Learn more about how to compute units CU) works according to your license and available options after reaching your quota.
Cortex Cloud provides a free daily quota of compute units (CU) allocated according to your license size. Queries called without enough quota will fail. To expand your investigation capabilities, you can purchase additional CU by enabling the Compute Unit add-on.
The Compute Unit add-on provides an additional 1 compute unit per day for a year, in addition to your free annual quota. For example, if you have allocated 1,825 free annual CU, with the add-on, you will have a total of 2,190 annual compute units. The Compute Unit add-on is calculated on an annual basis, starting from the procurement of your add-on license. The minimum purchase amount is 50 compute units.
You can configure the daily consumption limit for your compute units according to your organizational needs and change it when needed. For example, you can set a lower limit on a daily basis, and during an incident investigation, you can change it to a higher limit that enables you to consume more compute units.
Your unused compute unit balance cannot be transferred from one licensing period to the next.
To gauge how many CU you require, Cortex Cloud provides a 30-day free trial period with 1/12 of your allocated annual CU quota to run XQL API and Cold Storage queries. You can then track the cost of each XQL API and Cold Storage query responses, and the Compute Units Usage page. In addition, Cortex Cloud sends a notification when the Compute Units add-on has reached your daily threshold.
Note
To enable the add-on, select → tile, and select the Compute Unit tile and Enable.
Select → → → .
In Annual Usage in Compute Units, monitor the number of free compute units per license year, the number of purchased compute units per license year, and the ratio of used compute units to your yearly total compute units.
If you have Edit permissions for Public APIs, you can customize the Daily limit to cater to your needs.
Divide annual quota evenly: Total annual compute units divided by 365.
1% of annual quota: 1% of the total annual compute units.
No limit
Custom: Configure a daily amount that is equal to or greater than your daily average calculated over a year (annual total/365). Use only integers.
The default daily limit is the annual quota divided evenly.
In Compute Units Usage , view the compute unit usage over the past 30 days or over the past 12 months.
Compute Units Usage over the Last 30 Days: Hover over each bar to view the total number of units used each day. The daily compute units are calculated at 00:00 UTC time. The red line represents your daily limit for that day. If you change the daily limit a few times on a specific day, the displayed limit is the last number you configured on that day. Select a bar to display in the Compute Unit Usage table the list of queries executed on the selected day.
Compute Units Usage over the Last 12 Months: Hover over each bar to view the total number of compute units used each month. The dotted gray line represents your average annual limit per month. You can use the 12-month display to plan how many compute units you need in the next licensing period.
In the Compute Units Usage table, investigate all the queries that were executed on your tenant.
You can filter and sort according to the following fields.
ID: Unique identifier representing the executed XQL API query.
Timestamp
For XQL API: date and time of query execution.
Type: Indicates the type of query performed.
PAPI Key ID: API Key ID used to execute XQL APIs.
Query: The query description.
Compute Unit Usage: Displays how many query units were used to execute the query.
Tenant: Appears only in a Managed Security tenant. Displays which tenant executed an API query or Cold Storage query.
Investigate the XQL API or Cold Storage query results.
In the Compute Units Usage table, locate an XQL API or Cold Storage query, right-click, and select Show results.
The query is displayed in the query field of the Query Builder, where you can view the query results. For more information, see How to build XQL queries.