Migrate Your License - Administrator Guide - Cortex XDR - Cortex - Security Operations

Cortex XDR Pro Administrator Guide

Product
Cortex XDR
License
Pro
Creation date
2023-03-27
Last date published
2023-03-27

As part of the migration of Cortex XDR 1.0 to Cortex XDR 2.0, a new Cortex XDR licensing structure is in effect. The new licensing structure allows you to better view and manage how your network data and endpoints are best utilized across your organization.

Cortex XDR 1.0 license was based on the amount of terabyte (TB) used for either.

  • 1TB = 200 Pro per Endpoints (with EDR Collection)

    or

  • 1TB = 1TB of network traffic analysis/third party data + 200 Prevent Endpoints (without EDR collection)

The Cortex XDR 2.0 license structure is based on three Licenses that you can purchase individually or as a combination. The endpoint licenses provide the number of permitted agents, either Prevent or Pro. The TB license identifies the amount of TB used for network traffic analysis and collecting third-party data:

  • Cortex XDR Prevent license—Number of Prevent Endpoints (without EDR collection)

  • Cortex XDR Pro per Endpoint license—Number of Pro Endpoints (with EDR collection)

  • Cortex XDR Pro per TB license—Amount of network data used for network traffic analysis and third-party data.

License Conversion Method and Example

Converting Cortex XDR 1.0 license to a Cortex XDR 2.0 license is calculated as follows:

License Type

Calculation

Endpoints

  • For each CortexCortex XDR 1.0 license, 1 TB = 200 Pro per Endpoints (with EDR collection).

    The number of endpoints is converted based on the quota allocated in HubCortex Data LakeCortex XDREndpoint XDR Data, previously TrapsEndpoint Data.

Network Data

  • For each Cortex XDR 1.0 license, 1 TB = 1 TB of network data.

    Note

    Since Cortex XDR 2.0 pro per TB license no longer includes Prevent endpoints, the license does not reflect them, however, you can keep using them until your renewal.

After migration of Cortex XDR 2.0, when selecting SettingsCortex XDR License, the license displays the converted amounts of network data or its equivalent number of endpoints allocated to your license. The following table displays a conversion comparison between Cortex XDR 1.0 and 2.0 licenses.

License Version

License Details

Cortex XDR 1.0 License

  • Cortex XDR 1.0 PAN-MGFR-XDR-1TB license - 100TB

  • HubCortex Data LakeTrapsEndpoint Data - 10TB Endpoint Data.

Post Migration Cortex XDR 2.0 License

  • Up to 20,000 Pro per Endpoints

  • Up to 100TB for network traffic analysis and third-party data

Convert Your Cortex XDR License

When your Cortex XDR app is migrated to Cortex XDR 2.0, we recommend you convert your Cortex XDR license to align with the new structure. To apply the new license structure, determine how the amount of network data and number of endpoints are distributed across your organization.

Note

After you convert your legacy license to Cortex XDR 2.0 license structure, your new network and endpoint allocation are applied immediately. You can edit the allocation at any time, however, after you convert to the new license structure you cannot revert to your legacy license.

  1. In Cortex XDR app, select SettingsCortex XDR License.

    legacy-license.png
    • (1) Network quota in TB and qualifying number of Pro per Endpoints

    • (2,3) Number of agents installed and enabled to collect EDR data in your organization based on the quota allocated in HubCortex Data LakeCortex XDREndpoint XDR Data.

    • (4) Current number of days Cortex XDR retains your data.

  2. Convert your Cortex XDR 1.0 license to Cortex XDR 2.0 license.

    1. Select Convert License.

      allocate-license.png
    2. Use the Network Allocation slide bar to allocate your license between network and endpoints (1 network TB = 200 endpoints).

      Note

      If you allocate all of your license to network data then you disable endpoint capabilities (and vice versa).

    3. Apply your new license allocations.

  3. In your new Cortex XDR 2.0 license, review or Edit your license allocation.

    • Number of Cortex XDR agents

    • Amount of network TB

    • Number of installed endpoints and endpoints enabled with EDR Data collection according to the number of agents allocated to your license, rather than the Cortex Data Lake distribution.

    • Number of days remaining for Cortex XDR to retain your data.

    migrated-license.png
  4. Should you require additional TB or agent coverage, contact your Sales representative.