworks</FONT></SPAN></P> <P class="c4">&nbsp;</P> <P class="c6"><SPAN class="c13">The official steps for configuring your tenant to access your image repository are found<SPAN>&nbsp;</SPAN></SPAN><SPAN class="c14 c13"><A class="c5" href="https://www.google.com/url?q=https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Pull-images-from-a-private-image-registry&amp;sa=D&amp;source=editors&amp;ust=1738727714236278&amp;usg=AOvVaw1bXyct7G-nbNwEtPTMKTvv" target="_blank" rel="noopener">here</A></SPAN><SPAN class="c8">. Turn the switch to On, and follow the instructions for either the direct pull or engine pull method. Make sure the correct Connection option is selected.</SPAN></P> <P class="c4">&nbsp;</P> <P class="c6"><SPAN class="c13">You can only connect your XSOAR 8 instance to one image registry for custom images (integrations will continue to pull their images from the Demisto image repository). You will also need to specify each image you wish to import. Once the image(s) have been selected, click Save and you are ready to start using your custom images.</SPAN></P> <H3 class="c12">&nbsp;</H3> <H3 id="h.5ia7imctmsae" class="c12"><FONT color="#FF6600"><STRONG><SPAN class="c9">Troubleshooting Issues</SPAN></STRONG></FONT></H3> <P>&nbsp;</P> <P class="c6"><SPAN class="c8">There is always a chance that, even if you follow every step to the letter, you may encounter issues with connections or with the chosen image. Below are some items to consider. You can also discuss any issues with your Customer Success team, if you have one available.</SPAN></P> <P class="c4">&nbsp;</P> <UL class="c7 lst-kix_ylbhn2n6yklk-0 start"> <LI class="c6 c15 li-bullet-0"><SPAN class="c2">Connection Issues</SPAN></LI> </UL> <UL class="c7 lst-kix_ylbhn2n6yklk-1 start"> <LI class="c6 c10 li-bullet-0"><SPAN class="c8">If experiencing connection issues, and using an engine, make sure to confirm the engine can connect to the instance using CURL run from the engine. This can point to an issue with the URL or potentially a routing issue.</SPAN></LI> <LI class="c6 c10 li-bullet-0"><SPAN class="c8">If connecting your XSOAR instance directly to your image repository, remember to double check your passwords and access tokens</SPAN></LI> <LI class="c6 c10 li-bullet-0"><SPAN class="c8">If you are able to search for image tags in Import Images, this does indicate the system can connect to your registry and there may be indicate an issue with your image repository</SPAN></LI> </UL> <UL class="c7 lst-kix_ylbhn2n6yklk-0"> <LI class="c6 c15 li-bullet-0"><SPAN class="c2">Image Issues</SPAN></LI> </UL> <UL class="c7 lst-kix_ylbhn2n6yklk-1 start"> <LI class="c6 c10 li-bullet-0"><SPAN class="c8">If you run into issues with your custom docker image, consider the base image you are using</SPAN></LI> </UL> <UL class="c7 lst-kix_ylbhn2n6yklk-2 start"> <LI class="c6 c17 li-bullet-0"><SPAN class="c8">If, for example, you are creating a new docker image for a customized integration, you should try using the original default Docker image assigned to that integration</SPAN></LI> </UL> <UL class="c7 lst-kix_ylbhn2n6yklk-1"> <LI class="c6 c10 li-bullet-0"><SPAN class="c8">If your image requires access to external resources, you will need to verify if they are accessible on the source running the image (XSOAR 8 instance or engine)</SPAN></LI> </UL> <UL class="c7 lst-kix_ylbhn2n6yklk-2 start"> <LI class="c6 c17 li-bullet-0"><SPAN class="c8">You may need to consider an engine in this scenario if you are encountering issues with the image not being able to reach an external resource</SPAN></LI> </UL> <P class="c4">&nbsp;</P> <H2 class="c6"><FONT color="#FF6600"><STRONG><SPAN class="c8">References</SPAN></STRONG></FONT></H2> <P>&nbsp;</P> <UL class="c7 lst-kix_24cost3tn3fz-0 start"> <LI class="c3 li-bullet-0"><SPAN class="c14 c13"><A class="c5" href="https://www.google.com/url?q=https://github.com/demisto/dockerfiles-info/blob/master/used_packages.csv&amp;sa=D&amp;source=editors&amp;ust=1738727714237363&amp;usg=AOvVaw1vw3MTP50xUMhxaFvJG5Ss" target="_blank" rel="noopener">GitHub Demisto Docker Files</A></SPAN></LI> <LI class="c3 li-bullet-0"><SPAN class="c14 c13"><A class="c5" href="https://www.google.com/url?q=https://xsoar.ideas.aha.io/&amp;sa=D&amp;source=editors&amp;ust=1738727714237507&amp;usg=AOvVaw0XjPITfgIE4p3_As7yyPg1" target="_blank" rel="noopener">Aha! Portal for Feature Requests</A></SPAN></LI> <LI class="c3 li-bullet-0"><SPAN class="c14 c13"><A class="c5" href="https://www.google.com/url?q=https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.13/Cortex-XSOAR-Administrator-Guide/Create-a-Docker-Image-In-Cortex-XSOAR&amp;sa=D&amp;source=editors&amp;ust=1738727714237693&amp;usg=AOvVaw1hAck3a843LumFEl3qv1Q-" target="_blank" rel="noopener">Cortex XSOAR Administration Guide, Create a Docker Image In Cortex XSOAR</A></SPAN></LI> <LI class="c3 li-bullet-0"><SPAN class="c14 c13"><A class="c5" href="https://www.google.com/url?q=https://hub.docker.com/u/demisto/&amp;sa=D&amp;source=editors&amp;ust=1738727714237830&amp;usg=AOvVaw3eJItcOcrMqxawPfDCNY4G" target="_blank" rel="noopener">Demisto Docker Hub</A></SPAN></LI> <LI class="c3 li-bullet-0"><SPAN class="c13 c14"><A class="c5" href="https://www.google.com/url?q=https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Connect-an-engine-to-an-image-registry&amp;sa=D&amp;source=editors&amp;ust=1738727714237983&amp;usg=AOvVaw1eczv00xyRXopy3_ldq_0l" target="_blank" rel="noopener">Cortex XSOAR Administration Guide, Connect an engine to an image registry</A></SPAN></LI> <LI class="c3 li-bullet-0"><SPAN class="c14 c13"><A class="c5" href="https://www.google.com/url?q=https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Pull-images-from-a-private-image-registry&amp;sa=D&amp;source=editors&amp;ust=1738727714238124&amp;usg=AOvVaw1avrpcp3ItZH1JGTdoPDFG" target="_blank" rel="noopener">Cortex XSOAR Administration Guide, Pull image from a private image registry</A></SPAN></LI> </UL> <P>&nbsp;</P> <H2><FONT color="#FF6600"><SPAN class="c14 c13">About the Author</SPAN></FONT></H2> <P>&nbsp;</P> <P data-pm-slice="1 1 []">Brad Semma is a Senior Customer Success Architect for Cortex XSOAR. Prior to joining Palo Alto Networks, Brad managed SOC and Incident Response teams in the healthcare and financial industries and has experience in Cybersecurity and End User Technology engineering.</P> </DIV> Thu, 06 Feb 2025 18:00:57 GMT RPrasadi 2025-02-06T18:00:57Z https://live.paloaltonetworks.com/t5/cortex-xsoar-articles/creating-custom-docker-images-in-xsoar-8/ta-p/1219467 <P><SPAN class="c13">Cortex XSOAR customers love to customize their instances. If a customer decides to customize an integration, they may find the assigned docker image is not configured to handle the additional actions. In events such as these, you may need to consider creating a custom docker image. Before going down this road, however, you do have some considerations to make. First, you should review the<SPAN>&nbsp;</SPAN></SPAN><SPAN class="c14 c13"><A class="c5" href="https://www.google.com/url?q=https://github.com/demisto/dockerfiles-info/blob/master/used_packages.csv&amp;sa=D&amp;source=editors&amp;ust=1738727714233534&amp;usg=AOvVaw0GM4IHpl3yBw96BWmySYi1" target="_blank" rel="noopener">XSOAR image repository<SPAN>&nbsp;</SPAN></A></SPAN><SPAN class="c8">&nbsp;and confirm there are no existing images available that meet your needs.</SPAN></P> Thu, 06 Feb 2025 18:00:57 GMT https://live.paloaltonetworks.com/t5/cortex-xsoar-articles/creating-custom-docker-images-in-xsoar-8/ta-p/1219467 RPrasadi 2025-02-06T18:00:57Z