Propagation labels problem

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 

Propagation labels problem

L2 Linker

Hi everybody, I am really having a hard time syncing content with tenants because propagation labels aren't working properly for me. To give you an example, I create an xsoarcommunity tenant and set the propagation label to carbon_test so that I can't sync cortex xdr content with this tenant by mistake. Palo Alto Networks Cortex XDR - Investigation and Response content pack is already installed and I set the propagation label to xdr_test and xdr_master. In theory this pack shouldn't be syncable with the tenant I just created. Here is what happens, every single component of the content pack is now syncable.

 

EnesOzdemir_0-1657001869742.pngEnesOzdemir_1-1657001968955.png

 

EnesOzdemir_2-1657002019975.pngEnesOzdemir_3-1657002057104.png

 

Another thing to note is that if I set the propagation label to all in this case only the content pack is syncable, not every component.

I upgraded from 6.6 to 6.8 just to check if the latest release fixed the issue but unfortunately it didn't.

 

did I misunderstand how propagation labels work? If not is there anything I can do to fix this?

1 REPLY 1

L1 Bithead

Hello Enes, I see your issue and agree there must be something more to this. I took a look at our documentation and found this note: 

"As of version 6.0, if there is no relevant propagation tag on your content, for example, a script or playbook, but it is a dependency of a package that you do propagate to a tenant, the unlabeled content is still synced to the tenant." You can find the full article here: https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.8/Cortex-XSOAR-Multi-Tenant-Guide/Manage-C...

 

Maybe this is the reason why the packages are being synced to the tenants even though they shouldn't. I also took a look at this other article that talks about content dependencies and syncing even when the propagation labels don't match so please read this one as well: https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.8/Cortex-XSOAR-Multi-Tenant-Guide/Content-...

 

Let me know if any of the above fixes your issue or if you need further assistance. 

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!