Multi Tenant Automation

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 

Multi Tenant Automation

L1 Bithead

Hi,

 

Is there a way to run XSOAR automations across all tenants without having to place (push) the automation into all the tenants? 

 

If I wanted to write a script to pull all incidents across all tenants, how would I do that?

 

Thank you.

3 REPLIES 3

L4 Transporter

Hi @ChrisAycock,

 

This is not possible. MT environments enforce data segregation. 

 

You can do this via the API. You can run an external script that connects to Cortex's API via specific tenant URLs and API Keys. The script would then combine the data. 

 

Regarding your last question. You can view incidents from all tenants on master's incident page. Screenshot below.

Screen Shot 2023-01-10 at 12.33.17 pm.png

 

Hi,

 

What would the Cortex API call look like into XSOAR to get all incidents from XSOAR?

 

What authentication would it pass in when being executed from your own VS Code environment?

 

Is there an API reference available to use?

Thank you.

L1 Bithead

Hi,

 

Is there a way to monitor jobs from multiple tenants?  API or Playbook task?  We have multiple tenants and some of the jobs, from various tenants, are erroring or hanging and we would like to write a script that would be able to report out on this.  Currently we are having to manually check the jobs in XSOAR.

 

Thank you.

 

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!