XSOAR Multi-Engine Deployment on CentOS7

kreeves — Tue, 16 Apr 2024 19:11:01 GMT

I just had our instance migrated to 8.5. during testing we figure out that we could not update our engine using the shell program and need to do a zip deployment. The basic instructions for ZIP does not support multple engines on the same host. Here is our solution

If see problems please comment

xsoar create zip archive "d1_ENGINENAME".zip
Download "d1_ENGINENAME".zip
copy to server

cd /usr/local/demisto/ or mkdir /usr/local/demisto/

-- IF YOU DO NOT HAVE A RUNNING ENGINE --
mkdir /usr/local/demisto/
groupadd demisto
sudo useradd -g demisto -s /bin/false demisto
chown demisto:demisto /usr/local/demisto

-- ONCE /usr/local/demisto/ EXISTS --
cd /usr/local/demisto/
mkdir d1_ENGINENAME
chmod 755 d1_ENGINENAME
unzip PATH_TO_d1_ENGINENAME.zip -d /usr/local/demisto/d1_ENGINENAME
chown -R demisto:demisto d1_ENGINENAME
setcap CAP_NET_BIND_SERVICE=+eip /usr/local/demisto/d1_ENGINENAME/d1_linux_amd64

-- SETUP SYSCTL

cd /etc/systemd/system/
touch .d1_ENGINENAME.service
MODIFY the Services File
systemctl enable d1_ENGINENAME
systemctl start d1_ENGINENAME

--------- SYSCTL FILE i.e. .service. ----------------

[Unit]
Description=Demisto Engine Service
After=network.target

[Service]
WorkingDirectory=/usr/local/demisto/d1_ENGINENAME
Type=simple
User=demisto
Group=demisto
ExecStart=/usr/local/demisto/d1_ENGINENAME/d1_linux_amd64
EnvironmentFile=/etc/environment
Restart=always

[Install]
WantedBy=multi-user.target

-----------------------------------------

Re: XSOAR Multi-Engine Deployment on CentOS7

tzimmer — Wed, 17 Apr 2024 15:14:59 GMT

Hey,

Indeed based on the documentation the only way to support multiple engines is to install the engine using Shell method.
Installing on engine method on Centos 7, is only Zip.
as a result of the above indeed mltuple engine installation on Centos 7 is not supported.

to add this functionality in an official way I suggest submitting a feature request to in https://xsoar.ideas.aha.io/

topic XSOAR Multi-Engine Deployment on CentOS7 in Cortex XSOAR Discussions

XSOAR Multi-Engine Deployment on CentOS7

Re: XSOAR Multi-Engine Deployment on CentOS7