Cortex XSIAM development tenant ↗

Use a Cortex XSIAM development tenant to create, test, and manage content before deployment to production. Remote repository synchronization lets you promote approved content updates between development and production tenants.

A development tenant is a Cortex XSIAM test environment. It lets you validate content before using it in a production tenant.

Before explaining more about development tenants, it is important to understand what content is.

Content

Content includes integrations, automation scripts, playbooks, and other components that enhance Cortex XSIAM capabilities for case response and threat intelligence management. There are two types of content:

  • System content - content packs you can download from Marketplace. Packs are groups of components that implement use cases. Content packs are created by Palo Alto Networks, technology partners, consulting companies, MSSPs, customers, and individual contributors. Depending on the use case, each content pack includes a combination of different components, such as integrations, scripts, playbooks, and widgets.
  • Custom or user-defined content - custom components you can develop to meet your business needs.

Cortex XSIAM development tenants

The Cortex XSIAM development tenant provides a safe environment to develop and test content functionality before production deployment.

Development tenants are not intended for performance checks; they cannot access production data, and they are connected to a limited number of endpoints. As a result, all development tenants have fewer resources than the production tenant, including data ingestion capacity and performance, and compute capabilities. In a development tenant, extreme demand for resources for data ingestion or compute may affect performance and cause latency issues.

To make developed content available in production or other development tenants, push it to a remote repository as a content update.

Cortex XSIAM content management with a remote repository

Use Cortex XSIAM content management with a remote repository to develop and test content. Choose the built-in remote repository, which is the default, or a private Git-based repository. Supported private repositories include GitHub, GitLab, Bitbucket, and on-premise repositories.

The development tenant pushes content to the remote repository. The production tenant and additional development tenants pull content from the repository.

Push and pull Cortex XSIAM content between tenants

In a tenant cluster, only one development tenant pushes content. This is the push tenant. The production tenant and any other development tenants pull content as pull tenants.

Push and pull system content updates

Only the development push tenant manages system content and content updates. Pull tenants only pull system content from the push tenant. They cannot download, install, edit, create, or update it.

Only the development push tenant can access Marketplace. Download and install Marketplace content there. Then push it to the remote repository for pull tenants.

Push and pull custom content

Not all custom content supports push and pull. Develop unsupported content in either tenant, or copy it from development to production. Unsupported content includes dashboards, lists, parsing rules, data modeling rules, and correlation rules.

The following system and user-defined content types are push/pull supported:

  • Case fields and layouts
  • Issue types and fields
  • Indicator types and fields
  • Issue and indicator layouts
  • Layouts
  • Classifiers
  • Integrations
  • Playbooks
  • Scripts

For custom content that can be pushed/pulled, when pushing content from the development tenant, the content is pulled into the production or other development pull tenants as content updates. You can decide which updates you want to push from the development push tenant to pull tenants via the remote repository.