XSOAR muti-site (DC,DR) design best practice

MSSSOC — Tue, 08 Aug 2023 07:01:49 GMT

Dears All,

Kindly we need your support to provide us with best practices for muti-site high availability architecture (DC, DR)

Re: XSOAR muti-site (DC,DR) design best practice

gyldz — Tue, 08 Aug 2023 08:22:14 GMT

Hi @MSSSOC ,

Have you ever checked our documentation on this topic? I am sharing this below.

https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.5/Cortex-XSOAR-Administrator-Guide/Engines-and-Disaster-Recovery

Re: XSOAR muti-site (DC,DR) design best practice

MBeauchamp2 — Tue, 08 Aug 2023 14:07:11 GMT

There is no best practice for multi-site HA when using Cortex XSOAR. You can setup XSOAR to be highly available within the context of a single data center, or a single cloud region. Multi-DC or multi-Region are not supported.

XSOAR HA - https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.11/Cortex-XSOAR-Administrator-Guide/High-Availability-Overview

For Disaster Recovery when using HA with Elastic, you use elastic snapshots to restore data to a different cluster, and can switch to that cluster in the event of total loss of the original cluster, and rebuild your XSOAR app servers to use it.

https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.11/Cortex-XSOAR-Administrator-Guide/Disaster-Recovery-for-Elasticsearch

If you're not using HA with Elastic, then you can use the Live Backup feature which is basically an Active/Passive setup with 2 servers:

https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.11/Cortex-XSOAR-Administrator-Guide/Disaster-Recovery-and-Live-Backup-Overview

In lieu of Live Backup, regular snapshots of your server are a good alternative as well.

topic Re: XSOAR muti-site (DC,DR) design best practice in Cortex XSOAR Discussions

XSOAR muti-site (DC,DR) design best practice

Re: XSOAR muti-site (DC,DR) design best practice

Re: XSOAR muti-site (DC,DR) design best practice