Issue in enabling the "content-repository" feature.

[assubramania]

Hi Team, I have a customer who wants to enable the "content-repository" built-in feature.

They tried the below steps:
1. First, they have enabled the feature successfully in DEV.
2. Next, when they enabled the feature in PROD, they got an error (refer to screenshot "PROD")
3. As mentioned in the above screenshot, tried to disable the feature in our DEV but a popup says I need to "discard" all the changes (refer to screenshot "DEV"). Which I don't want to and there might be data loss that is not pushed to PROD or specific to DEV. 

Now they want to enable this feature without any impact on the data in DEV and PROD. I am waiting for the answers.

[vmikhailov]

is it XSOAR v8 MT?

BTW I think you need to chose on the screenshot "Prod" second option "Existing content on the specified repository" and overwrite all the content in prod using content in your remote repo. If you have some content on prod which is not on dev I can recommend to export it first, import into dev and push to repo that you could pull relevant copy of content

[assubramania]

Thank you for the response.

Yes, it is XSOAR 8.5. I have attached the file which the customer added. 

[vmikhailov]

that looks as expected, what if to chose on the screenshot "Prod" second option "Existing content on the specified repository" and overwrite all the content in prod using content in your remote repo. If you have some content on prod which is not on dev I can recommend to export it first, import into dev and push to repo that you could pull relevant copy of content

[assubramania]

Thank you. I will check the same with the customer and let you know. 

[assubramania]

Hi, 

I have updated the customer with your response. But their expectation is where the DEV and PROD, content is different. They want the data to be "AS IS". They want to enable the content repository so that, from 1st push, they will make sure related content in dev is the same as PROD before they PUSH.

If they go with your approach, my data in PROD will be replaced with DEV and everything will break.

Please let me know another alternate plan.

[vmikhailov]

Hi,

I think thats some misunderstanding here. you have three components in that design: dev, prod and repo with committed content.

when you initially turn on feature in prod it will take all the content from repo and replace current content in prod with that one, there is no other way to configure it (ok, to be correct that's an other way - to use ci/cd process but thats other feature way more complex). What you need to do step by step:
1. Enable "remote repo" in dev

2. Move all the needed content from prod (if any) to dev using export/import features.

3. Push to repo all the needed for your prod to work. I mean to not to break anything it should be at least the same content what you already use in prod now. After that step you should have pushed to repo all the content to replace prod.

4. Enable feature in prod and pull all the content from repo. Yes, it will replace the current content in prod but to avoid any issues you need to have in that repo already content in use in prod (dont forget about marketplace content packs)

thats it.

that's also possible to sync to repo content from prod first but in this case it means that content in dev will be replaced. thats on you to chose what way you prefer, it also depends on where you have your custom content if any (on dev or prod or both). see more details https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Administrator-Guide/Set-up-a-...

[assubramania]

Thank you for the response.

During the call with the customer they had some open questions:

1. Can you do something from your backend, were we can bypass the discard option (deleting all the local content) in Dev, so that i can continue enabling the feature? - If we want to go ahead discarding the changes in DEV, can we ignore by selecting excluding from PROD, so that content is not deleted in DEV. - Is there are any alternative solution?

2. we want to enable built-in Content repository "AS IS" in Dev and PROD, without any content loss.

3. Lets assume, we are setting from scratch and Prod is our primary content (PULL), how the data would be synced back to DEV (PUSH). - Will the data in Dev remain same and on top of it, the PROD content would be synced? - or DEV content would be replaced with PROD content?

Please assist.

[vmikhailov]

replying to your topics:

1. Try to request from support or from Customer Success if you have any. Thats not relevant topic for Live community questions

2. Not supported, see next point.

3. I put above the process, thats what you need to follow to not to loose anything from prod and start to use feature:

1. Enable "remote repo" in dev

2. Move all the needed content from prod (if any) to dev using export/import features.

3. Push from dev to repo all the needed for your prod to work. I mean to not to break anything it should be at least the same content what you already use in prod now. After that step you should have pushed to repo all the content to replace prod.

4. Enable feature in prod and pull all the content from repo. Yes, it will replace the current content in prod but to avoid any issues you need to have in that repo already content in use in prod (dont forget about marketplace content packs)