As part of the migration of Cortex XDR 1.0 to Cortex XDR 2.0, a new Cortex XDR licensing structure is in effect. The new licensing structure allows you to better view and manage how your network data and endpoints are best utilized across your organization.
Cortex XDR 1.0 license was based on the amount of terabyte (TB) used for either.
1TB = 200 Pro per Endpoints (with EDR Collection)
or
1TB = 1TB of network traffic analysis/third party data + 200 Prevent Endpoints (without EDR collection)
The Cortex XDR 2.0 license structure is based on three Licenses that you can purchase individually or as a combination. The endpoint licenses provide the number of permitted agents, either Prevent or Pro. The TB license identifies the amount of TB used for network traffic analysis and collecting third-party data:
Cortex XDR Prevent license—Number of Prevent Endpoints (without EDR collection)
Cortex XDR Pro per Endpoint license—Number of Pro Endpoints (with EDR collection)
Cortex XDR Pro per TB license—Amount of network data used for network traffic analysis and third-party data.
License Conversion Method and Example
Converting Cortex XDR 1.0 license to a Cortex XDR 2.0 license is calculated as follows:
License Type | Calculation |
|---|---|
Endpoints |
|
Network Data |
|
After migration of Cortex XDR 2.0, when selecting → , the license displays the converted amounts of network data or its equivalent number of endpoints allocated to your license. The following table displays a conversion comparison between Cortex XDR 1.0 and 2.0 licenses.
License Version | License Details |
|---|---|
Cortex XDR 1.0 License |
|
Post Migration Cortex XDR 2.0 License |
|
Convert Your Cortex XDR License
When your Cortex XDR app is migrated to Cortex XDR 2.0, we recommend you convert your Cortex XDR license to align with the new structure. To apply the new license structure, determine how the amount of network data and number of endpoints are distributed across your organization.
Note
After you convert your legacy license to Cortex XDR 2.0 license structure, your new network and endpoint allocation are applied immediately. You can edit the allocation at any time, however, after you convert to the new license structure you cannot revert to your legacy license.
In Cortex XDR app, select → .
(1) Network quota in TB and qualifying number of Pro per Endpoints
(2,3) Number of agents installed and enabled to collect EDR data in your organization based on the quota allocated in → → → .
(4) Current number of days Cortex XDR retains your data.
Convert your Cortex XDR 1.0 license to Cortex XDR 2.0 license.
Select Convert License.
Use the Network Allocation slide bar to allocate your license between network and endpoints (1 network TB = 200 endpoints).
Note
If you allocate all of your license to network data then you disable endpoint capabilities (and vice versa).
Apply your new license allocations.
In your new Cortex XDR 2.0 license, review or Edit your license allocation.
Number of Cortex XDR agents
Amount of network TB
Number of installed endpoints and endpoints enabled with EDR Data collection according to the number of agents allocated to your license, rather than the Cortex Data Lake distribution.
Number of days remaining for Cortex XDR to retain your data.
Should you require additional TB or agent coverage, contact your Sales representative.