The next step after deploying a Publisher is to pair the Publisher with your Chronicle SOAR instance as follows.

  1. In the platform, navigate to Settings > Advanced > Publishers.
  2. Click the plus icon on the top right of the screen.
  3. Fill in the following information
    1. Name of Publisher
    2. Server API Root (Address)
    3. Secondary Publisher: Please refer to Set up High Availability for more information on when to fill this out.
    4. Agent Communication Time: This is the time threshold for the Publisher to receive a ping from the Agent. Once this time is up, the Publisher will tell Chronicle SOAR that the Agent is down.
    5. Publisher API token: For details on how to access this, see previous topic
  4. Click Save.

The Publisher now appears in the list on the main screen. Note that you can click on View Publisher Logs to download a zip file containing logs from the last 24 hours.