Share Indicators with Tenants Using Propagation Labels
The Share Indicators integration is an integration that
you configure on the master account to share indicators to tenants,
using propagation labels. XSOAR
The share indicators feature requires
a Cortex XSOAR Threat Intel Management license and that Cortex XSOAR
runs using Elasticsearch.
The Share Indicators
integration is a dedicated integration that you configure on the
main account to share indicators with tenants. In order for a tenant
to receive the shared indicators, you need to assign corresponding
propagation labels to the integration instance, the integration,
and the tenants.
For example, if you want to share the indicators
from the Share Indicators integration instance A to three tenant
accounts, you need to assign the same propagation label to:
Share Indicators integration
Share Indicators integration instance A
Tenant 1
Tenant 2
Tenant 3
Go to
Settings
Integrations
Instances
.
Search for
Share Indicators
.
Configure the integration instance.
Parameter
Description
Example
Name
A meaningful name for the integration instance.
indicators-share_domains_ips
Fetch indicators
Make sure you select this option if you want
this integration instance to export indicators from the shared indexes
to the tenant accounts with corresponding propagation labels
N/A
Fetch interval
How often to fetch indicators from the shared
indexes and export them to the tenant accounts with corresponding propagation
labels. You can specify the interval in days, hours, or minutes.
5 minutes
Indicators Query
The query that defines which indicators to
fetch from the tenant and export to the shared index. The Query
is in Elasticsearch syntax.
type:Domain or type:IP
Propagation Labels
These labels define which tenants will receive
the indicators fetched from this integration instance. Make sure whatever
labels you apply here are also applied on the Elasticsearch Feed integration
itself, and the relevant tenants. The default label is
all
,
which will send indicators from this integration instance to all
tenants, whether or not propagation labels are assigned to the tenant
accounts.
