Propagating configuration changes to MSSP organizations

After you make changes to administration and customization settings in the configuration organization, you must push the changes to the global dashboard and child organizations for the updates to take effect.

Before you begin

You must be a member of all organizations in the MSSP deployment to update the configuration as described in this section. Make sure that there are no other users currently logged in to the system.

About this task

To update the global dashboard and child organizations with configuration settings from the configuration organization, complete a configuration push from the configuration organization. All administration and customization settings, except for user accounts and API key accounts, are propagated to the global dashboard and child organizations. Any data not currently in use is deleted, for example, incident fields, workflows, and notifications.

Depending on the amount of customizations in your deployment and the number of organizations, propagating the configuration the first time can take several minutes where subsequent pushes are quicker. On premises customers can check the client.log file, located in the /usr/share/co3/logs directory, to review the progress.

Note: Any running instances of a playbook in a child organization are canceled if any of the following are true:
  • Playbook was deleted.
  • Any input fields were removed.
  • A sub-playbook was removed.
  • Any playbook condition fields were deleted.
  • Any functions were deleted.

You cannot complete a configuration push if one is already in progress.

Procedure

  1. Navigate to the configuration organization, identified by the icon.
  2. Select Administrator Settings > Configuration Push.
  3. Click Push Configuration.
  4. If prompted, enter a reason for this configuration push.
    The following animated graphic shows how to navigate to the Administrator Settings and Configuration Push tab and complete a configuration push.

Results

You can view the status of the configuration push in the table. Clicking on the status provides details about the state of the push for each organization.

NOTE: If your SOAR Platform was upgraded and you have configuration pushes from a previous release, clicking the status of those pushes does not provide any details.