Learn more about how to compute units (CU) works according to your license and available options after reaching your quota.
Cortex XSIAM provides a free daily quota of compute units (CU) allocated according to your license size. Queries called without enough quota will fail. To expand your investigation capabilities, you can purchase additional CU by enabling the Compute Unit add-on.
The Compute Unit add-on provides an additional 1 compute unit per day, in addition to your free daily quota. For example, if you have allocated 5 free daily CU, with the add-on you will have a total of 6 daily compute units. The CU are refreshed every 24 hours according to UTC time. You can purchase a minimum of 50 compute units.
To gauge how many CU you require, Cortex XSIAM provides a 30-day free trial period with a total of three times your allocated CU to run XQL API and Cold Storage queries. You can then track the cost of each XQL API and Cold Storage query responses and the Compute Units Usage page. In addition, Cortex XSIAM sends a notification when the Compute Units add-on has reached your daily threshold.
To enable the add-on, select → → → tile, and select the Compute Unit tile and Enable.
Select → → → .
In the Daily Usage in Compute Units section, monitor the amount of quota units used over the past 24 hours and the amount of free daily quota allocated according to your license size and the additional amount you have purchased. The time frame is calculated according to UTC time.
For Managed Security tenants, the values calculated are the total daily usage of parent and child tenants.
In the Compute Units over last 30 Days section, track your quota usage over the past 30 days. The red line represents your daily license quota. For Managed Security tenants, make sure you select from the MSSP Tenant Selection drop-down menu, the tenant for which you want to display the information. To investigate further.
Hover over each bar to view the total number of query units used each day.
Select a bar to display in the XCompute Unit Usage table the list of queries executed on the selected day.
In the Compute Units Usage table, investigate all the queries that were executed on your tenant. For Managed Security tenants, make sure you select from the MSSP Tenant Selection drop-down menu, the tenant for which you want to display the information. You can filter and sort according to the following fields.
ID: Unique identifier representing the executed XQL API query.
Timestamp
For XQL API: date and time of query execution.
For Notebooks and BQ queries: date and time the query is charged.
Type: Indicates the type of query performed.
PAPI Key ID: API Key ID used to execute XQL APIs.
Query: The query description.
Compute Unit Usage: Displays how many query units were used to execute the query .
Tenant: Appears only in a Managed Security tenant. Displays which tenant executed an API query or Cold Storage query.
Investigate the XQL API or Cold Storage query results.
In the Compute Units Usage table, locate an XQL API or Cold Storage query, right-click and select Show Results.
The query is displayed in the query field of the Query Builder where you can view the query results. For more information, see How to build XQL queries.