End-of-Life (EoL)
Migrate Cortex XSOAR Objects to Elasticsearch for a Single
Server
You should migrate Cortex XSOAR objects to Elasticsearch
if you plan to ingest a large amount of objects.
When you run the migration tool, parameter
values specified in the
demisto.conf
file override
values supplied for tool flags and default values. If no value exists
in the demisto.conf
file, values supplied in
the tool flags override default values, but do not write the values to
the demisto.config
file. For example, if the db-path
is
identified in the configuration file, the tool will use the value
in that file, not the value supplied or the default value, when
running the tool. Download the migration tool
To
download the migration tool, append
&downloadName=elasticsearch_migration_tool
to
the end of the download link that you received. Configuration
file parameters
The elasticsearch object
should be a top-level object in the
demisto.config
file
(within the main curly brackets). The following are the available
parameters.Parameter | Type | Description | Required |
---|---|---|---|
enabled | boolean | Enables Elasticsearch repository. | Mandatory |
url | string | URL for the Elasticsearch DB (including prefix
http/https and port). | Mandatory |
username | string | Username in Elasticsearch. | Mandatory (unless API key is used) |
password | string | Password for the user. | Mandatory (unless API key is used) |
apiKey | string | Specify an API key instead of a username
and password. | Optional |
insecure | boolean | Specify whether or not to verify the https
certificate. Default: true | Optional |
proxy | boolean | Specify whether to use a proxy connection
to connect to Elasticsearch. Default: false | Optional |
shards.<name of index> | integer | The number of shards for a specific index.
You should set the value of the specific index to the number of
CPU cores in the Elasticsearch dedicated server. Default:
1 For example: elasticsearch.shards. where <common-indicator> <common-indicator> is
the name of the index. | Optional |
replicas.<name of index> | integer | The number of replica shards for a specific
index. You should set the value of the specific index to the number
of backups you require. For example, elasticsearch.replicas. <common-indicator> where <common-indicator> is
the name of the index.Default: 0 | Optional |
innerBatchSize | integer | Number of Cortex XSOAR objects to include
in a single insert request. | Optional |
indexPrefix | string | Prefix to include in index names for indexes
created by Cortex XSOAR. | Optional |
maxResultWindow | integer | Maximum number of results to request from
Elasticsearch in a single page. Default: 1000 | Optional |
For example:
“elasticsearch”: { “enabled”: true, “url”: “http://localhost:9200”, “username”: “user”,// Username in elastic “password”: “password”, “apiKey”: “”, // an API key can be specified instead of username and password “shards”: { “common-indicator”: 1 “common-audit”: 1 }, “replicas”: { “common-indicator”: 0 “common-audit”: 0 } },
Tool flags
Flag | Type | Description | Required |
---|---|---|---|
-accounts | string | A comma-separated list of accounts to migrate.
If not specified, all accounts are migrated. Multi-tenant
deployments only. | Optional |
-config-path | string | The path to the configuration file for the
server. The default path is /etc/demisto.conf . | Optional |
-db-path | string | The path to the database directory. The
default path is /var/lib/demisto . | Optional |
-elastic-batch-size | integer | The number of indicators per batch to write
to Elasticsearch indexes. The default value is 500. | Optional |
-elastic-index-prefix | string | The index prefix used in Elasticsearch. | Optional |
-elastic-key | string | The API key to connect to Elasticsearch. | Optional |
-elastic-password | string | The password to connect to Elasticsearch. | Optional |
-elastic-url | string | The URL of your Elasticsearch environment. The
default is http://localhost:9200. | Optional |
-elastic-username | string | The username to connect to Elasticsearch. | Optional |
-log-level | string | The log level to display. The default
is info . | Optional |
-migrate-all | N/A | By default, the Elasticsearch tool checks existing
indexes and migrates only the ones that are new. Using this flag,
the Elasticsearch tool migrates all indexes even if they currently
exist. This is useful, for example, if there was an error or invalid
data that was fixed. | Optional |
Prerequisites
Run all commands
from the Cortex XSOAR server machine.
- Stop the Cortex XSOAR server.
- CentOS:sudo systemctl stop demisto
- Ubuntu:sudo service demisto stop
- Edit thedemisto.confas needed.
- Run the./elasticMigratorcommand with eitherdemistoorsudopermissions../elasticMigrator
- Start the Cortex XSOAR service.
- CentOS:sudo systemctl start demisto
- Ubuntu:sudo service demisto start
Recommended For You
Recommended Videos
Recommended videos not found.