Activate Cortex Data Lake Without Panorama

After purchasing Cortex Data Lake, you received an auth code that you’ll use to activate Cortex Data Lake.
The steps here describe how to activate Cortex Data Lake on the hub if you’re using Cortex XDR, Cloud Managed Prisma Access, firewalls that are not managed by Panorama, or firewalls that are managed by a Panorama running PAN-OS 10.1 or later.
How you activate and implement Cortex Data Lake varies depending on the products and services you’re using. Learn more about what you should do to get started with Cortex Data Lake based on the product you’re using. For example,
if you’re using Panorama on PAN-OS 10.0 or earlier
(either to manage on-prem firewalls or for Panorama Managed Prisma Access), you’ll need to use the Customer Support Portal instead of the hub.
If you are using PAN-OS 10.0 or later firewalls, and if you were sharing telemetry data with Palo Alto Networks prior to purchasing a Cortex Data Lake license, then you already have a small, unlicensed Cortex Data Lake instance. This instance exists solely for the purpose of storing your PAN-OS telemetry data.
When you activate your license Palo Alto Networks will upgrade this tenant to a full Cortex Data Lake instance, so long as the region you use to send telemetry data to Palo Alto Networks is the same region that you use when you activate your Cortex Data Lake license. If you use different regions for this purpose, then the small telemetry-specific tenant will not upgrade to your new, licensed Cortex Data Lake instance.
  1. Activate Cortex Data Lake.
    1. Log in to the hub.
    2. Activate New App
    3. Enter the
      Auth Code
      you received to activate Cortex Data Lake and
    4. Enter an
      Instance Name
      so that you can identify this app instance in the hub, and optionally add a
    5. Select the
      you want to host the Cortex Data Lake instance.
    6. Click
      Agree and Activate
    7. Verify that Cortex Data Lake is successfully activated on the hub.
      Cortex Data Lake was previously called the Logging Service, and you might continue to see that name listed as the application name.
  2. In the hub, log in to the Cortex Data Lake app instance you just activated.
  3. Select
    and allocate storage for each log type that you plan to forward to Cortex Data Lake.
    When you add a new log source (like the firewall or Cortex XDR), log storage quota is not allocated for the log types that belong to this source. Until you allocate log storage, logs are not saved in Cortex Data Lake.
  4. After you enable firewalls to authenticate to Cortex Data Lake, you can start forwarding logs.

Recommended For You