Cortex Data Lake collects log data from next-generation firewalls, Prisma Access, and Cortex XDR. When you purchase Cortex Data Lake, all firewalls registered to your support account receive a Cortex Data Lake license. You’ll also receive an auth code that you’ll need to use to activate your Cortex Data Lake instance.

How you activate and implement Cortex Data Lake can vary depending on the other products and services you’re using:

As part of another product subscription or evaluation, you might have received some Cortex Data Lake log storage. To extend your storage capacity, you can purchase and merge a new Cortex Data Lake instance with the instance that came with your product. In this case, consider that the product-included storage is tied to your product license and the additional Cortex Data Lake instance has its own separate license. If the additional Cortex Data Lake license expires before your product license does, your Cortex Data Lake storage capacity reverts to the amount of storage you received with your product. While your storage capacity is reduced, your log storage quota settings don’t change; the percentage of overall storage you’ve allocated for each log type remains the same.

In all cases, when your Cortex Data Lake subscription expires, you’ll have a 30-day grace period to renew your license before log data is deleted.