Cortex XSOAR Marketplace includes both free and premium (paid-for content) packs. When you purchase a premium pack, you subscribe to the pack on a monthly basis, or for a defined term length (via Private Offer ) by using points that you buy upfront and are available in your Cortex XSOAR account. When you subscribe to premium packs, you receive all content and updates for the pack on a regular basis.
Some premium packs only allow subscribing for a defined term length (with Private Offer), without the option to subscribe on a monthly basis. In this case, the Subscribe button is disabled. Refer to the pack’s details section for instructions on how to subscribe.
To install a premium pack you need access to the Marketplace and have sufficient points in your account. Premium packs come with a Trial Period.
Note
You can restrict who can install content when defining or editing a role. You can also restrict who can spend points in the Customer Support portal.
Trial Period
Premium packs come with a free 30-day trial period, during which you can evaluate the pack without commitment. After installing the premium pack, you see initially how many days remain for the trial, after which you see the date the trial ends.
When you initiate a trial, depending on the pack type, you will either have immediate access to the pack contents for installation or you will be sent an API key by the Tech partner.
After installing the premium pack you initially see how many days remain for the trial, after which you see the date the trial ends.
 |
If you want to continue using the premium pack after the trial period ends, you need to subscribe or request a Private Offer during the trial period.
Note
Some premium packs only allow subscribing for a defined term length (with Private Offer), without the option to subscribe on a monthly basis. In this case, the Subscribe button is disabled. Refer to the pack’s details section for instructions on how to subscribe.
If you do not subscribe during the trial period, the premium pack is deleted together with any customized content. You cannot take another trial period until 1 year has elapsed from the date the trial ends. If you initially subscribe but the premium pack is deleted (for example, you decide no longer to subscribe), you cannot take another trial until 6 months have elapsed from the date of deletion.
Subscription
When you subscribe to the premium pack during or after the trial period, you receive all content items and any updates. Payment is based on a Points Bank system. The Marketplace supports two subscription models:
Monthly: Points are deducted immediately from the account upon subscription and automatically renewed on the 1st of every month thereafter.
Term (available through Private Offer): Points are deducted upfront for the approved custom contract length.
To receive support for community-supported content packs, post a comment in the Cortex XSOAR Live Community.
Note
After installing a premium pack you cannot copy the playbook and view the integration and automation code.
Premium packs are automatically renewed every month. Once you subscribe to a premium pack, you can install on different environments. For example, if you have a test and production environment, you can install the premium pack on a test environment and when finished testing, install on a production environment.
Note
There are no refunds for subscribed premium packs.
Points Bank
You buy premium packs using points, which are purchased through your sales representative. Cortex XSOAR sends you a monthly report of all transactions. You can view your total points, monthly obligations, and when the next payment is due.
Tip
1 point = $100 USD.
 |
When subscribing to premium packs, note the following:
You need to have sufficient points in your account to subscribe to the pack on an ongoing basis. In other words, if installing a free content pack that depends on a premium pack, the cost includes the total sum of the free content pack and each dependent premium pack.
If you do not have enough points, you cannot subscribe to the premium pack. However if you are already a subscriber to the pack and do not have enough points for that month, you enter a Grace Period.
If there are insufficient points for all the subscribed packs, the system automatically renews the oldest subscriptions first. Premium packs that the system could not charge, go into the grace period.
Note
Points are connected to your Cortex XSOAR license. Points that are not used by the Cortex XSOAR license expiry date can be used for renewal.
Tip
Points purchased but not used after 5 years will automatically expire (unless prohibited by applicable law).
Grace Period
Premium packs are automatically renewed each month. If you do not have sufficient points to renew your subscription, the premium pack enters a two-month grace period, enabling you to buy more points before the pack is removed from your environment. During the grace period you receive warnings that the grace period is to expire, but no content is removed. In the Status field you see notification that you have insufficient funds.
 |
If you hover over the No sufficient funds field, you can see more details.
 |
When you buy more points, you need to pay for the grace period and the following month. In the following example, you can see the overdue payments and the monthly subscription.
 |
You can also view more details of the overdue payments when clicking view details:
 |
Note
When more points are added, any outstanding payment is taken automatically. If the premium pack was deleted and you want to subscribe again you need to pay any outstanding amount.
If after the grace period you do not have enough points to purchase the content pack, it is deleted together with any customizations, playbook, automations, etc.
 |
Subscription to Third-Party Services
Some of the premium packs provide a subscription to a third-party service (for example, intelligence feeds, SaaS products, etc.). Access is managed by third-party technology partners. In the Details tab of the pack, you can see whether the premium pack contains a third-party subscription.
How to Get Access
When you trial or subscribe to a premium pack that contains an API key, the Marketplace platform processes the transaction and notifies the Partner to generate access to complete the transaction.
Usually within 24 hours, the Partner will send API key information by email directly to you (detailed instructions are provided). The Partner may ask you to obtain the key via their system, portal, etc.
After receiving the API key, copy and paste the key into the integration configuration to allow the integration to function. You may need to paste this key into another content pack’s configuration (such as a Base or Core content pack). The premium pack will specify the relevant content pack and integration name.
Ongoing Access
You continue to have access to the third-party data or service for as long as you remain subscribed to the premium pack. If a Partner contacts you to update your key, please do so to ensure your access is active.
Payments for premium packs occur monthly, on the first day of the month. If you subscribed to a pack via Private Offer, payment is collected upfront and the pack remains active for the contracted term length. If you choose to delete or unsubscribe from the premium pack, access will be terminated at the end of the current calendar month.
Get Help
If you need help, have questions, or did not receive access, email soar.alliances@paloaltonetworks.com.
Content Pack Updates
Content packs are updated for bug fixes, enhancements, and so on. When there is an update available for a content pack, you will see notifications in several places in the Cortex XSOAR platform, including an icon over Marketplace in the main navigation panel and the Installed Content Packs tab in the Marketplace. You can also enable content pack update notifications.
The Marketplace is updated every 2 hours and when the server is restarted.
In the Release Notes tab of a content pack you can see the version history for the content pack, including the currently installed version, earlier versions, and available updates. You can always revert to a previous version of a content pack.
Note
Third party product Integrations are developed and tested against a specific product version. For products which are on-prem or cloud based with specific API versions, the version developed and tested against will be included in the integration's documentation. Newer versions of the product are not always immediately tested and it is expected that products maintain API compatibility upon release of newer product versions. When upgrading to a newer product version, it is highly recommended to test the integration in a dev environment before deploying to production.
Unsubscribe
You can unsubscribe from premium packs that you have subscribed to monthly, at any time, without obligation. If you unsubscribe, you can either delete the content pack immediately or unsubscribe and then wait until the end of the month when the content is deleted. For more information, see delete a content pack.
If you have subscribed to a premium pack through Private Offer, the pack remains active through the contracted term length. If you no longer want to use the pack, you can delete it at any time, but the terms of the private offer agreement will continue through the contracted term length.
Contributions
When you contribute to a content pack, you can provide it for free or set a point amount for subscribing. Payment is usually sent from Palo Alto Networks to the contributor every month.
Certification
Certified content packs are thoroughly reviewed by the Cortex XSOAR team and pass a rigid set of requirements that ensure quality and that the pack consists of a complete use case. All premium packs will be certified.