Palo Alto Networks Certified Security Automation Engineer (PCSAE)Cortex XSOAR FundamentalsMedium
A security operations team is evaluating Cortex XSOAR and is concerned about the licensing model. They want to understand what dictates the primary cost factor for an XSOAR deployment. Which of the following is the main determinant of Cortex XSOAR licensing costs?
- ANumber of integrations deployed
- BAmount of data stored in the XSOAR database
- CNumber of active incidents processed per year
- DNumber of XSOAR Engines installed
Show answer & explanationAnswer & explanation
Correct answer: C. Number of active incidents processed per year
Cortex XSOAR's primary licensing model is based on the number of 'active' incidents processed within a given period (typically per year). This metric directly reflects the usage and value derived from the platform's automation capabilities.
Why the other options are wrong
- A. While integrations are crucial, they are generally included in the platform and do not directly dictate the core license cost.
- B. Data storage might have secondary cost implications (e.g., for cloud hosting) but is not the primary licensing driver for the XSOAR software itself.
- D. XSOAR Engines are typically licensed as part of the overall deployment, but their number is not the primary cost determinant compared to incident volume.
XSOAR Licensing Model
Cortex XSOAR's core licensing model is primarily based on the volume of active incidents processed by the platform within a defined period (e.g., annually).
- Incident volume directly correlates with platform usage and value.
- Licenses are tiered based on incident count.
- Other components like Engines might be included or have secondary considerations, but incidents are primary.
Memory trick: The more security fires you put out, the more it costs.