Cortex XDR Log Storage is managed in the Cortex XDR Data Layer. You receive log storage based on the amount of storage associated with your licenses. Generally, this capacity is determined by factors such as your daily ingestion needs and the number of users in your deployment. All Cortex XDR licenses provide you with a default retention period of 30 days for your general data usage and 180 days for your alert and incident data. You can extend your license retention depending on your requirements for the following types of storage.
Hot Storage—Fully searchable storage, for investigation and threat hunting.
Cold Storage—Cheaper storage, usually for long-term compliance needs with limited search options.
There are three types of Pro licenses.
Type of Pro License | Retention Details | Storage Options |
|---|---|---|
Cortex XDR Pro per Endpoint (PAN-XDR-ADV-EP) | Grants ingestion and 30 days retention. If you want to save more than 30 days of endpoint data, you need to obtain additional Cold or Hot Storage according to your requirements for all of your endpoints. For example, if you obtain 20,000 endpoints for 30 days and then require an additional 6 months retention, you need to purchase retention for 6 months for 20,000 endpoints. | The following are the storage options available with this license.
|
Cortex XDR Cloud per Host (PAN-XDR-ADV-EP-CLOUD) | Grants ingestion and 30 days retention. If you want to save more than 30 days of cloud data, you need to obtain additional Cold or Hot Storage according to your requirements for all of your hosts. | The following are the storage options available with this license.
|
Cortex XDR Pro per TB (PAN-XDR-ADV-1TB) | Where each license adheres to the following guidelines.
| For retention, each license provides you with a default retention of 30 days. If you want to save more than 30 days of Pro per TB data, you need to obtain additional Cold or Hot Storage according to you requirements for all your data. The following are the storage options available with this license.
|
For more information on your storage license details, see Data Management.
To view your licenses, from Cortex XDR, select → .