Run a command on incidents residing on multiple tenants
in a Cortex XSOAR multi-tenant deployment
In some cases, you might need to run a command
across multiple tenants. For example, you might want to enrich certain
IOCs across all tenant accounts.
From the main account, you
can batch run a command on incidents from different tenant accounts.
Running a command at the main account runs it locally on each tenant
If the command doesn’t exist on a particular tenant
or if the user running the command from the main account doesn’t
have the correct permissions, the command execution will fail and
the output will be written to the incident’s war room. You will
not see the error in the main account.
In some cases, tenants
may have different versions of the same command. The local version
of the command runs on the tenant.