Activate Cortex XDR Apps

Use the Palo Alto Networks Cortex Hub (https://apps.paloaltonetworks.com) to activate your Cortex XDR apps. This is a one-time task you’ll need to perform when you first start using Cortex XDR apps. Once you’ve activated the apps—and completed all the steps to Cortex XDR Configuration Overview—you’ll only need to repeat the activation if you want to add additional app instances.
To activate Cortex XDR apps, you must be assigned the four required roles and have your Palo Alto Networks-provided authentication code ready as described in Everything You Need to Configure Cortex XDR. You must also have activated your Cortex Data Lake (formerly named Logging Service) license and allocated quota for Cortex XDR.
  1. Log in to the Palo Alto Networks Cortex Hub.
    Any Palo Alto Networks account user can log in to the Cortex Hub; however, you must be assigned the appropriate roles to continue to activate the Cortex XDR – Analytics app.
  2. Click Activate New App.
  3. Enter the Auth Code that Palo Alto Networks provided with your Cortex XDR license and Continue.
  4. Provide details about the Cortex XDR apps you’re activating.
    cortex-xdr-activation.png
    • Name Prefix—Give your Cortex XDR apps instance an easily-recognizable name and optional Description. Cortex Hub uses the name prefix to create your app instances (for example prefix.analytics.paloaltonetworks.com and prefix.investigation-and-response.paloaltonetworks.com).
    • Traps Subdomain—Give your Traps instance an easy to recognize prefix.
    • Region—Select your region. This must be the same region in which the associated Cortex Data Lake instance is deployed.
    • Cortex Data Lake—Select the Cortex Data Lake instance that will provide the Cortex XDR apps with log data.
    • Directory Sync—Optionally select the Directory Sync Service instance that will provide the Cortex XDR apps with Active Directory data. If you do not currently have a Directory Sync Service activated and configured for your account, you can add one at a later time.
    Agree and Activate and then wait for the activation to complete. It can take up to an hour to complete activation for all apps.
  5. Verify the status of your apps.
    From the Cortex Hub, click the gear icon next to your name and view the STATUS. When the app is available you will see a green check mark.
  6. Log in to your Cortex XDR apps to confirm that you can successfully access the Cortex XDR app interfaces.
  7. Complete the setup required for specific apps:

Related Documentation