Manage Engines

Manage engines and load balancing groups in Cortex XSOAR.
After you have installed the engine, you can manage engines and Load-Balancing groups by going to
Settings
Integrations
Engines
.
You can view engine names, hosts, status, connection, etc.
In the
Service Name
column, if the service name starts with a
d1
prefix, it is a multiple engine.
You can do the following:
  • Add/remove engines to the Load-Balancing Group.
    You can only add the engine to the Load-Balancing group after you have connected the engine.
  • Create Load-Balancing Groups
    When selecting
    Load-Balancing Group
    Add to new group
    , you can create multiple Load-Balancing groups and decide which engines are part of each group. It is useful to create separate Load-Balancing groups. For example,
    • Use separate Load-Balancing groups for different integrations and instances. Create Load-Balancing groups for certain tasks, which can help segregate the infrastructure of critical integrations.
    • Managed Security Service Providers may want to split internal engines and SaaS product engines.
    • If you have multiple AWS accounts that are not connected and do not want a single point of failure for AWS integrations that use STS.
    • For high availability, you may want multiple load-balancing groups of engines in different locations.
    • It can also help managing the load in a multi tenant environment
    Users can move an engine from one group to another. A group will be deleted when the last engine is removed from it.
    Users can choose to add the server to the Load-Balancing group if they want the engines to share the load with the Cortex XSOAR server. This can be done by adding the following advanced configuration:
    Key:
    engine.group.add.server.to.group
    Value: Comma separated list of engine group names (for example,
    EngineGroup1,EngineGroup2
    .
    Each engine can only be part of a separate group.
    (
    Multi-Tenant
    ) When clicking
    Load-Balancing and Propagation
    , you can share engines with tenants for integration purposes.
  • Get engine logs
    Logs are located in
    /var/log/demisto
    . For multiple engines, logs are located in
    /var/log/demisto/
    <name of the engine>
    . For example,
    var/log/demisto.d1_e1
    .
  • Upgrade an engine
    When an engine requires an upgrade, the Cortex XSOAR version for that engine is red. You need to select the checkbox for the engine that requires an upgrade and click
    Upgrade Engine
    . When the upgrade finishes, the version appears in the
    Cortex XSOAR Version
    . The upgrade procedure can take several minutes.
    You can only upgrade the engine if you installed the engine with the shell installer. To upgrade engines that were not installed with the shell installer, you need to remove the engine and do a fresh install. For more information, see Install a Cortex XSOAR Engine. For troubleshooting, see Troubleshoot Engine Upgrades.
  • Delete engines

Recommended For You