Activate Cortex XDR

Use the hub ( to activate Cortex XDR. This is a one-time task you’ll need to perform when you first start using Cortex XDR. After you’ve activated the Cortex XDR app—and completed all the steps described in Set up Cortex XDR Prevent Overview—you’ll only need to repeat the activation if you want to add additional app instances.
To activate the Cortex XDR app, you must be assigned a required role and locate your activation email containing a link to begin activation in the hub. Activating Cortex XDR automatically includes activation of Cortex Data Lake.
  1. Begin activation.
    1. Click the activation link you received in email to begin activation in the hub.
    2. If you manage multiple company CSP accounts, make sure you select the specific account to which you want to allocate the Cortex XDR license to before proceeding with activation.
      The hub will associate activation of Cortex XDR and the included apps and services only with the selected account.
    3. From the Cortex XDR tile, select the serial number you want to activate.
      If there is only one serial number associated with your company account, you can click the tile to begin activation.
      If you have multiple serial numbers associated, click each one to activate.
  2. Provide details about the Cortex XDR app you’re activating.
    • Company Account
      —Identifies the company account under which you are activating Cortex XDR.
    • Name
      —Give your Cortex XDR app instance an easily-recognizable name and optional
      . If you have more than one Cortex XDR instance, the hub displays the name in the instance list when you select the Cortex XDR tile. Choose a name that is 59 or fewer characters and is unique across your company account.
    • Subdomain
      —Give your Cortex XDR instance an easy to recognize name. The hub displays the name you assign on the list of available instances for the Cortex XDR app. You can also access the Cortex XDR app directly using the full URL (https://
      <region> If you are converting an existing Traps management service to Cortex XDR, this field is grayed out.
    • Cortex Data Lake
      —Select the Cortex Data Lake instance that will provide the Cortex XDR apps with log data.
      If you activated with an auth code, provision a new Cortex Data Lake instance by selecting the link to
      activate purchased licenses
      and provide the separate Cortex Data Lake auth code you received in email.
      If you activated with the activation link, you can automatically provision a new Cortex Data Lake instance in the region you select or select an existing Cortex Data Lake and increase its size.
      You can only select a Cortex Data Lake instance that is not allocated to another Cortex XDR instance. When you select a Cortex Data Lake instance, the hub provisions your Cortex XDR instance in the same region.
    • Region
      —Select a region in which you want to set up your Cortex Data Lake instance. If you selected an existing Cortex Data Lake instance, this field automatically displays the region in which your Cortex Data Lake instance is deployed and cannot be changed.
    • Directory Sync
      ) Select the Directory Sync Service instance that will provide the Cortex XDR app with Active Directory data. If there is only one Directory Sync Service instance for the selected Cortex Data Lake region, the hub automatically selects it for pairing with the Cortex XDR app, however you can clear the default selection, if desired. If you do not currently have a Directory Sync Service activated and configured for your account, you can select the link to
      create an instance
      now, or you can add one at a later time.
  3. Review the end user license agreement and
    Agree & Activate
    The hub displays the activation status as it activates and provisions your apps. It can take up to an hour to complete activation. After activation completes, the hub displays a summary that shows the details for your apps and services.
  4. Manage Apps
    to view the current status of your apps.
    When the app is available you will see a green check mark in the
    column. To return to the status page at a later time, return to the hub and select
    Manage Apps
  5. When your app is available, log in to your Cortex XDR app to confirm that you can successfully access the Cortex XDR app interface.
  6. Review the storage allocation for your Cortex Data Lake and adjust the quota as needed. You must be an assigned an Instance Administrator or higher role to for Cortex Data Lake to manage logging storage.
  7. Complete your configuration.

Recommended For You