purchasing Cortex Data Lake, you received an auth code that you’ll
use to activate Cortex Data Lake.
The steps here describe
how to activate Cortex Data Lake on the hub if you’re using Cortex XDR, Cloud Managed
Prisma Access, firewalls that are not managed by Panorama, or firewalls
that are managed by a Panorama running PAN-OS 10.1 or later.
How you activate and implement Cortex Data
Lake varies depending on the products and services you’re using.
Learn more about what you should do to get started with Cortex Data Lake based on the product
you’re using. For example,
if you’re using Panorama on PAN-OS
10.0 or earlier
(either to manage on-prem firewalls or for Panorama
Managed Prisma Access), you’ll need to use the Customer Support Portal instead
of the hub.
If you are using PAN-OS 10.0 or later
firewalls, and if you were sharing telemetry data with Palo Alto
Networks prior to purchasing a Cortex Data Lake license, then you
already have a small, unlicensed Cortex Data Lake instance. This
instance exists solely for the purpose of storing your PAN-OS telemetry
When you activate your license Palo Alto Networks will
upgrade this tenant to a full Cortex Data Lake instance, so long
as the region you use to send telemetry data to Palo Alto Networks
is the same region that you use when you activate your Cortex Data
Lake license. If you use different regions for this purpose, then
the small telemetry-specific tenant will not upgrade to your new,
licensed Cortex Data Lake instance.
When you add a new log source (like the firewall or Cortex
XDR), log storage quota is not allocated for the log types that
belong to this source. Until you allocate log storage, logs are
not saved in Cortex Data Lake.