Activate Cortex Data Lake on the Cortex Hub

If are using the Traps management service to secure your endpoints, all logs generated by the Traps components are forwarded to the Cortex Data Lake and you can view these logs directly from the Traps management service.
When you activated the Traps management service, if you did not have a Cortex Data Lake instance in the region where you were deploying the Traps management service, you received Traps Included Storage of 100GB. If you now require additional log storage capacity for Traps logs, use this workflow to upgrade the Traps Included Storage of 100GB to the Cortex Data Lake you purchased with a larger storage capacity. For this use case, you can activate the Cortex Data Lake Auth code from the Cloud Services portal.
If you plan to configure your Palo Alto Networks firewalls or GlobalProtect cloud services to use this Cortex Data Lake instance, you must activate the Cortex Data Lake from the Customer Support Portal instead.
  1. Sign In to the cloud services portal at https://apps.paloaltonetworks.com/.
  2. Activate your Cortex Data Lake Auth code.
    1. Click Activate New App.
    2. Enter the Auth Code you received to activate the Cortex Data Lake and click Continue.
    3. Enter an Instance Name to identify your tenant in the cloud services portal and provide an optional Description.
    4. Enter an Instance Name to identify your Cortex Data Lake tenant in the cloud services portal and provide an optional Description.
    5. Select the Region in which you want to host the Cortex Data Lake tenant: Europe or Americas.
    6. Select the Cortex Data Lake instance with Traps Included Storage-100GB so that you can merge the logs from the 100GB tenant into the Cortex Data Lake instance that you are activating.
      activate-paid-ls.png
    7. Click Agree and Activate.
  3. Verify the Cortex Data Lake is successfully activated on the Cloud Services portal.
    activate-paid-ls-complete.png

Related Documentation