topic Re: Multi Tenant Automation in Cortex XSOAR Discussions

Multi Tenant Automation

ChrisAycock — Thu, 05 Jan 2023 21:32:37 GMT

Hi,

Is there a way to run XSOAR automations across all tenants without having to place (push) the automation into all the tenants?

If I wanted to write a script to pull all incidents across all tenants, how would I do that?

Thank you.

Re: Multi Tenant Automation

jfernandes1 — Tue, 10 Jan 2023 01:34:01 GMT

Hi @ChrisAycock,

This is not possible. MT environments enforce data segregation.

You can do this via the API. You can run an external script that connects to Cortex's API via specific tenant URLs and API Keys. The script would then combine the data.

Regarding your last question. You can view incidents from all tenants on master's incident page. Screenshot below.

Re: Multi Tenant Automation

ChrisAycock — Tue, 10 Jan 2023 17:49:29 GMT

Hi,

What would the Cortex API call look like into XSOAR to get all incidents from XSOAR?

What authentication would it pass in when being executed from your own VS Code environment?

Is there an API reference available to use?

Thank you.

Re: Multi Tenant Automation

ChrisAycock — Fri, 27 Jan 2023 22:06:23 GMT

Hi,

Is there a way to monitor jobs from multiple tenants? API or Playbook task? We have multiple tenants and some of the jobs, from various tenants, are erroring or hanging and we would like to write a script that would be able to report out on this. Currently we are having to manually check the jobs in XSOAR.

Thank you.