XSOAR muti-site (DC,DR) design best practice

[MSSSOC]

Dears All,

Kindly we need your support to provide us with best practices for muti-site high availability architecture (DC, DR)

[gyldz]

Hi @MSSSOC ,

Have you ever checked our documentation on this topic? I am sharing this below. 

https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.5/Cortex-XSOAR-Administrator-Guide/Engines...

[MBeauchamp2]

There is no best practice for multi-site HA when using Cortex XSOAR.   You can setup XSOAR to be highly available within the context of a single data center, or a single cloud region.  Multi-DC or multi-Region are not supported.   

XSOAR HA - https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.11/Cortex-XSOAR-Administrator-Guide/High-A...

For Disaster Recovery when using HA with Elastic, you use elastic snapshots to restore data to a different cluster, and can switch to that cluster in the event of total loss of the original cluster, and rebuild your XSOAR app servers to use it. 

https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.11/Cortex-XSOAR-Administrator-Guide/Disast...

If you're not using HA with Elastic, then you can use the Live Backup feature which is basically an Active/Passive setup with 2 servers:

https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.11/Cortex-XSOAR-Administrator-Guide/Disast...

In lieu of Live Backup, regular snapshots of your server are a good alternative as well.