Content Pack Lifecycle

subscription trial subscribe unsubscribe contribution points grace
Cortex XSOAR Marketplace includes both free and paid-for Content Packs. When you purchase a paid Content Pack, you subscribe to the pack on a monthly basis, which is automatically renewed each month. You receive all content and updates for the Content Pack on a regular basis, in return for payment using a points system. In the
tab, you can view the monthly cost of each Content Pack.
To install a paid Content Pack you need access to the Marketplace and to have sufficient points in your account. Paid Content Packs come with a 30-day free trial.
You can restrict who can install content when defining or editing a role. You can also restrict who can spend points in the Customer Support portal.

Trial Period

Paid Content Packs come with a free 30-day trial period, during which you can evaluate the Content Pack without commitment. After installing the Content Pack, you see initially how many days remain for the trial, after which you see the date the trial ends.
If you want to continue using the Content Pack after the trial period ends, you need to subscribe to the Content Pack during the trial period.
If you do not subscribe during the trial period, the Content Pack is deleted together with any customized content. You cannot take another trial period until 1 year has elapsed from the date the trial ends. If you initially subscribe, but the Content Pack is deleted (for example, you decide no longer to subscribe), you cannot take another trial until 6 months have elapsed from the date of deletion.


When you subscribe to the Content Pack during or after the trial period, you receive all content items and any updates. Payment is based on a points system, which is charged immediately upon subscription and the 1st of every month thereafter.
To receive support for community supported content packs, post a comment in the Cortex XSOAR Live Community.
After installing a paid Content Pack, you cannot copy the playbook, and view the integration and automation code.
Content Packs are automatically renewed every month. Once you subscribe to a Content Pack, you can install on different environments. For example, if you have a test and production environment, you can install the Content Pack on a test environment and when finished testing, install on a production environment.
There are no refunds for subscribed content packs.

Points Bank

You buy Content Packs using points, which are bought from your sales representative. Cortex XSOAR sends you a monthly report of all transactions. You can view your total points, monthly obligations, and when the next payment is due.
1 point = $100 USD.
When subscribing to paid Content Packs, note the following:
  • You need to have sufficient points. If installing a free Content Pack that depends on a paid Content Pack, the cost includes the total sum of the free Content Pack and each dependent paid Content Pack.
  • If you do not have enough points, you cannot subscribe to the content. However if you are already a subscriber to the Content Pack and do not have enough points for that month, you enter a grace period.
  • If there are insufficient points for all the subscribed packs, the system automatically renews the oldest subscriptions first. Content Packs that the system could not charge, go into the grace period.
Points are connected to your Cortex XSOAR license. Points that are not used by the Cortex XSOAR license expiry date can be used for renewal.
Points purchased but not used after 5 years will automatically expire (unless prohibited by applicable law).

Grace Period

Although the Content Pack is renewed automatically each month, if you do not have sufficient points to renew your subscription, the Content Pack enters a two-month grace period, enabling you to buy more points before the Content Pack is removed from your environment. During the grace period you receive warnings that the grace period is to expire, but no content is removed. In the
field you see notification that you have insufficient funds.
If you hover over the
No sufficient funds
field, you can see more details.
When you buy more points, you need to pay for the grace period and the following month. In the following example, you can see the overdue payments and the monthly subscription.
You can also view more details of the overdue payments when clicking
view details
When more points are added, any outstanding payment is taken automatically. If the Content Pack was deleted and you want to subscribe again you need to pay any outstanding amount.
If after the grace period you do not have enough points to purchase the Content Pack, it is deleted together with any customizations, playbook, automations, etc.

Subscription to Third Party Services

Some of the Premium Content Packs provide a subscription to a third party service (for example, intelligence feed, SaaS products, etc.). Access is managed by third party technology partners. In the
tab of the Content pack, you can see whether the Content Pack contains a third party subscription.
How to get access
When you trial or subscribe to a Content Pack that contains an API key, the Marketplace platform processes the transaction and notifies the Partner to generate access to complete the transaction.
Usually within 24 hours, the Partner will send API key information by email directly to you (detailed instructions are provided). The Partner may ask you to obtain the key via their system, portal, etc.
After receiving the API key, copy and paste the key into the integration configuration to allow the integration to function. You may need to paste this key into another Content Pack’s configuration (such as a Base or Core Content Pack). The Content Pack will specify the relevant Content Pack and integration name.
Ongoing Access
You continue to have access to the third party data or service for as long as you remain subscribed to the Content Pack. If a Partner contacts you to update your key, please do so to ensure your access is active.
Payments for Content Packs occur monthly on the first day of the month. If you choose to delete or unsubscribe from the Premium Content Pack, access will be terminated at the end of the current calendar month.
Get Help
If you need help, have questions, or did not receive access, please email

Content Pack Updates

Content Packs are updated for bug fixes, enhancements, and so on. When there is an update available for a Content Pack, you will see notifications in several places in the Cortex XSOAR platform, including an icon over
in the main navigation panel and the
Installed Content Packs
tab in the Marketplace.
The Marketplace is updated every 2 hours and when the server is restarted.
In the
Release Notes
tab of a Content Pack you can see the version history for the Content Pack, including the currently installed version, earlier versions, and available updates. You can always revert to a previous version of a Content Pack.


You can unsubscribe at any time without obligation. If you unsubscribe, you can either delete the Content Pack immediately or unsubscribe and then wait until the end of the month when the content is deleted. For more information, see delete a content pack.


When you contribute a Content Pack, you can provide it for free or set a point amount for subscribing. Payment is usually sent from Palo Alto Networks to the contributor every month.


Certified content packs are thoroughly reviewed by the Cortex XSOAR team and pass a rigid set of requirements that ensure quality and that the pack consists of a complete use case. All paid packs will be certified.

Recommended For You