From 6b24521c741a29776741f154431db47cbd14983a Mon Sep 17 00:00:00 2001 From: Shir2611 Date: Tue, 18 Aug 2026 14:31:04 +0300 Subject: [PATCH 01/13] added doc for upload-custome-integration --- .../custom-integration-duplication.md | 205 ++++++++++++++++++ sidebars.js | 4 +- 2 files changed, 207 insertions(+), 2 deletions(-) create mode 100644 docs/integrations/custom-integration-duplication.md diff --git a/docs/integrations/custom-integration-duplication.md b/docs/integrations/custom-integration-duplication.md new file mode 100644 index 000000000..a50dad4d4 --- /dev/null +++ b/docs/integrations/custom-integration-duplication.md @@ -0,0 +1,205 @@ +--- +id: custom-integration-duplication +title: Custom Integration Duplication & Manual Upload +description: Step-by-step guide for duplicating and uploading a custom integration using demisto-sdk upload-custom-integration. +--- + +When replacing traditional integrations with Connectors, the in-product **Duplicate** button in the platform user interface redirects users to perform a custom duplicate and upload flow. + +This guide provides a step-by-step walkthrough for manually duplicating an existing integration from the official Content repository, updating its identifiers safely, and uploading it to your Cortex XSOAR or Cortex XSIAM platform tenant using the `demisto-sdk`. + +--- + +:::warning Critical System ID Conflict Risk +If you upload a custom integration whose `id` matches an official system integration's `id`, any subsequent attempt to update or download the system pack containing that integration will **fail with a platform system error**. + +To protect your instance, custom integrations **must** append the `_copy` marker suffix to both their **ID** and **Display Name** (e.g., `MyIntegration_copy`). The `demisto-sdk` CLI auto-enforces this convention before any upload. +::: + +--- + +## Prerequisites + +Before starting, ensure you have: + +1. **Python 3.10 or higher** installed on your workstation. +2. **Git** installed and configured with access to GitHub. +3. **Cortex Platform Tenant Credentials** (Instance Administrator privileges required). + +--- + +## Step 1: Install or Update `demisto-sdk` + +The duplication upload flow requires `demisto-sdk` version **1.40.0 or higher**, which includes the dedicated `upload-custom-integration` safety command. + +Open your terminal and run: + +```bash +pip install --upgrade demisto-sdk +``` + +Verify your installed version and confirm the command is available: + +```bash +demisto-sdk upload-custom-integration --help +``` + +--- + +## Step 2: Clone or Sync the Content Repository + +Clone the official `demisto/content` repository locally (or update your existing copy): + +**Option A: Clone via SSH** + +```bash +git clone git@github.com:demisto/content.git +cd content +``` + +**Option B: Clone via HTTPS** + +```bash +git clone https://github.com/demisto/content.git +cd content +``` + +If you already have a local copy, ensure it is up to date: + +```bash +git checkout master +git pull origin master --rebase +``` + +--- + +## Step 3: Configure Environment Variables + +To allow `demisto-sdk` to authenticate with your platform instance, create a `.env` file in the root directory of your cloned content repository (`content/.env`). + +### How to Obtain Credentials from the Platform UI + +1. Log in to your Cortex XSOAR / XSIAM platform instance. +2. Navigate to **Settings → Configurations** → search for **API Keys**. +3. **API URL** (`DEMISTO_BASE_URL`): Click **Copy API URL** in the top right corner. +4. **API Key** (`DEMISTO_API_KEY`): + - Click **New Key** (top right corner). + - Set **Key Type** to `Standard`. + - Set **Role** to `Instance Administrator`. + - Click **Generate** and copy the key immediately from the modal popup. +5. **Auth ID** (`XSIAM_AUTH_ID`): + - Close the key modal to view the API Keys table. + - Locate the row for your newly created API key. + - Copy the numerical ID in the **ID** column (e.g., `4`). + +### Populate `content/.env` + +Add your credentials to `content/.env`: + +```bash +DEMISTO_BASE_URL=https://api-your-tenant-url.xdr.us.paloaltonetworks.com/xsoar +DEMISTO_API_KEY=your_copied_api_key_here +XSIAM_AUTH_ID=your_key_id_number_here +``` + +--- + +## Step 4: Duplicate & Update Integration YAML + +1. **Locate the Integration**: Find the integration folder you wish to duplicate inside `Packs//Integrations//`. +2. **Create a Working Copy**: Copy the integration directory or YAML file to a new location or branch. +3. **Add the `_copy` Marker**: Open the integration's `.yml` file in an editor (e.g., VS Code) and update both the `commonfields.id` and `name` fields: + +```yaml +# BEFORE +commonfields: + id: PolarSecurity +name: Polar Security + +# AFTER (Required Duplication Convention) +commonfields: + id: PolarSecurity_copy +name: Polar Security_copy +``` + +:::note +Both `commonfields.id` and `name` must end with the `_copy` suffix. If either field is missing this marker, the upload command will block execution to prevent tenant corruption. +::: + +--- + +## Step 5: Upload the Custom Integration + +Run the `upload-custom-integration` command, passing the path to your modified YAML file or its parent directory: + +**Recommended: Upload via Directory Path** + +```bash +demisto-sdk upload-custom-integration -i Packs/PolarSecurity/Integrations/PolarSecurity_copy/ +``` + +**Alternative: Upload via Direct YAML File** + +```bash +demisto-sdk upload-custom-integration -i Packs/PolarSecurity/Integrations/PolarSecurity_copy/PolarSecurity_copy.yml +``` + +### Expected Command Output + +```text +Running Demisto-SDK CLI +Uploading Packs/PolarSecurity/Integrations/PolarSecurity_copy/PolarSecurity_copy.yml to https://api-your-tenant... +UPLOAD SUMMARY: + +SUCCESSFUL UPLOADS: +┌────────────────────────┼─────────────┼────────────────┼──────────────┐ +│ NAME │ TYPE │ PACK NAME │ PACK VERSION │ +├────────────────────────┼─────────────┼────────────────┼──────────────┤ +│ PolarSecurity_copy.yml │ Integration │ Polar Security │ 1.0.0 │ +└────────────────────────┴─────────────┴────────────────┴──────────────┘ +``` + +--- + +## Step 6: Verify in Platform UI + +1. Log in to your Cortex platform instance. +2. Navigate to **Settings → Integrations → Custom Integrations**. +3. Locate your integration (e.g., `Polar Security_copy`). It will display a **Custom** badge next to its title. +4. Click **Add Instance** to configure and use your custom duplicate. + +--- + +## Troubleshooting & FAQ + +### Error: Missing `_copy` Marker + +If you see an error like this: + +```text +Invalid value: + Integration field(s) missing the '_copy' marker: + commonfields.id = 'PolarSecurity' and name = 'PolarSecurity' +``` + +**Fix**: Open your YAML file and append `_copy` to both `commonfields.id` and `name`. + +--- + +### Bypassing Validation (`--force-id`) + +:::warning +Using `--force-id` is strongly discouraged. Only use this flag if you are an advanced administrator explicitly maintaining custom IDs outside standard system pack boundaries. +::: + +If you must upload without the `_copy` marker, pass `--force-id`: + +```bash +demisto-sdk upload-custom-integration -i --force-id +``` + +This will log a high-visibility CLI warning and proceed with the upload: + +```text +[WARNING] Uploading custom content without the '_copy' marker risks conflicting with official system pack IDs... Proceeding because --force-id was explicitly set. +``` diff --git a/sidebars.js b/sidebars.js index 97b7dad03..dfceccadd 100644 --- a/sidebars.js +++ b/sidebars.js @@ -160,8 +160,8 @@ const sidebars = { "integrations/yml-from-python-code-gen", "integrations/fetch-incidents-lookback", "integrations/Trust-any-certificate", - "integrations/dynamic-ui-fields" - + "integrations/dynamic-ui-fields", + "integrations/custom-integration-duplication" ] } ] From 7d7dc285e8c95ef90685c9e07c40cb1ca20d198e Mon Sep 17 00:00:00 2001 From: Shir2611 Date: Wed, 19 Aug 2026 00:37:36 +0300 Subject: [PATCH 02/13] small fixes to the phrasing --- .../custom-integration-duplication.md | 34 +++++++++---------- 1 file changed, 17 insertions(+), 17 deletions(-) diff --git a/docs/integrations/custom-integration-duplication.md b/docs/integrations/custom-integration-duplication.md index a50dad4d4..317c9c2f7 100644 --- a/docs/integrations/custom-integration-duplication.md +++ b/docs/integrations/custom-integration-duplication.md @@ -1,12 +1,12 @@ --- id: custom-integration-duplication -title: Custom Integration Duplication & Manual Upload -description: Step-by-step guide for duplicating and uploading a custom integration using demisto-sdk upload-custom-integration. +title: Custom Integration Duplication & Manual Upload - ConnectUs +description: Step-by-step guide for uploading a custom integration using demisto-sdk upload-custom-integration. --- When replacing traditional integrations with Connectors, the in-product **Duplicate** button in the platform user interface redirects users to perform a custom duplicate and upload flow. -This guide provides a step-by-step walkthrough for manually duplicating an existing integration from the official Content repository, updating its identifiers safely, and uploading it to your Cortex XSOAR or Cortex XSIAM platform tenant using the `demisto-sdk`. +This guide provides a step-by-step walkthrough for manually duplicating an existing integration from the official Content repository, updating its identifiers safely, and uploading it to your Cortex Platform tenant using the `demisto-sdk`. --- @@ -79,7 +79,7 @@ To allow `demisto-sdk` to authenticate with your platform instance, create a `.e ### How to Obtain Credentials from the Platform UI -1. Log in to your Cortex XSOAR / XSIAM platform instance. +1. Log in to your Cortex Platform instance. 2. Navigate to **Settings → Configurations** → search for **API Keys**. 3. **API URL** (`DEMISTO_BASE_URL`): Click **Copy API URL** in the top right corner. 4. **API Key** (`DEMISTO_API_KEY`): @@ -107,7 +107,7 @@ XSIAM_AUTH_ID=your_key_id_number_here ## Step 4: Duplicate & Update Integration YAML 1. **Locate the Integration**: Find the integration folder you wish to duplicate inside `Packs//Integrations//`. -2. **Create a Working Copy**: Copy the integration directory or YAML file to a new location or branch. +2. **Create a Working Copy**: Copy the integration directory or YAML file to a new branch. 3. **Add the `_copy` Marker**: Open the integration's `.yml` file in an editor (e.g., VS Code) and update both the `commonfields.id` and `name` fields: ```yaml @@ -135,38 +135,38 @@ Run the `upload-custom-integration` command, passing the path to your modified Y **Recommended: Upload via Directory Path** ```bash -demisto-sdk upload-custom-integration -i Packs/PolarSecurity/Integrations/PolarSecurity_copy/ +demisto-sdk upload-custom-integration -i 'Packs/PolarSecurity/Integrations/PolarSecurity' ``` **Alternative: Upload via Direct YAML File** ```bash -demisto-sdk upload-custom-integration -i Packs/PolarSecurity/Integrations/PolarSecurity_copy/PolarSecurity_copy.yml +demisto-sdk upload-custom-integration -i 'Packs/PolarSecurity/Integrations/PolarSecurity/PolarSecurity.yml' ``` ### Expected Command Output ```text Running Demisto-SDK CLI -Uploading Packs/PolarSecurity/Integrations/PolarSecurity_copy/PolarSecurity_copy.yml to https://api-your-tenant... +Uploading Packs/PolarSecurity/Integrations/PolarSecurity/PolarSecurity.yml to https://api-your-tenant... UPLOAD SUMMARY: SUCCESSFUL UPLOADS: -┌────────────────────────┼─────────────┼────────────────┼──────────────┐ -│ NAME │ TYPE │ PACK NAME │ PACK VERSION │ -├────────────────────────┼─────────────┼────────────────┼──────────────┤ -│ PolarSecurity_copy.yml │ Integration │ Polar Security │ 1.0.0 │ -└────────────────────────┴─────────────┴────────────────┴──────────────┘ +┌───────────────────┬─────────────┬────────────────┬──────────────┐ +│ NAME │ TYPE │ PACK NAME │ PACK VERSION │ +├───────────────────┼─────────────┼────────────────┼──────────────┤ +│ PolarSecurity.yml │ Integration │ Polar Security │ 1.0.0 │ +└───────────────────┴─────────────┴────────────────┴──────────────┘ ``` --- ## Step 6: Verify in Platform UI -1. Log in to your Cortex platform instance. -2. Navigate to **Settings → Integrations → Custom Integrations**. -3. Locate your integration (e.g., `Polar Security_copy`). It will display a **Custom** badge next to its title. -4. Click **Add Instance** to configure and use your custom duplicate. +1. Log in to your Cortex Platform instance. +2. Navigate to **Settings → Configuration → Data Sources & Integrations → Add New**. +3. Locate your integration (e.g., `Polar Security`). It will display a **Custom** badge next to its title. +4. Click **Add** to configure and use your custom duplicate. --- From 03cec4f9abc1cb39c16a26325e8ac9ce087d4270 Mon Sep 17 00:00:00 2001 From: Shir2611 Date: Wed, 19 Aug 2026 17:31:11 +0300 Subject: [PATCH 03/13] code review --- .../custom-integration-duplication.md | 35 +++++++++++-------- 1 file changed, 21 insertions(+), 14 deletions(-) diff --git a/docs/integrations/custom-integration-duplication.md b/docs/integrations/custom-integration-duplication.md index 317c9c2f7..10529c2ba 100644 --- a/docs/integrations/custom-integration-duplication.md +++ b/docs/integrations/custom-integration-duplication.md @@ -1,19 +1,23 @@ --- id: custom-integration-duplication title: Custom Integration Duplication & Manual Upload - ConnectUs -description: Step-by-step guide for uploading a custom integration using demisto-sdk upload-custom-integration. +description: Step-by-step guide for uploading a custom integration to the Cortex Platform using the ***demisto-sdk upload-custom-integration*** command. --- -When replacing traditional integrations with Connectors, the in-product **Duplicate** button in the platform user interface redirects users to perform a custom duplicate and upload flow. +When replacing traditional integrations with Connectors, the in-product **Duplicate** button in the Cortex Platform user interface redirects users to perform a manual flow of uploading a custom duplication of the integration to the Cortex Platform. This guide provides a step-by-step walkthrough for manually duplicating an existing integration from the official Content repository, updating its identifiers safely, and uploading it to your Cortex Platform tenant using the `demisto-sdk`. +:::tip Already set up? Skip ahead +If you already have `demisto-sdk` version **1.40.0 or higher** installed and the `demisto/content` repository cloned locally, skip to [Step 3: Configure Environment Variables](#step-3-configure-environment-variables). +::: + --- :::warning Critical System ID Conflict Risk -If you upload a custom integration whose `id` matches an official system integration's `id`, any subsequent attempt to update or download the system pack containing that integration will **fail with a platform system error**. +If you upload a custom integration whose `id` matches an official system integration's `id`, any subsequent attempt to update or install the system pack containing that integration will **fail with a platform system error**. -To protect your instance, custom integrations **must** append the `_copy` marker suffix to both their **ID** and **Display Name** (e.g., `MyIntegration_copy`). The `demisto-sdk` CLI auto-enforces this convention before any upload. +To protect your instance, custom integrations **must** append the `_copy` marker suffix to both their **ID** and **Name** (e.g., `MyIntegration_copy`). The `demisto-sdk` CLI auto-enforces this convention before any upload. ::: --- @@ -22,17 +26,17 @@ To protect your instance, custom integrations **must** append the `_copy` marker Before starting, ensure you have: -1. **Python 3.10 or higher** installed on your workstation. -2. **Git** installed and configured with access to GitHub. -3. **Cortex Platform Tenant Credentials** (Instance Administrator privileges required). +1. **[Python 3.10 or higher](https://www.python.org/downloads/)** installed on your workstation. +2. **[Git](https://git-scm.com/downloads)** installed and configured with access to GitHub. +3. **Cortex Platform Tenant Credentials** (Instance Administrator privileges required) — see [Step 3](#step-3-configure-environment-variables) below for how to obtain them. --- ## Step 1: Install or Update `demisto-sdk` -The duplication upload flow requires `demisto-sdk` version **1.40.0 or higher**, which includes the dedicated `upload-custom-integration` safety command. +The custom integration upload flow requires `demisto-sdk` version **1.40.0 or higher**, which includes the dedicated `upload-custom-integration` command. -Open your terminal and run: +Run the following command to install `demisto-sdk` for the first time, or upgrade it to the latest version (the `--upgrade` flag handles both cases): ```bash pip install --upgrade demisto-sdk @@ -41,9 +45,11 @@ pip install --upgrade demisto-sdk Verify your installed version and confirm the command is available: ```bash -demisto-sdk upload-custom-integration --help +demisto-sdk upload-custom-integration --version ``` +For full installation instructions and system requirements, see the [Demisto-SDK Installation Guide](https://cortex-docs.paloaltonetworks.com/demisto-sdk-development-guide/demisto-sdk-guide/install-demisto-sdk). + --- ## Step 2: Clone or Sync the Content Repository @@ -106,9 +112,10 @@ XSIAM_AUTH_ID=your_key_id_number_here ## Step 4: Duplicate & Update Integration YAML -1. **Locate the Integration**: Find the integration folder you wish to duplicate inside `Packs//Integrations//`. -2. **Create a Working Copy**: Copy the integration directory or YAML file to a new branch. -3. **Add the `_copy` Marker**: Open the integration's `.yml` file in an editor (e.g., VS Code) and update both the `commonfields.id` and `name` fields: +1. **Locate the Integration**: Find the integration directory you wish to duplicate under the Packs directory (`Packs//Integrations//`). +2. **Add the `_copy` Marker**: Open the integration's `.yml` file in you favorite IDE (e.g., VS Code) and update both the `commonfields.id` and `name` fields: + +**For example:** ```yaml # BEFORE @@ -130,7 +137,7 @@ Both `commonfields.id` and `name` must end with the `_copy` suffix. If either fi ## Step 5: Upload the Custom Integration -Run the `upload-custom-integration` command, passing the path to your modified YAML file or its parent directory: +Run the `upload-custom-integration` command, passing the path to your modified YAML file or the integration's directory: **Recommended: Upload via Directory Path** From 6568d9e3c9a0ff8bf71a9a0984894aba32875aaa Mon Sep 17 00:00:00 2001 From: Shir2611 Date: Thu, 20 Aug 2026 18:11:14 +0300 Subject: [PATCH 04/13] demo notes --- docs/integrations/custom-integration-duplication.md | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/docs/integrations/custom-integration-duplication.md b/docs/integrations/custom-integration-duplication.md index 10529c2ba..889c1edf3 100644 --- a/docs/integrations/custom-integration-duplication.md +++ b/docs/integrations/custom-integration-duplication.md @@ -54,9 +54,13 @@ For full installation instructions and system requirements, see the [Demisto-SDK ## Step 2: Clone or Sync the Content Repository -Clone the official `demisto/content` repository locally (or update your existing copy): +Clone the official `demisto/content` repository locally. Choose the option that matches your goal: -**Option A: Clone via SSH** +:::note Planning to contribute back to the official repository? +If you intend to submit your changes as a pull request to `demisto/content`, you should **fork** the repository first instead of cloning it directly. See the [Contributing Guide](../contributing/contributing) for the full fork-based contribution workflow. +::: + +**Option A: Clone via SSH** *(recommended for local uploads only)* ```bash git clone git@github.com:demisto/content.git @@ -70,7 +74,7 @@ git clone https://github.com/demisto/content.git cd content ``` -If you already have a local copy, ensure it is up to date: +If you already have a local copy, ensure it is up to date before proceeding: ```bash git checkout master From 5de2aaec080bfd5e4fa8844ebbc1882725914bf9 Mon Sep 17 00:00:00 2001 From: Shir2611 Date: Mon, 7 Sep 2026 11:48:56 +0300 Subject: [PATCH 05/13] code review --- docs/integrations/custom-integration-duplication.md | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) diff --git a/docs/integrations/custom-integration-duplication.md b/docs/integrations/custom-integration-duplication.md index 889c1edf3..f84f6bf57 100644 --- a/docs/integrations/custom-integration-duplication.md +++ b/docs/integrations/custom-integration-duplication.md @@ -1,6 +1,6 @@ --- id: custom-integration-duplication -title: Custom Integration Duplication & Manual Upload - ConnectUs +title: Custom Integration Duplication & Manual Upload description: Step-by-step guide for uploading a custom integration to the Cortex Platform using the ***demisto-sdk upload-custom-integration*** command. --- @@ -8,6 +8,10 @@ When replacing traditional integrations with Connectors, the in-product **Duplic This guide provides a step-by-step walkthrough for manually duplicating an existing integration from the official Content repository, updating its identifiers safely, and uploading it to your Cortex Platform tenant using the `demisto-sdk`. +:::info Prefer automation? +If you use an Agentic Coding assistant (such as Claude Code), you can use our [Custom Integration Duplication Skill](#TODO-ADD-SKILL-LINK) to automate this entire workflow instead of following the manual steps below. +::: + :::tip Already set up? Skip ahead If you already have `demisto-sdk` version **1.40.0 or higher** installed and the `demisto/content` repository cloned locally, skip to [Step 3: Configure Environment Variables](#step-3-configure-environment-variables). ::: @@ -107,7 +111,7 @@ To allow `demisto-sdk` to authenticate with your platform instance, create a `.e Add your credentials to `content/.env`: ```bash -DEMISTO_BASE_URL=https://api-your-tenant-url.xdr.us.paloaltonetworks.com/xsoar +DEMISTO_BASE_URL=https://api-your-tenant-url.xdr.us.paloaltonetworks.com DEMISTO_API_KEY=your_copied_api_key_here XSIAM_AUTH_ID=your_key_id_number_here ``` @@ -118,6 +122,7 @@ XSIAM_AUTH_ID=your_key_id_number_here 1. **Locate the Integration**: Find the integration directory you wish to duplicate under the Packs directory (`Packs//Integrations//`). 2. **Add the `_copy` Marker**: Open the integration's `.yml` file in you favorite IDE (e.g., VS Code) and update both the `commonfields.id` and `name` fields: +3. **(Recommended) Customize the Display Name**: In addition to the required `_copy` suffix, consider changing the `name` field to something more descriptive (e.g., `Polar Security (Custom)` or `Polar Security - Internal`). This makes your custom copy easier to identify among other integrations in the Cortex Platform UI. **For example:** @@ -177,6 +182,9 @@ SUCCESSFUL UPLOADS: 1. Log in to your Cortex Platform instance. 2. Navigate to **Settings → Configuration → Data Sources & Integrations → Add New**. 3. Locate your integration (e.g., `Polar Security`). It will display a **Custom** badge next to its title. + +![Custom badge shown next to a duplicated integration in the Add Data Sources or Integrations screen](/doc_imgs/integrations/polar-security-custom-badge.png) + 4. Click **Add** to configure and use your custom duplicate. --- From fc9d21480f5566888490832c21c4d376c9508dc9 Mon Sep 17 00:00:00 2001 From: Shir2611 Date: Mon, 7 Sep 2026 14:14:40 +0300 Subject: [PATCH 06/13] changed the clone to ssh --- content-repo/create-docs.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content-repo/create-docs.sh b/content-repo/create-docs.sh index 0ec62a00a..629771c9f 100755 --- a/content-repo/create-docs.sh +++ b/content-repo/create-docs.sh @@ -28,7 +28,7 @@ else echo "==== current branch: ${CURRENT_BRANCH} ====" - CONTENT_GIT_URL="https://github.com/demisto/content.git" + CONTENT_GIT_URL="git@github.com:demisto/content.git" CONTENT_BRANCH="master" REQUIRE_BRANCH=false if [ -n "${INCOMING_HOOK_BODY}" ]; then From cbd1ba28ae80b9072ef1adabb2ec06670530655d Mon Sep 17 00:00:00 2001 From: Shir2611 Date: Mon, 7 Sep 2026 14:46:56 +0300 Subject: [PATCH 07/13] revert --- content-repo/create-docs.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content-repo/create-docs.sh b/content-repo/create-docs.sh index 629771c9f..0ec62a00a 100755 --- a/content-repo/create-docs.sh +++ b/content-repo/create-docs.sh @@ -28,7 +28,7 @@ else echo "==== current branch: ${CURRENT_BRANCH} ====" - CONTENT_GIT_URL="git@github.com:demisto/content.git" + CONTENT_GIT_URL="https://github.com/demisto/content.git" CONTENT_BRANCH="master" REQUIRE_BRANCH=false if [ -n "${INCOMING_HOOK_BODY}" ]; then From a73b8e67e9d0e56381da237dd8bb51ebd6545ada Mon Sep 17 00:00:00 2001 From: Shir2611 Date: Tue, 8 Sep 2026 13:08:44 +0300 Subject: [PATCH 08/13] tech writer approved --- .../custom-integration-duplication.md | 157 ++++++++++-------- 1 file changed, 86 insertions(+), 71 deletions(-) diff --git a/docs/integrations/custom-integration-duplication.md b/docs/integrations/custom-integration-duplication.md index f84f6bf57..c05ece349 100644 --- a/docs/integrations/custom-integration-duplication.md +++ b/docs/integrations/custom-integration-duplication.md @@ -1,112 +1,127 @@ --- id: custom-integration-duplication -title: Custom Integration Duplication & Manual Upload -description: Step-by-step guide for uploading a custom integration to the Cortex Platform using the ***demisto-sdk upload-custom-integration*** command. +title: Manage custom content for connectors +description: Learn how Cortex XSIAM manages custom content for connectors, including viewing source code and duplicating sub-capabilities (integrations) using the demisto-sdk. --- -When replacing traditional integrations with Connectors, the in-product **Duplicate** button in the Cortex Platform user interface redirects users to perform a manual flow of uploading a custom duplication of the integration to the Cortex Platform. +Cortex XSIAM is transitioning to a unified connector experience that consolidates all vendor security capabilities, including log ingestion, automation, and threat intelligence, into a single entry in the catalog. Within a connector, these individual services are referred to as sub-capabilities (integrations). -This guide provides a step-by-step walkthrough for manually duplicating an existing integration from the official Content repository, updating its identifiers safely, and uploading it to your Cortex Platform tenant using the `demisto-sdk`. +--- -:::info Prefer automation? -If you use an Agentic Coding assistant (such as Claude Code), you can use our [Custom Integration Duplication Skill](#TODO-ADD-SKILL-LINK) to automate this entire workflow instead of following the manual steps below. -::: +## Availability -:::tip Already set up? Skip ahead -If you already have `demisto-sdk` version **1.40.0 or higher** installed and the `demisto/content` repository cloned locally, skip to [Step 3: Configure Environment Variables](#step-3-configure-environment-variables). -::: +The method for managing custom content depends on your onboarding date and the implementation status of the specific vendor: + +- **New customers (onboarded after July 26, 2026):** All services in the catalog follow the unified connector experience and require external management for custom content. +- **Existing customers (onboarded before July 26, 2026):** You may see a mix of legacy integrations and unified connectors. The product UI will automatically direct you to the external workflow for sub-capabilities (integrations) that have been transitioned to the unified experience. --- -:::warning Critical System ID Conflict Risk -If you upload a custom integration whose `id` matches an official system integration's `id`, any subsequent attempt to update or install the system pack containing that integration will **fail with a platform system error**. +## Duplicate and view source code -To protect your instance, custom integrations **must** append the `_copy` marker suffix to both their **ID** and **Name** (e.g., `MyIntegration_copy`). The `demisto-sdk` CLI auto-enforces this convention before any upload. -::: +The method for managing source code depends on whether the service is currently part of a unified connector. + +- **Legacy integrations:** For services not yet transitioned to the unified experience, you can continue to use the Duplicate and View Source options directly within the product UI. Upon duplication, the item transitions to a custom content status, and you can modify the source code using the built-in editor. +- **Connector sub-capabilities (integrations):** For vendors using the unified connector experience, the built-in UI editor is not supported. To view the source code of a sub-capability (integration), you can do so directly in GitHub. To duplicate a sub-capability (integration) and upload it as custom content, you must perform a manual flow using the `demisto-sdk`. --- -## Prerequisites +## External management workflow + +When you select **Duplicate** or **View Source** for a sub-capability (integration) on the **Data Sources & Integrations** page, Cortex XSIAM provides the name of the sub-capability (integration) needed to locate the relevant files in the official repository. + +### Option 1: View Source in GitHub + +If you only need to review the code without making changes: + +1. Copy the Integration Name provided for the sub-capability (integration) on the **Data Sources & Integrations** page in Cortex XSIAM. +2. Navigate to the official [Cortex Content GitHub Repository](https://github.com/demisto/content). +3. Search for the integration folder under the `Packs/` directory using the name you copied (such as, `Packs//Integrations//`). +4. Review the YAML and Python/PowerShell files directly in the repository. + +### Option 2: Duplicate and modify via the SDK + +To modify an existing sub-capability (integration) and upload it as custom content, you must use the SDK. + +#### Prerequisites Before starting, ensure you have: 1. **[Python 3.10 or higher](https://www.python.org/downloads/)** installed on your workstation. 2. **[Git](https://git-scm.com/downloads)** installed and configured with access to GitHub. -3. **Cortex Platform Tenant Credentials** (Instance Administrator privileges required) — see [Step 3](#step-3-configure-environment-variables) below for how to obtain them. +3. **Cortex XSIAM tenant credentials** (Instance Administrator privileges required). --- -## Step 1: Install or Update `demisto-sdk` +#### Step 1: Install or update demisto-sdk -The custom integration upload flow requires `demisto-sdk` version **1.40.0 or higher**, which includes the dedicated `upload-custom-integration` command. +The custom upload flow requires `demisto-sdk` version **1.40.0 or higher**. -Run the following command to install `demisto-sdk` for the first time, or upgrade it to the latest version (the `--upgrade` flag handles both cases): +Run the following command to install or upgrade: ```bash pip install --upgrade demisto-sdk ``` -Verify your installed version and confirm the command is available: +Verify the version and confirm the command is available: ```bash demisto-sdk upload-custom-integration --version ``` +:::note For full installation instructions and system requirements, see the [Demisto-SDK Installation Guide](https://cortex-docs.paloaltonetworks.com/demisto-sdk-development-guide/demisto-sdk-guide/install-demisto-sdk). +::: --- -## Step 2: Clone or Sync the Content Repository +#### Step 2: Clone or sync the content repository -Clone the official `demisto/content` repository locally. Choose the option that matches your goal: +Clone the official `demisto/content` repository locally. -:::note Planning to contribute back to the official repository? -If you intend to submit your changes as a pull request to `demisto/content`, you should **fork** the repository first instead of cloning it directly. See the [Contributing Guide](../contributing/contributing) for the full fork-based contribution workflow. -::: - -**Option A: Clone via SSH** *(recommended for local uploads only)* +**Option A: SSH** *(recommended for local uploads only)* ```bash git clone git@github.com:demisto/content.git -cd content ``` -**Option B: Clone via HTTPS** +**Option B: HTTPS** ```bash git clone https://github.com/demisto/content.git -cd content ``` +:::note If you already have a local copy, ensure it is up to date before proceeding: ```bash git checkout master git pull origin master --rebase ``` +::: --- -## Step 3: Configure Environment Variables +#### Step 3: Configure environment variables To allow `demisto-sdk` to authenticate with your platform instance, create a `.env` file in the root directory of your cloned content repository (`content/.env`). -### How to Obtain Credentials from the Platform UI +**How to obtain credentials from the Cortex XSIAM UI:** -1. Log in to your Cortex Platform instance. +1. Log in to Cortex XSIAM. 2. Navigate to **Settings → Configurations** → search for **API Keys**. 3. **API URL** (`DEMISTO_BASE_URL`): Click **Copy API URL** in the top right corner. 4. **API Key** (`DEMISTO_API_KEY`): - Click **New Key** (top right corner). - Set **Key Type** to `Standard`. - Set **Role** to `Instance Administrator`. - - Click **Generate** and copy the key immediately from the modal popup. + - Click **Generate** and copy the key immediately from the window. 5. **Auth ID** (`XSIAM_AUTH_ID`): - - Close the key modal to view the API Keys table. + - Close the key window to view the API Keys table. - Locate the row for your newly created API key. - - Copy the numerical ID in the **ID** column (e.g., `4`). + - Copy the numerical ID in the **ID** column (such as, `4`). -### Populate `content/.env` +**Populate `content/.env`** Add your credentials to `content/.env`: @@ -118,13 +133,20 @@ XSIAM_AUTH_ID=your_key_id_number_here --- -## Step 4: Duplicate & Update Integration YAML +#### Step 4: Duplicate and update YAML -1. **Locate the Integration**: Find the integration directory you wish to duplicate under the Packs directory (`Packs//Integrations//`). -2. **Add the `_copy` Marker**: Open the integration's `.yml` file in you favorite IDE (e.g., VS Code) and update both the `commonfields.id` and `name` fields: -3. **(Recommended) Customize the Display Name**: In addition to the required `_copy` suffix, consider changing the `name` field to something more descriptive (e.g., `Polar Security (Custom)` or `Polar Security - Internal`). This makes your custom copy easier to identify among other integrations in the Cortex Platform UI. +1. **Locate the sub-capability (integration)**: Find the directory you want to duplicate under the Packs directory (such as, `Packs//Integrations//`). +2. **Add the `_copy` marker**: Open the integration's `.yml` file in your favorite IDE (such as, VS Code) and update both the `commonfields.id` and `name` fields to include the `_copy` marker. -**For example:** +:::note +If either field is missing this marker, the upload command will block execution to prevent tenant corruption. +::: + +:::warning Critical System ID Conflict Risk +If you upload a custom sub-capability (integration) whose ID matches an official system integration's ID, any subsequent attempt to update or install the system pack containing that integration will **fail with a platform system error**. The `_copy` marker suffix is required to protect your instance. +::: + +For example: ```yaml # BEFORE @@ -138,53 +160,46 @@ commonfields: name: Polar Security_copy ``` -:::note -Both `commonfields.id` and `name` must end with the `_copy` suffix. If either field is missing this marker, the upload command will block execution to prevent tenant corruption. -::: - --- -## Step 5: Upload the Custom Integration +#### Step 5: Upload the custom sub-capability (integration) -Run the `upload-custom-integration` command, passing the path to your modified YAML file or the integration's directory: +Run the `upload-custom-integration` command, passing the path to your modified directory or direct YAML file. -**Recommended: Upload via Directory Path** +**Recommended (upload using directory path)** ```bash -demisto-sdk upload-custom-integration -i 'Packs/PolarSecurity/Integrations/PolarSecurity' +demisto-sdk upload-custom-integration -i 'Packs/MyPack/Integrations/MyIntegration' ``` -**Alternative: Upload via Direct YAML File** +**Alternative (upload using direct YAML file)** ```bash -demisto-sdk upload-custom-integration -i 'Packs/PolarSecurity/Integrations/PolarSecurity/PolarSecurity.yml' +demisto-sdk upload-custom-integration -i 'Packs/MyPack/Integrations/MyIntegration/MyIntegration.yml' ``` -### Expected Command Output +**Expected command output:** ```text Running Demisto-SDK CLI -Uploading Packs/PolarSecurity/Integrations/PolarSecurity/PolarSecurity.yml to https://api-your-tenant... +Uploading Packs/MyPack/Integrations/MyIntegration/MyIntegration.yml to https://api-your-tenant... UPLOAD SUMMARY: SUCCESSFUL UPLOADS: -┌───────────────────┬─────────────┬────────────────┬──────────────┐ -│ NAME │ TYPE │ PACK NAME │ PACK VERSION │ -├───────────────────┼─────────────┼────────────────┼──────────────┤ -│ PolarSecurity.yml │ Integration │ Polar Security │ 1.0.0 │ -└───────────────────┴─────────────┴────────────────┴──────────────┘ +┌───────────────────┬─────────────┬──────────────┬──────────────┐ +│ NAME │ TYPE │ PACK NAME │ PACK VERSION │ +├───────────────────┼─────────────┼──────────────┼──────────────┤ +│ MyIntegration.yml │ Integration │ My Pack │ 1.0.0 │ +└───────────────────┴─────────────┴──────────────┴──────────────┘ ``` --- -## Step 6: Verify in Platform UI - -1. Log in to your Cortex Platform instance. -2. Navigate to **Settings → Configuration → Data Sources & Integrations → Add New**. -3. Locate your integration (e.g., `Polar Security`). It will display a **Custom** badge next to its title. - -![Custom badge shown next to a duplicated integration in the Add Data Sources or Integrations screen](/doc_imgs/integrations/polar-security-custom-badge.png) +#### Step 6: Verify in Cortex XSIAM +1. Log in to Cortex XSIAM. +2. Navigate to **Settings → Data Sources & Integrations → Add New**. +3. Locate your sub-capability (integration); it will display a **Custom** badge. 4. Click **Add** to configure and use your custom duplicate. --- @@ -193,12 +208,12 @@ SUCCESSFUL UPLOADS: ### Error: Missing `_copy` Marker -If you see an error like this: +If you see an error like the one below, the SDK has blocked the upload to prevent ID conflicts: ```text Invalid value: Integration field(s) missing the '_copy' marker: - commonfields.id = 'PolarSecurity' and name = 'PolarSecurity' + commonfields.id = 'MyIntegration' and name = 'MyIntegration' ``` **Fix**: Open your YAML file and append `_copy` to both `commonfields.id` and `name`. @@ -211,13 +226,13 @@ Invalid value: Using `--force-id` is strongly discouraged. Only use this flag if you are an advanced administrator explicitly maintaining custom IDs outside standard system pack boundaries. ::: -If you must upload without the `_copy` marker, pass `--force-id`: +If you must upload without the `_copy` marker, pass the `--force-id` flag: ```bash -demisto-sdk upload-custom-integration -i --force-id +demisto-sdk upload-custom-integration -i --force-id ``` -This will log a high-visibility CLI warning and proceed with the upload: +This will log a high-visibility CLI warning before proceeding: ```text [WARNING] Uploading custom content without the '_copy' marker risks conflicting with official system pack IDs... Proceeding because --force-id was explicitly set. From 2b6319f08193374f69356aa8af506624f9842e40 Mon Sep 17 00:00:00 2001 From: Shir2611 Date: Tue, 8 Sep 2026 14:18:51 +0300 Subject: [PATCH 09/13] bold --- docs/integrations/custom-integration-duplication.md | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/docs/integrations/custom-integration-duplication.md b/docs/integrations/custom-integration-duplication.md index c05ece349..e71528542 100644 --- a/docs/integrations/custom-integration-duplication.md +++ b/docs/integrations/custom-integration-duplication.md @@ -21,8 +21,8 @@ The method for managing custom content depends on your onboarding date and the i The method for managing source code depends on whether the service is currently part of a unified connector. -- **Legacy integrations:** For services not yet transitioned to the unified experience, you can continue to use the Duplicate and View Source options directly within the product UI. Upon duplication, the item transitions to a custom content status, and you can modify the source code using the built-in editor. -- **Connector sub-capabilities (integrations):** For vendors using the unified connector experience, the built-in UI editor is not supported. To view the source code of a sub-capability (integration), you can do so directly in GitHub. To duplicate a sub-capability (integration) and upload it as custom content, you must perform a manual flow using the `demisto-sdk`. +- **Legacy integrations:** For services not yet transitioned to the unified experience, you can continue to use the **Duplicate** and **View Source** options directly within the product UI. Upon duplication, the item transitions to a custom content status, and you can modify the source code using the built-in editor. +- **Connector sub-capabilities (integrations):** For vendors using the unified connector experience, the built-in UI editor is not supported. To view the source code of a sub-capability (integration), you can do so directly in **GitHub**. To duplicate a sub-capability (integration) and upload it as custom content, you must perform a manual flow using the `demisto-sdk`. --- @@ -34,7 +34,7 @@ When you select **Duplicate** or **View Source** for a sub-capability (integrati If you only need to review the code without making changes: -1. Copy the Integration Name provided for the sub-capability (integration) on the **Data Sources & Integrations** page in Cortex XSIAM. +1. Copy the **Integration Name** provided for the sub-capability (integration) on the **Data Sources & Integrations** page in Cortex XSIAM. 2. Navigate to the official [Cortex Content GitHub Repository](https://github.com/demisto/content). 3. Search for the integration folder under the `Packs/` directory using the name you copied (such as, `Packs//Integrations//`). 4. Review the YAML and Python/PowerShell files directly in the repository. @@ -77,7 +77,7 @@ For full installation instructions and system requirements, see the [Demisto-SDK #### Step 2: Clone or sync the content repository -Clone the official `demisto/content` repository locally. +Clone the official [`demisto/content`](https://github.com/demisto/content) repository locally. **Option A: SSH** *(recommended for local uploads only)* From 8a978ffcaa2a28dc8eca97420caf453105381109 Mon Sep 17 00:00:00 2001 From: Shir2611 Date: Tue, 8 Sep 2026 14:42:19 +0300 Subject: [PATCH 10/13] empty commit From 4a962bfcb4a3580747cd86ce43f8db58936c5e8d Mon Sep 17 00:00:00 2001 From: Shir2611 Date: Thu, 10 Sep 2026 17:46:41 +0300 Subject: [PATCH 11/13] code review --- ...> manage-custom-content-for-connectors.md} | 20 +++++++++++++++++-- sidebars.js | 2 +- 2 files changed, 19 insertions(+), 3 deletions(-) rename docs/integrations/{custom-integration-duplication.md => manage-custom-content-for-connectors.md} (87%) diff --git a/docs/integrations/custom-integration-duplication.md b/docs/integrations/manage-custom-content-for-connectors.md similarity index 87% rename from docs/integrations/custom-integration-duplication.md rename to docs/integrations/manage-custom-content-for-connectors.md index e71528542..c8075d7cf 100644 --- a/docs/integrations/custom-integration-duplication.md +++ b/docs/integrations/manage-custom-content-for-connectors.md @@ -1,9 +1,13 @@ --- -id: custom-integration-duplication +id: manage-custom-content-for-connectors title: Manage custom content for connectors description: Learn how Cortex XSIAM manages custom content for connectors, including viewing source code and duplicating sub-capabilities (integrations) using the demisto-sdk. --- +:::note +This topic applies to the following Cortex products: **Cortex XSIAM**, **Cortex XDR**, **Cortex Cloud**, **Cortex AgentiX**, and **Cortex Data Security**. It does not apply to standalone Cortex XSOAR deployments. +::: + Cortex XSIAM is transitioning to a unified connector experience that consolidates all vendor security capabilities, including log ingestion, automation, and threat intelligence, into a single entry in the catalog. Within a connector, these individual services are referred to as sub-capabilities (integrations). --- @@ -28,7 +32,7 @@ The method for managing source code depends on whether the service is currently ## External management workflow -When you select **Duplicate** or **View Source** for a sub-capability (integration) on the **Data Sources & Integrations** page, Cortex XSIAM provides the name of the sub-capability (integration) needed to locate the relevant files in the official repository. +When you select **Duplicate** or **View Source** for a sub-capability (integration) on the **Data Sources & Integrations** page, Cortex XSIAM provides the names of all the collector's sub-capabilities (integrations) so you can select the one relevant to you. You will need this name to locate the relevant files in the official repository. ### Option 1: View Source in GitHub @@ -77,6 +81,10 @@ For full installation instructions and system requirements, see the [Demisto-SDK #### Step 2: Clone or sync the content repository +:::note Planning to contribute back to the official repository? +If you intend to submit your changes as a pull request to `demisto/content`, you should **fork** the repository first instead of cloning it directly. See the [Contributing Guide](../contributing/contributing) for the full fork-based contribution workflow. +::: + Clone the official [`demisto/content`](https://github.com/demisto/content) repository locally. **Option A: SSH** *(recommended for local uploads only)* @@ -140,6 +148,8 @@ XSIAM_AUTH_ID=your_key_id_number_here :::note If either field is missing this marker, the upload command will block execution to prevent tenant corruption. + +Updating the `display` field with the `_copy` marker is not mandatory, but it is recommended. Doing so makes it easier to distinguish your custom duplicate from the original sub-capability (integration) in the Cortex XSIAM UI. ::: :::warning Critical System ID Conflict Risk @@ -153,11 +163,13 @@ For example: commonfields: id: PolarSecurity name: Polar Security +display: Polar Security # AFTER (Required Duplication Convention) commonfields: id: PolarSecurity_copy name: Polar Security_copy +display: Polar Security_copy ``` --- @@ -224,6 +236,10 @@ Invalid value: :::warning Using `--force-id` is strongly discouraged. Only use this flag if you are an advanced administrator explicitly maintaining custom IDs outside standard system pack boundaries. + +Before using this flag, verify ALL of the following: +1. Your chosen ID is completely unique and does NOT match the original integration ID. +2. Your chosen ID does NOT match any integration ID published on the Marketplace. ::: If you must upload without the `_copy` marker, pass the `--force-id` flag: diff --git a/sidebars.js b/sidebars.js index dfceccadd..365683ea1 100644 --- a/sidebars.js +++ b/sidebars.js @@ -161,7 +161,7 @@ const sidebars = { "integrations/fetch-incidents-lookback", "integrations/Trust-any-certificate", "integrations/dynamic-ui-fields", - "integrations/custom-integration-duplication" + "integrations/manage-custom-content-for-connectors" ] } ] From 955388faa8dc79a28a0d0112f8f762e131eb1135 Mon Sep 17 00:00:00 2001 From: Shir2611 Date: Mon, 14 Sep 2026 15:11:19 +0300 Subject: [PATCH 12/13] final notes --- .../manage-custom-content-for-connectors.md | 28 +++++++++++-------- 1 file changed, 16 insertions(+), 12 deletions(-) diff --git a/docs/integrations/manage-custom-content-for-connectors.md b/docs/integrations/manage-custom-content-for-connectors.md index c8075d7cf..6b87b358a 100644 --- a/docs/integrations/manage-custom-content-for-connectors.md +++ b/docs/integrations/manage-custom-content-for-connectors.md @@ -8,7 +8,7 @@ description: Learn how Cortex XSIAM manages custom content for connectors, inclu This topic applies to the following Cortex products: **Cortex XSIAM**, **Cortex XDR**, **Cortex Cloud**, **Cortex AgentiX**, and **Cortex Data Security**. It does not apply to standalone Cortex XSOAR deployments. ::: -Cortex XSIAM is transitioning to a unified connector experience that consolidates all vendor security capabilities, including log ingestion, automation, and threat intelligence, into a single entry in the catalog. Within a connector, these individual services are referred to as sub-capabilities (integrations). +Cortex is transitioning to a unified connector experience that consolidates all vendor security capabilities, including log ingestion, automation, and threat intelligence, into a single entry in the catalog. Within a connector, these individual services are referred to as sub-capabilities (integrations). --- @@ -16,8 +16,10 @@ Cortex XSIAM is transitioning to a unified connector experience that consolidate The method for managing custom content depends on your onboarding date and the implementation status of the specific vendor: -- **New customers (onboarded after July 26, 2026):** All services in the catalog follow the unified connector experience and require external management for custom content. -- **Existing customers (onboarded before July 26, 2026):** You may see a mix of legacy integrations and unified connectors. The product UI will automatically direct you to the external workflow for sub-capabilities (integrations) that have been transitioned to the unified experience. +
    +
  • New customers (onboarded after July 26, 2026): All services in the catalog follow the unified connector experience and require external management for custom content.
    • +
  • Existing customers (onboarded before July 26, 2026): You may see a mix of legacy integrations and unified connectors. The product UI will automatically direct you to the external workflow for sub-capabilities (integrations) that have been transitioned to the unified experience.
    • +
--- @@ -25,20 +27,22 @@ The method for managing custom content depends on your onboarding date and the i The method for managing source code depends on whether the service is currently part of a unified connector. -- **Legacy integrations:** For services not yet transitioned to the unified experience, you can continue to use the **Duplicate** and **View Source** options directly within the product UI. Upon duplication, the item transitions to a custom content status, and you can modify the source code using the built-in editor. -- **Connector sub-capabilities (integrations):** For vendors using the unified connector experience, the built-in UI editor is not supported. To view the source code of a sub-capability (integration), you can do so directly in **GitHub**. To duplicate a sub-capability (integration) and upload it as custom content, you must perform a manual flow using the `demisto-sdk`. +
    +
  • Legacy integrations: For services not yet transitioned to the unified experience, you can continue to use the Duplicate and View Source options directly within the product UI. Upon duplication, the item transitions to a custom content status, and you can modify the source code using the built-in editor.
    • +
  • Connector sub-capabilities (integrations): For vendors using the unified connector experience, the built-in UI editor is not supported. To view the source code of a sub-capability (integration), you can do so directly in GitHub. To duplicate a sub-capability (integration) and upload it as custom content, you must perform a manual flow using the demisto-sdk.
    • +
--- ## External management workflow -When you select **Duplicate** or **View Source** for a sub-capability (integration) on the **Data Sources & Integrations** page, Cortex XSIAM provides the names of all the collector's sub-capabilities (integrations) so you can select the one relevant to you. You will need this name to locate the relevant files in the official repository. +When you select **Duplicate** or **View Source** for a sub-capability (integration) on the **Data Sources & Integrations** page, Cortex provides the names of all the collector's sub-capabilities (integrations) so you can select the one relevant to you. You will need this name to locate the relevant files in the official repository. ### Option 1: View Source in GitHub If you only need to review the code without making changes: -1. Copy the **Integration Name** provided for the sub-capability (integration) on the **Data Sources & Integrations** page in Cortex XSIAM. +1. Copy the **Integration Name** provided for the sub-capability (integration) on the **Data Sources & Integrations** page in the Cortex tenant. 2. Navigate to the official [Cortex Content GitHub Repository](https://github.com/demisto/content). 3. Search for the integration folder under the `Packs/` directory using the name you copied (such as, `Packs//Integrations//`). 4. Review the YAML and Python/PowerShell files directly in the repository. @@ -53,7 +57,7 @@ Before starting, ensure you have: 1. **[Python 3.10 or higher](https://www.python.org/downloads/)** installed on your workstation. 2. **[Git](https://git-scm.com/downloads)** installed and configured with access to GitHub. -3. **Cortex XSIAM tenant credentials** (Instance Administrator privileges required). +3. **Cortex tenant credentials** (Instance Administrator privileges required). --- @@ -114,9 +118,9 @@ git pull origin master --rebase To allow `demisto-sdk` to authenticate with your platform instance, create a `.env` file in the root directory of your cloned content repository (`content/.env`). -**How to obtain credentials from the Cortex XSIAM UI:** +**How to obtain credentials from the Cortex tenant:** -1. Log in to Cortex XSIAM. +1. Log in to the Cortex tenant. 2. Navigate to **Settings → Configurations** → search for **API Keys**. 3. **API URL** (`DEMISTO_BASE_URL`): Click **Copy API URL** in the top right corner. 4. **API Key** (`DEMISTO_API_KEY`): @@ -207,9 +211,9 @@ SUCCESSFUL UPLOADS: --- -#### Step 6: Verify in Cortex XSIAM +#### Step 6: Verify in the Cortex tenant -1. Log in to Cortex XSIAM. +1. Log in to the Cortex tenant. 2. Navigate to **Settings → Data Sources & Integrations → Add New**. 3. Locate your sub-capability (integration); it will display a **Custom** badge. 4. Click **Add** to configure and use your custom duplicate. From 86bc8ed242d08ddee6e1df664b03f7433b376c25 Mon Sep 17 00:00:00 2001 From: Shir2611 Date: Tue, 22 Sep 2026 14:55:49 +0300 Subject: [PATCH 13/13] changed the sdk ver --- docs/integrations/manage-custom-content-for-connectors.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/integrations/manage-custom-content-for-connectors.md b/docs/integrations/manage-custom-content-for-connectors.md index 6b87b358a..f5b144d9c 100644 --- a/docs/integrations/manage-custom-content-for-connectors.md +++ b/docs/integrations/manage-custom-content-for-connectors.md @@ -63,7 +63,7 @@ Before starting, ensure you have: #### Step 1: Install or update demisto-sdk -The custom upload flow requires `demisto-sdk` version **1.40.0 or higher**. +The custom upload flow requires `demisto-sdk` version **1.39.10 or higher**. Run the following command to install or upgrade: