Category PSE-Cortex-Pro-24

Cortex Data Lake (often referred to as Strata Logging Service in some contexts) is Palo Alto Networks’ cloud- based storage solution that centralizes security data for products like Cortex XDR, Prisma Access, and NGFWs. The question involves a customer who has activated a TMS (Tenant Management Service) tenant but has not purchased a Cortex Data Lake instance. TMS is part of the Palo Alto Networks ecosystem for managing tenants and services, typically associated with Cortex or Prisma deployments. Let’s break this down to determine the size of the free Cortex Data Lake instance provided in this scenario.
Understanding TMS and Cortex Data Lake:
* TMS Tenant: The Tenant Management Service is a framework used to manage multiple tenants or instances within Palo Alto Networks’ cloud services (e.g., Cortex XDR, Prisma Access). Activating a TMS tenant implies the customer has initialized a management structure but hasn’t committed to a full Cortex Data Lake purchase.
* Free Cortex Data Lake Instance: Palo Alto Networks provides a limited, free tier of Cortex Data Lake storage to customers who activate certain services or products, allowing them to evaluate functionality or store minimal data before committing to a paid license.
Free Storage Allocation:
When a customer activates a TMS tenant without purchasing a Cortex Data Lake instance, Palo Alto Networks allocates a default free storage capacity to enable basic functionality. According to official documentation and standard practices:
* The free Cortex Data Lake instance provides 100 GB of storage.
* This amount is intended for initial use cases, such as storing logs from a small number of endpoints (e.
g., Cortex X## XDR Prevent agents), firewall logs, or trial data during evaluation periods.
Option Analysis:
* A. 10 GB:
* Analysis: 10 GB is too small to be a meaningful free tier for a product like Cortex Data Lake, which is designed to handle security telemetry from endpoints, networks, or cloud services. Even basic log storage for a few devices over a short period would exceed this quickly.
* Conclusion: Incorrect.
* B. 1 TB:
* Analysis: 1 TB (1,000 GB) is a substantial amount of storage, typically associated with paid Cortex Data Lake subscriptions rather than a free tier. Offering this much for free would undermine the paid licensing model.
* Conclusion: Incorrect.
* C. 10 TB:
* Analysis: 10 TB is even larger and aligns with enterprise-scale paid deployments, not a free instance. This size is far beyond what’s provided without a purchase.
* Conclusion: Incorrect.
* D. 100 GB:
* Analysis: 100 GB is the documented size of the free Cortex Data Lake instance provided to customers who activate a tenant (e.g., via TMS) without purchasing additional storage. It’s sufficient for small-scale testing, such as storing logs from a handful of Cortex XDR agents or firewall data for a limited retention period (e.g., 30 days).
* Conclusion: Correct.
Supporting Context:
* Cortex XDR Example: For Cortex XDR Prevent customers, activating a tenant includes 100 GB of free Cortex Data Lake storage for 30 days of alert data (not full telemetry, which requires XDR Pro).
This aligns with the TMS scenario, where basic tenant activation triggers the same free tier.
* Prisma Access: Similarly, Prisma Access customers activating a tenant without a purchased Data Lake instance receive 100 GB for initial log storage.
* Documentation: While exact wording may vary, Palo Alto Networks consistently references 100 GB as the free tier across product activation guides.
References:
Cortex Data Lake Getting Started Guide (Palo Alto Networks Documentation):
States that customers who activate a tenant without purchasing storage receive “100 GB of free storage” for initial use.
docs-cortex.paloaltonetworks.com/r/Cortex-Data-Lake/Cortex-Data-Lake-Getting-Started/Get-Started-with- Cortex-Data-Lake Cortex XDR Prevent Activation:
Notes that 100 GB is included for free with tenant activation, supporting basic alert storage.
Palo Alto Networks Sales and Licensing FAQs:
Confirms 100 GB as the standard free tier for Cortex Data Lake when no additional storage is purchased.

https://docs.paloaltonetworks.com/cortex/cortex-xdr/cortex-xdr-pro-admin/get-started-with-cortex-xdr-pro
/use-cortex-xdr/manage-tables.html

Cortex Xpanse uses continuous internet scanning to identify previously unknown assets. This feature allows the platform to continuously monitor the internet for new or unregistered assets that could be associated with an organization’s network, providing real-time visibility into potential exposure or vulnerabilities.

The Palo Alto Networks Status Page provides real-time information about the uptime and operational status of Cortex XSIAM. It can be used by customers to validate whether there are any ongoing service interruptions or issues affecting their access to the tenant.

The ASM for Remote Workers module in Cortex Xpanse focuses on analyzing global scan data, identifying risky issues on remote networks, and providing internal insights. This helps organizations maintain visibility and control over the security of their remote workforce, ensuring that potential risks and vulnerabilities in remote network configurations are addressed proactively.

The Data Ingestion Health page provides visibility into the normal patterns of log collection and highlights any deviations, which helps identify issues early on.
he Cortex XSIAM Command Center dashboard displays a red icon when there is an issue with a data source, providing a quick visual indication of ingestion problems.

A clear understanding of a customer’s technical expertise helps post-sales teams customize their support and training efforts to match the customer’s knowledge level. This ensures that the customer receives the appropriate guidance, training, and resources needed to effectively use the product or solution after the sale.

Cortex Xpanse provides visibility over remote workforce risks by identifying customer assets on residential networks. This allows organizations to monitor and secure assets that are outside of the traditional corporate network, which is particularly important as more employees work remotely and connect from various locations.

Reference: https://www.paloaltonetworks.com/cortex/cortex-xsoar/marketplace

The Live terminal capability in Cortex XDR allows the immediate termination of an anomalous process or the entire process tree during the investigation of a security event. This feature helps analysts take swift action to stop potentially malicious activity on the endpoint in real-time.