1. Home
    2. Security Operations
    3. Cortex XDR
    4. Cortex® XDR™ Prevent Administrator’s Guide
    5. Get Started with Cortex® XDR™ Prevent
    6. Manage Your Log Storage within Cortex XDR

    Manage Your Log Storage within
    Cortex
    XDR

    Cortex XDR licenses are based on your log storage capacity. To view your licensed capacity, use the Customer Support Portal.
    • Hot Storage
      —Fully searchable storage, for investigation and threat hunting.
    • Cold Storage
      —Cheaper storage usually for long-term compliance needs with limited search options.
    There are three types of Pro licenses.
    Type of Pro License
    Retention Details
    Storage Options
    Cortex
    XDR
     Pro per Endpoint (PAN-XDR-ADV-EP)
    Grants ingestion and 30 days retention. If you want to save more than 30 days of endpoint data, you need to obtain additional Cold or Hot Storage according to your requirements for all of your endpoints. For example, if you obtain 20,000 endpoints for 30 days and then require an additional 6 months retention, you need to purchase retention for 6 months for 20,000 endpoints.
    The following are the storage options available with this license.
    • Hot storage EP
      —Minimum of 1 month storage.
    • Cold storage EP
      —Minimum of 6 months storage.
    Cortex
    XDR
     Cloud per Host (PAN-XDR-ADV-EP-CLOUD)
    Grants ingestion and 30 days retention. If you want to save more than 30 days of cloud data, you need to obtain additional Cold or Hot Storage according to your requirements for all of your hosts.
    The following are the storage options available with this license.
    • Hot storage EP
      —Minimum of 1 month storage.
    • Cold storage EP
      —Minimum of 6 months storage.
    Cortex
    XDR
     Pro per TB (PAN-XDR-ADV-1TB)
    Where each license adheres to the following guidelines.
    • Allows ingesting up to 1 TB per month and no more than 33GB per day.
    • Enables storing 1TB of data for 30 days.
      The
      Cortex
      XDR
       Agent and
      Cortex
      XDR
       Stitched data is not counted against your daily ingestion quota.
    For retention, each license provides you with a default retention of 30 days. If you want to save more than 30 days of Pro per TB data, you need to obtain additional Cold or Hot Storage according to you requirements for all your data. The following are the storage options available with this license.
    • Hot storage GB
      —Minimum of 1 month storage.
    • Cold storage GB
      —Minimum of 6 months storage.
    For more information on your storage license details, see Dataset Management.
    A
    Cortex
    XDR
     Prevent license grants you 30 days retention.

    Recommended For You

    Recommended Videos

    Recommended videos not found.

    © 2022 Palo Alto Networks, Inc. All rights reserved.

    Techdocs Logo