Cortex Data Lake License Activation

Determine whether to you need to activate your Cortex Data Lake (formerly called the Logging Service) license on the CSP or on the Cloud Services portal.
The Cortex Data Lake collects log data from next-generation firewalls, GlobalProtect cloud service and the Traps management service.There are two ways in which you can activate your Cortex Data Lake license depending on what products you are using:
  • Customer Support Portal—If you have Palo Alto Networks firewalls on which you plan to enable log forwarding to the Cortex Data Lake or you use the GlobalProtect cloud service, you must first activate the Cortex Data Lake from the Customer Support Portal. The Customer Support Portal workflow allows you to associate the auth code with Panorama so that you can get the Cloud Services plugin that is required for the firewalls and the GlobalProtect cloud service. See License and Install the Cloud Services Plugin.
  • Cortex Hub—You can activate the license directly on the Cloud Services portal, if you have purchased the Traps management service license, and the following are true:
    • You already have a Cortex Data Lake instance set up in the region in which you plan to store Traps management service logs. In this case, you must Configure Log Storage Quota on the Cortex Data Lake.
    • Your Palo Alto Networks firewalls are not forwarding logs to the Cortex Data Lake region in which you plan to store Traps logs, and you don’t use the GlobalProtect cloud service. In this case, when you activate the Traps management service license you receive Traps Included Storage of 100GB.
    • You are upgrading the Traps Included Storage of 100GB to a Cortex Data Lake license with larger storage capacity. See Activate Cortex Data Lake on the Cortex Hub.
If your Cortex Data Lake subscription expires, you have a 30-day grace period to renew your licence before log data is deleted.

Related Documentation