Cortex XSOAR Licenses - Administrator Guide - 6.8 - Cortex XSOAR - Cortex - Security Operations

Cortex XSOAR Administrator Guide

Product
Cortex XSOAR
Version
6.8
Creation date
2022-09-28
Last date published
2024-03-21
End_of_Life
EoL
Category
Administrator Guide
Abstract

The Cortex XSOAR license type determines which components users can utilize. License types are community, starter, or enterprise. Users include audit and full.

Cortex XSOAR requires a yearly license per user, with the exception of the Cortex XSOAR Community Edition. Multi-year licenses are available.

Cortex XSOAR License Usage

This table describes the types of Cortex XSOAR licenses which are used in the following circumstances:

Version

Usage

Cortex XSOAR Community Edition

For evaluating Cortex XSOAR, partner development, and general free usage.

Cortex XSOAR Threat Intel Management Edition

Built for Threat Intelligence & Security Operations teams who need threat intelligence based automation.

Cortex XSOAR Starter Edition

Built for Security Operations and Incident Response customers who need case management with collaboration and playbook driven automation

Cortex XSOAR Edition

Built for customers who need a complete security automation solution.

Cortex XSOAR License Quota

The following table describes the license quotas of each version in Cortex XSOAR. The license includes the number of users that can be configured. Self service read-only users do not count as users in your license pool.

comparison-matrix.png

Multi-Tenant Licenses

XSOAM TIM, XSOAR Starter Edition, and XSOAR are all available for multi-tenant deployments, with a multi-tenant license. Cortex XSOAR multi-tenant deployments are designed for MSSPs (managed security service providers) and enterprises that require strict data segregation, but also need the flexibility to share and manage critical security practices across tenant accounts.

Cortex XSOAR Users

Cortex XSOAR has audit users and full users.

Audit user

Audit users have read-only permission in Cortex XSOAR, meaning they do not have the ability to edit system components and data, or run commands, automations, and playbooks. Audit users can view incidents, dashboards, and reports.

Full user

Full users have read-write permission in Cortex XSOAR, meaning they have the ability to view and edit system components and data. They can investigate incidents, run automation scripts and playbooks, chat in the War Room, etc. Full users’ access to Cortex XSOAR is determined by their assigned role.

Add a License

Abstract

Add Cortex XSOAR license file, either through the UI or by saving the license file directly on the server.

There are two methods for saving the license file. You can follow either one of the following methods.

  • Upload the License File using the user interface

    1. Save the license file you received.

    2. Go to SettingsAboutLicense.

    3. Click Upload license.

    4. (Optional) Refresh the browser.

    5. (Multi-Tenant) For multi-tenant environments, the server must be restarted in order to create tenants.

      sudo service demisto stop

      sudo service demisto start

    Alternative Method

    Save the license file on the server. This method requires you to restart the server after saving the file. The path for the license file varies according to your installation.

    • If you are using Elasticsearch as your database and did not upgrade from a previous version of Cortex XSOAR, the file is located in the lib directory. Default is /var/lib/demisto/demisto.lic.

    • If you are using Elasticsearch and upgraded from a previous version of Cortex XSOAR or you are not using Elasticsearch, the default location of the license file is /usr/local/demisto/demisto.lic.

    • For customers using a custom location, the path can be found in the license.file.path configuration key in the demisto configuration file. The default location of the configuration file is /etc/demisto.conf.

    For High Availability deployments, once Cortex XSOAR is running, synchronize the license by restarting the demisto service on the additional app servers.

    If using Live Backup, the production server and the backup server must have the same Cortex XSOAR license installed. When a new license is installed on the production server, the license is automatically synced with the backup server.

Manually Refresh the Number of Licenses in Use

Abstract

A user with administrator privileges can manually refresh the number of users in use.

When you audit users and roles, the calculation for the number of licenses currently in use is performed by the system every few hours or when uploading a license.

A user with administrator privileges can manually refresh the number of licenses currently in use. This enables you to retrieve immediate feedback on licensing when disabling accounts or removing users, and when provisioning new users.

  1. Go to SettingsAboutLicense.

  2. In the Users in use section, click Refresh.