Understand Cortex AgentiX licenses

The Cortex AgentiX license is downloaded from Cortex Gateway and determines which components users can use and how many users can access the tenant.

Cortex AgentiX requires a yearly license per user. Multi-year licenses are available.

License usage

This table describes the types of Cortex AgentiX licenses which are used in the following circumstances:

Version	Usage	Description
Cortex AgentiX Enterprise	Built for customers who need a complete security automation solution, including threat intel management.	Cortex AgentiX SOAR with threat intel includes 4 users, six months of hot storage for incidents, and 800 compute units per year.
Cortex AgentiX Base	Built for security operations and incident response customers who need case management with collaboration and playbook-driven automation.	Cortex AgentiX SOAR includes 2 users, six months of hot storage for incidents, and 400 compute units per year.

Development/Production tenants

In Cortex AgentiX you can use a content management system with a remote repository to develop and test content. If you want a development tenant, you need a development tenant license. The development tenant license allows many users to build, test, and refine automations. It is not limited to your purchased user licenses, and it enables multiple stakeholders to work on these tasks. This supports faster innovation, more reliable workflows, and scalable solutions as your organization grows.

License quota

The following table describes the license quotas of each version in Cortex AgentiX.

	Cortex AgentiX Base	Cortex AgentiX Enterprise
Users	Two users, additional users can be added	Four users, additional users can be added
Compute units	400 compute units per year*	800 compute units per year*
Integrations	Unlimited	Unlimited
Incident Management	180-day history*	180-day history*
Incident Triggered Automations	Unlimited	Unlimited
Job Triggered Automations	Unlimited	Unlimited
Intel Feeds	5 active feeds, 100 indicators/fetch	Unlimited
Threat Intel Library	Intelligence detail view and relationship data are not included	Unlimited

Note

**You can purchase additional compute units.

*You can extend incident retention by purchasing an add-on. For more information, see Data retention policy.

Intel feed quotas are based on the selected Fetches Indicators field in the integration instance settings, not the enabled status. Disabling an integration instance does not affect the intel feed quota. For example, if the AWS Feed is enabled and is fetching indicators and you don't want to include this in your quota, open the integration settings and clear the Fetches Indicators checkbox.

Cortex AgentiX users

Cortex AgentiX has the following users:

Audit user

Audit users have read-only permission in Cortex AgentiX, meaning they cannot edit system components and data or run commands, scripts, and playbooks. Audit users can view incidents, dashboards, and reports.

Full user

Full users have read-write permission in Cortex AgentiX, meaning they can view and edit system components and data. They can investigate incidents, run scripts and playbooks, chat in the War Room, and more. Full users’ access to Cortex AgentiX is determined by their assigned role.