Multi Tenant Automation

[ChrisAycock]

Hi,

Is there a way to run XSOAR automations across all tenants without having to place (push) the automation into all the tenants? 

If I wanted to write a script to pull all incidents across all tenants, how would I do that?

Thank you.

[jfernandes1]

Hi @ChrisAycock,

This is not possible. MT environments enforce data segregation. 

You can do this via the API. You can run an external script that connects to Cortex's API via specific tenant URLs and API Keys. The script would then combine the data. 

Regarding your last question. You can view incidents from all tenants on master's incident page. Screenshot below.

[ChrisAycock]

Hi,

What would the Cortex API call look like into XSOAR to get all incidents from XSOAR?

What authentication would it pass in when being executed from your own VS Code environment?

Is there an API reference available to use?

Thank you.

[ChrisAycock]

Hi,

Is there a way to monitor jobs from multiple tenants?  API or Playbook task?  We have multiple tenants and some of the jobs, from various tenants, are erroring or hanging and we would like to write a script that would be able to report out on this.  Currently we are having to manually check the jobs in XSOAR.

Thank you.