topic Re: [Multi-Tenant] System configuration levels in Cortex XSOAR Discussions

[Multi-Tenant] System configuration levels

EnesOzdemir — Tue, 01 Aug 2023 13:24:41 GMT

in a multi tenant environment, should I forward all the system configurations to tenants or are some of them meant only for hosts?

CSP cases in particular, can be pretty confusing. CSP tells me to put a sys config on the main account and in another comment they say to set the conf on the host as well and in some they recommend forwarding it to tenants. How should I approach to system configurations when dealing with multiple configuration endpoints without having to confirm the configuration level.

For example:
https://xsoar.local/host_2/#/settings/troubleshooting
https://xsoar.local/#/settings/troubleshooting
https://xsoar.local/acc_TEST#/settings/troubleshooting

Re: [Multi-Tenant] System configuration levels

MBeauchamp2 — Tue, 01 Aug 2023 14:55:05 GMT

Server configurations that you want to be the same across all Tenants should be set at the main and forwarded to the Tenants. This way you can update the configuration at the main and it will be sync'd across, versus having to do it individually. This makes your administration much easier.

Examples might configurations like Docker Hardening configs, instance.execute.external for external long running integrations, etc.

Configurations that are different by Tenant should be set at the Tenant level. For example, you may have different close reasons for Incidents on different Tenants, so setting the incident.closereasons config individually is the way go to.

So basically TLDR:

If it's common across all -> Set at Main and Forward.

If it's unique -> Set at Tenant.

Re: [Multi-Tenant] System configuration levels

EnesOzdemir — Wed, 02 Aug 2023 07:35:40 GMT

are there any cases where you should put the configuration in the main account and the host rather than tenant?

Re: [Multi-Tenant] System configuration levels

MBeauchamp2 — Wed, 02 Aug 2023 14:42:09 GMT

Not that I can think of at this time.

It should be called out in the Server Configuration documentation if there are any exceptions, and I don't see any:

https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.11/Cortex-XSOAR-Administrator-Guide/Server-Configurations