Cortex XDR Licenses
Cortex XDR License Types
The following table describes the different license types that are available for Cortex XDR. If you do not know which license type you have, see License Monitoring.
Cortex XDR Prevent
Cortex XDR Pro per Endpoint
Cortex XDR Pro per TB
Minimum 5TB log storage
EDR data collection
External log ingestion
Outbound integration and notification forwarding (Slack, Syslog)
+ agent audit logs
+ agent audit logs
With Cortex XDR Prevent and Cortex XDR Pro per Endpoint licenses, Cortex XDR manages licensing for all endpoints in your organization. Each time you install a new Cortex XDR agent on an endpoint, the Cortex XDR agent registers with Cortex XDR to obtain a license. In the case of non-persistent VDI, the Cortex XDR agent registers with Cortex XDR as soon as the user logs in to the endpoint.
Cortex XDR issues licenses until you exhaust the number of license seats available. Cortex XDR also enforces a license cleanup policy to automatically return unused licenses to the pool of available licenses. The time at which a license returns to the license pool depends on the type of endpoint:
Agent Removal from Cortex XDR
Standard and mobile devices
If after a license is revoked the agent connects to Cortex XDR, reconnection will succeed as long as the agent has not been deleted.
It can take up to an hour for Cortex XDR to display revived endpoints.
Cortex XDR will notify you if you exceed the number of available licenses.
After your Cortex XDR license expires, Cortex XDR allows access to your tenant for an additional grace period of 48 hours. After the 48-hour grace period, Cortex XDR disables access to the Cortex XDR app until you renew the license.
For the first 30 days of your expired license, Cortex XDR continues to protect your endpoints and/or network and retains data in the Cortex Data Lake according to your Cortex Data Lake data retention policy and licensing. After 30 days the tenant is decommissioned.
dialog, you can view the license type associated with your Cortex XDR instance.
Cortex XDR License
For each license you have, Cortex XDR displays a tile that has the expiration date of your license and additional details specific to your license type:
- Cortex XDR Prevent—Displays the total number of concurrent agents permitted by your license. You can also view a graph of the current license allocation (total and percentage).
- Cortex XDR Pro per Endpoint—Displays the total number of installed in addition to the number and percentage of agents that have EDR data collection enabled. Below the license card, you can also view the storage retention policy, total amount of storage allocated for endpoint XDR, and the actual data usage.
- Cortex XDR Pro per TB—Displays the amount of total storage included with your license and the amount of storage used.
- Combination of Cortex XDR Pro per Endpoint and Cortex XDR Pro per TB—Cortex XDR Pro per Endpoint displays the total number of installed agents, while Cortex XDR Pro per TB displays how many agents are enabled with endpoint data collection, allowing them to collect and send data to the server.
Cortex XDR will send you a notification if you exceed the number of allowed agents.
To keep you informed of updates made to your license and avoid service disruptions, Cortex XDR now displays a notification of changes made to your license when you log in. If any actions are required from you
Recommended For You
Recommended videos not found.