Activate Cortex Data Lake
After purchasing Cortex Data Lake, you received
an auth code that you’ll use to activate Cortex Data Lake.
The
steps here describe how to activate Cortex Data Lake on the hub if you’re using Cortex XDR, Cloud Managed
Prisma Access, or firewalls that are not managed by Panorama.
How you activate and implement Cortex Data
Lake varies depending on the products and services you’re using.
Learn more about what you should do to get started with Cortex Data Lake based on the product
you’re using. For example,
if you’re using Panorama
(either
to manage on-prem firewalls or for Panorama Managed Prisma Access),
you’ll need to use the Customer Support Portal
to activate Cortex Data Lake instead of the hub.
If you are using PAN-OS 10.0 or later firewalls, and if you were sharing telemetry
data with Palo Alto Networks prior to purchasing a Cortex Data Lake license, then you
already have a small, unlicensed Cortex Data Lake instance. This instance exists
solely for the purpose of storing your PAN-OS telemetry data.
When you activate your license Palo Alto Networks will upgrade this tenant to a full
Cortext Data Lake instance, so long as the region you use to send telemetry data to
Palo Alto Networks is the same region that you use when you activate your Cortex Data
Lake license. If you use different regions for this purpose, then the small
telemetry-specific tenant will not upgrade to your new, licensed Cortex Data Lake
instance.
- Activate Cortex Data Lake.
- Log in to the hub.
- Activate New App.
- Enter theAuth Codeyou received to activate Cortex Data Lake andContinue.
- Enter anInstance Nameso that you can identify this app instance in the hub, and optionally add aDescription.
- Select theRegionyou want to host the Cortex Data Lake instance.
- ClickAgree and Activate.
- Verify that Cortex Data Lake is successfully activated on the hub.Cortex Data Lake was previously called the Logging Service, and you might continue to see that name listed as the application name.
- In the hub, log in to the Cortex Data Lake app instance you just activated.
- SelectConfigurationand allocate storage for each log type that you plan to forward to Cortex Data Lake.When you add a new log source (like the firewall or Cortex XDR), log storage quota is not allocated for the log types that belong to this source. Until you allocate log storage, logs are not saved in Cortex Data Lake.
- Continue to Connect Firewalls to Cortex Data Lake.After you enable firewalls to authenticate to Cortex Data Lake, you can start forwarding logs.
