Manage Your Log Storage within
Cortex
XDR

Cortex XDR licenses are based on your log storage capacity. To view your licensed capacity, use the Customer Support Portal.
Cortex
XDR
Log Storage is managed in the
Cortex
XDR
Data Layer. You receive log storage based on the amount of storage associated with your Cortex XDR Licenses. Generally, this capacity is determined by factors such as your daily ingestion needs and the number of users in your deployment. All
Cortex
XDR
licenses provide you with a default retention period of 30 days for your general data usage and your endpoint data usage. You can extend your license retention depending on your requirements for the following types of storage.
  • Hot Storage
    —Fully searchable storage, for investigation and threat hunting.
  • Cold Storage
    —Cheaper storage usually for long-term compliance needs with limited search options.
There are three types of Pro licenses.
Type of Pro License
Retention Details
Storage Options
Cortex
XDR
Pro per Endpoint (PAN-XDR-ADV-EP)
Grants ingestion and 30 days retention. If you want to save more than 30 days of endpoint data, you need to obtain additional Cold or Hot Storage according to your requirements for all of your endpoints. For example, if you obtain 20,000 endpoints for 30 days and then require an additional 6 months retention, you need to purchase retention for 6 months for 20,000 endpoints.
The following are the storage options available with this license.
  • Hot storage EP
    —Minimum of 1 month storage.
  • Cold storage EP
    —Minimum of 6 months storage.
Cortex
XDR
Cloud per Host (PAN-XDR-ADV-EP-CLOUD)
Grants ingestion and 30 days retention. If you want to save more than 30 days of cloud data, you need to obtain additional Cold or Hot Storage according to your requirements for all of your hosts.
The following are the storage options available with this license.
  • Hot storage EP
    —Minimum of 1 month storage.
  • Cold storage EP
    —Minimum of 6 months storage.
Cortex
XDR
Pro per TB (PAN-XDR-ADV-1TB)
Where each license adheres to the following guidelines.
  • Allows ingesting up to 1 TB per month and no more than 33GB per day.
  • Enables storing 1TB of data for 30 days.
    The
    Cortex
    XDR
    Agent and
    Cortex
    XDR
    Stitched data is not counted against your daily ingestion quota.
For retention, each license provides you with a default retention of 30 days. If you want to save more than 30 days of Pro per TB data, you need to obtain additional Cold or Hot Storage according to you requirements for all your data. The following are the storage options available with this license.
  • Hot storage GB
    —Minimum of 1 month storage.
  • Cold storage GB
    —Minimum of 6 months storage.
For more information on your storage license details, see Dataset Management.
To increase your capacity, contact your Palo Alto Network account representative.
To view your current
Cortex
XDR
license.
  1. From
    Cortex
    XDR
    , select
    Settings
    Cortex XDR License
    .
    Data usage and storage license details are available in Dataset Management.

Recommended For You