Activate Cortex XDR

Use the hub (https://apps.paloaltonetworks.com) to activate Cortex XDR. This is a one-time task you’ll need to perform when you first start using Cortex XDR. Once you’ve activated the Cortex XDR app—and completed all the steps described in Set up Cortex XDR Pro Overview—you’ll only need to repeat the activation if you want to add additional app instances.
To activate the Cortex XDR app, you must be assigned an App Administrator or Account Administrator role (for more information, see Administrative Roles). You must also locate your activation email containing either a link to begin activation in the hub or an auth code you can use to activate from the hub. If you recently purchased Cortex XDR (December 2019 or later), activating Cortex XDR automatically includes activation of Cortex Data Lake. However, if you purchased Cortex XDR before December 2019 and received an auth code for Cortex Data Lake, have that handy during activation to ensure set up of a new Cortex Data Lake instance.
  1. Begin activation.
    With an activation link
    :
    1. Click the activation link you received in email to begin activation in the hub.
    2. If you manage multiple company accounts, verify your company account name before proceeding with activation.
      company-account.png
      The hub will associate activation of Cortex XDR and the included apps and services only with the selected account.
    3. From the Cortex XDR tile, select the serial number you want to activate.
      If there is only one serial number associated with your company account, you can click the tile to begin activation.
      cortex-xdr-setup.png
      If you have multiple serial numbers associated, click each one to activate.
      cortex-xdr-setup-multiple.png
    With an auth code
    :
    1. Log in to the hub.
    2. If you manage multiple company accounts, verify your company account name (visible in the top right menu bar) before proceeding with activation.
      The hub will associate activation of Cortex XDR and the included apps and services with the selected account.
    3. Activate App
      .
    4. Enter the
      Auth Code
      that Palo Alto Networks provided with your Cortex XDR license and
      Continue
      .
  2. Provide details about the Cortex XDR app you’re activating.
    activate-cortex-xdr-v1.png
    • Company Account
      —Identifies the company account under which you are activating Cortex XDR.
    • Name
      —Give your Cortex XDR app instance an easily-recognizable name and optional
      Description
      . If you have more than one Cortex XDR instance, the hub displays the name in the instance list when you select the Cortex XDR tile. Choose a name that is 59 or fewer characters and is unique across your company account.
    • Subdomain
      —Give your Cortex XDR instance an easy to recognize name. The hub displays the name you assign on the list of available instances for the Cortex XDR app. You can also access the Cortex XDR app directly using the full URL (https://
      <subdomain>
      .xdr.
      <region>
      .paloaltonetworks.com). If you are converting an existing Traps management service to XDR with Traps management service, this field is grayed out.
    • Cortex Data Lake
      —Select the Cortex Data Lake instance that will provide the Cortex XDR apps with log data.
      If you activated with an auth code, provision a new Cortex Data Lake instance by selecting the link to
      activate purchased licenses
      and provide the separate Cortex Data Lake auth code you received in email.
      If you activated with the activation link, you can automatically provision a new Cortex Data Lake instance in the region you select or select an existing Cortex Data Lake and increase its size.
      You can only select a Cortex Data Lake that is not allocated to another Cortex XDR or Cortex XDR Agent instance. Once You select a Cortex Data Lake from a specific region, the Region field is automatically selected.
    • Region
      —Select a region in which you want to set up your Cortex Data Lake instance. If you selected an existing Cortex Data Lake instance, this field automatically displays the region in which your Cortex Data Lake instance is deployed and cannot be changed.
    • Directory Sync
      —(
      Optional
      ) Select the Directory Sync Service instance that will provide the Cortex XDR app with Active Directory data. If there is only one Directory Sync Service instance for the selected Cortex Data Lake region, the hub automatically selects it for pairing with the Cortex XDR app, however you can clear the default selection, if desired. If you do not currently have a Directory Sync Service activated and configured for your account, you can select the link to
      create an instance
      now, or you can add one at a later time.
  3. Review the end user license agreement and
    Agree & Activate
    .
    The hub displays the activation status as it activates and provisions your apps. It can take up to an hour to complete activation. After activation completes, the hub displays a summary that shows the details for your apps and services.
    activation-complete.png
  4. Manage Apps
    to view the current status of your apps.
    When the app is available you will see a green check mark in the
    STATUS
    column. To return to the status page at a later time, return to the hub and select
    gear.png
    Manage Apps
    .
  5. When your app is available, log in to your Cortex XDR app to confirm that you can successfully access the Cortex XDR app interface.
  6. Review the storage allocation for your Cortex Data Lake and adjust the quota as needed. You must be an assigned an Instance Administrator or higher role to for Cortex Data Lake to manage logging storage.
  7. If you have a Cortex XDR Pro per Endpoint license, continue to Set up Endpoint Protection. Otherwise proceed to Set up Network Analysis.

Recommended For You