Frequently asked questions about Cortex XSOAR Marketplace Content
Should Marketplace content always
Marketplace updates are a source for bug fixes and provide new
commands for integrations and automations. It’s a best practice
to update content packs to the newest available version. If you
encounter any issue with content updates, you can revert to a previous
version with one click.
When can Marketplace content be updated?
You can update content while the system is in use. If a playbook,
for example, is running on an incident while you update that playbook,
the original version of the playbook will continue to run without
issues. If the playbook includes an integration command that has
been updated, and the update occurs before the playbook reaches
this task, the new version of the integration command will be used.
When should content items be duplicated versus detached?
To edit a content item, the item must be detached or be custom
content. When content items are detached, they do not receive updates
from the Marketplace. There are two options for editing content
Detach content item (playbook, automation, etc.) and
edit the content item. If you want to receive content updates in
the future, you can reattach the content item, but the modifications
you made while the item was detached will be overwritten with the
Duplicate the content item and edit the copy. When a content
item is duplicated it becomes a custom content item, and therefore
will not receive updates, but you can view updates to the original
How does Marketplace content differ from custom content?
After Marketplace content is installed you can detach or duplicate
the content and customize the content as needed. Custom content
is, by definition, detached and does not receive updates.
How is content pushed to tenants in a multi-tenant deployment?
Content is pushed from the Main account to tenant accounts by
using propagation labels. In order for a content item to be synced
to a tenant account, both the content item and tenant account must
have the same propagation label(s). Content is pushed to tenants
by matching propagation labels, or if the content is labeled 'all'. By
default, if no labels are assigned, the 'all' label is assigned
to 'all' content.
How is Marketplace content installed on tenants in a multi-tenant deployment?
Marketplace content packs are installed on the main account and
pushed to tenants based on propagation labels.
How can content updates be rolled back? Are dependencies automatically
rolled back as well?
You can view all versions of a content pack in the Marketplace
and revert to earlier versions there. When you revert a content
pack, only the content pack is reverted, not the pack dependencies.