Cortex XSIAM license tiers and product licenses

Compare Cortex XSIAM license tiers and product licenses: NG-SIEM, Enterprise, Premium, included capabilities, and add-ons.

Cortex XSIAM product licenses are available in NG-SIEM, Enterprise, and Premium subscription tiers. Compare each Cortex XSIAM license tier, its included capabilities, and available security add-ons to select the subscription for your security use case.

You can upgrade your license by purchasing add-ons or moving to a different XSIAM license.

Compare Cortex XSIAM license tiers

• NG-SIEM provides analytics, data collection, detection, and security automation.
• Enterprise adds Cortex XDR agent coverage and extended endpoint visibility.
• Premium adds cloud posture security, cloud runtime security, and threat intelligence capabilities.

Cortex XSIAM NG-SIEM license

Cortex XSIAM NG-SIEM is an analytics subscription tier that includes data collection and full automation, suitable for users who want to enhance their security without immediately replacing their existing SIEM and endpoint solutions.

Key features include:

Feature	Description
AI and Big Data	Integrates data analytics, AI/ML, and automation into a unified platform.
Comprehensive Data Collection	Offers extensive cloud data collection with out-of-the-box analytics, detection, and cloud asset discovery.
Advanced Analytics	Provides capabilities for threat hunting, analysis, response, and automation.
User and Entity Behavior Analytics (UEBA)	Uses machine learning to profile users and entities, alerting on anomalous behavior that could indicate a compromised account or insider threat

Cortex XSIAM Enterprise license

Cortex XSIAM Enterprise includes all the features of Cortex XSIAM NG-SIEM and builds upon them by adding advanced endpoint visibility and data collection:

Key additions include:

Feature	Description
Cortex XDR agent	Entitles you to one Cortex XDR agent per endpoint, which provides tailored endpoint data and third-party logs collection to optimize detection and investigation visibility.
Extended Detection and Response (XDR)	Incorporates extended data collection and ingestion of endpoint logs and alerts, firewalls, and third-party audit and flow logs through Host Insights and Extended Threat Hunting Data.

Cortex XSIAM Premium license

Cortex XSIAM Premium is the most comprehensive tier, providing the highest level of security by combining all Enterprise features together with the following capabilities:

Feature	Details
Cloud Posture Security	Delivers comprehensive visibility and continuous monitoring of cloud environments to ensure configurations meet security best practices, compliance standards, and vulnerability management. This bundle includes the following advanced modules: Cloud Security Posture Management (CSPM): Continuously scans your cloud environment (AWS, Azure, GCP) to detect misconfigurations, compliance violations, and drift from secure baselines. Cloud Infrastructure Entitlement Management (CIEM): Enforces least-privilege access to cloud infrastructure. It protects and manages access to resources by analyzing identity misconfigurations, reducing excessive permissions, and providing real-time monitoring of identity anomalies. AI Security Posture Management (AI-SPM): Secures AI-powered applications and models against misuse and vulnerabilities. Data Security Posture Management (DSPM): Discovers, classifies, and secures sensitive data across your cloud environment. Agentless Workload Scanning: Scans cloud workloads for vulnerabilities, malware, and exposed secrets without requiring an agent installation. Application Security Posture Management (ASPM): Provides a consolidated view of application risks and vulnerabilities across your environment, enabling you to understand and manage your overall security posture. Full code security scanning requires a separate add-on. CI/CD: Focuses on securing your continuous integration and continuous delivery pipelines, ensuring the integrity and security of your automated build and deployment processes
Cloud Runtime Security	Prevents attackers from exploiting risks present in your cloud environment. Provides real-time protection, detection, and response for cloud workloads, crucial for applications, containers, serverless functions, and APIs. Includes Cloud Workload Rules: Cloud Workload Rules define the criteria for identifying security violations. This criteria can be applied to assets in your cloud environment and to findings generated by Cortex XSIAM. Cloud Workload Policies: Cloud Workload Policies help you prevent and manage security violations in your cloud runtime instances. Web and API Security: Cortex Web and API Security (WAAS) capabilities offer comprehensive protection of APIs across integrated API gateways and web-based applications and APIs running on Linux-based workloads. Cortex XSIAM Premium users can install an XDR agent on endpoints and on any host or cloud workload, including Kubernetes hosts, based on the user's per-unit subscription parameters and workload demands. The XDR agent offers cloud-based endpoint protection and detection support, along with tailored endpoint and third-party log data collection. For more information about the license relationship between the XDR agent on endpoints and the XDR agent on host or cloud workloads, and how the licenses are allocated, see License allocation.
Extended Threat Intelligence (XTI)	Provides operationalized Threat Intelligence (TI) seamlessly integrated across the Cortex platform.
Threat Intel Management	Investigates indicators and files, applies indicator rules, generates reports, and integrates feed integrations.
Attack Surface Management	Provides internet-facing assets and ASM enrichment, external services, external IP ranges, attack surface rules and alerts, ASM widgets, and report capabilities.

Existing users with a Cortex XSIAM Enterprise Plus license retain all Cortex XSIAM Enterprise features, including cloud agent features. You can deploy agents for runtime detection on cloud sources, such as Kubernetes nodes, OpenShift clusters, or cloud VMs, whether in the cloud or on-premises. If you want the full cloud posture security bundle (Cloud Posture Security or Cloud Runtime Security), you need to upgrade to Cortex XSIAM Premium.

Some add-ons, such as Advanced Email Security and Exposure Management, are available with Cortex XSIAM Premium, Enterprise, and NG-SIEM licenses.

License capabilities and add-ons

Cortex offers a modular set of license packages that work interchangeably, allowing them to serve as add-ons to subsequent products seamlessly. The table below shows the breakdown of each type of license package:

Feature	Description	Cortex XSIAM NG SIEM	Cortex XSIAM Enterprise	Cortex XSIAM Premium
Core Analytics	Detects anomalies and threats using machine learning and behavioral models.	Included in license	Included in license	Included in license
Automation	Orchestrates and automates security workflows with prebuilt and customizable playbooks.	Included in license	Included in license	Included in license
Data Ingestion	Analytics tier: Collects and normalizes data, creating a unified foundation for analytics, investigation, and detection. GB/day-based, with a minimum of 100 GB/day. Cortex Data Lake tier: Provides cost-efficient ingestion and storage of security data at scale for use cases such as threat hunting, forensic investigations, and compliance audits. This tier is available as an optional add-on with a minimum of 50 GB/day, provided the mandatory 100 GB/day Analytics tier license is already met. For more information, see Configure Cortex Data Lake tier.	Included in license	Included in license	Included in license
Enterprise Runtime Security (XDR)	Comprehensive endpoint and server protection by combining AI-driven analytics, endpoint controls, next-generation antivirus, and automated investigation to detect and respond to threats across various environments.	Add-on	Included in license	Included in license
Cloud Posture Security	Agentless comprehensive visibility across your cloud environment. Includes: Up to 400 workloads, dependent on the license plan Cloud Security Posture Management (CSPM) Cloud Infrastructure Entitlement Management (CIEM) Data Security Posture Management (DSPM) AI Security Posture Management (AI-SPM) Continuous Integration/Continuous Deployment (CI/CD) For Cortex XSIAM Enterprise and NG SIEM, if purchasing Cloud Posture Security only, a minimum number of workloads is required. If you purchase Cloud Runtime Security or Cortex XSIAM Premium, this add-on is included with the subscription.	Add-on	Add-on	Included with Cloud Runtime Security
Cloud Runtime Security	Full cloud protection, detection, and response. In addition to Cloud Posture Security: For Cortex XSIAM Premium: Minimum 200 workloads (priced per workload). Cloud Detection and Response (CDR) Cloud Workload Protection (CWP) Web Application and API Security (WAAS) For all Cortex XSIAM licenses, a minimum number of workloads is required.	Add-on	Add-on	Included in license
Application Security	Comprehensive protection for your software development lifecycle (SDLC) from code-to-cloud, offering visibility, detection, contextual analysis, prioritization, prevention, and remediation. To access the Application Security module, you must have a Cloud Posture Security, Cloud Runtime Security, or Cortex XSIAM Premium license. These licenses include Application Security Posture Management (ASPM) and CI/CD Security. Add-on component: Code Security Code Security requires a separate Application Security add-on as well as a Cloud Posture Security, Cloud Runtime Security, or Cortex XSIAM Premium license.	Add-on	Add-on	Add-on
Extended Threat Intelligence (XTI)	Provides operationalized Threat Intelligence (TI) seamlessly integrated across the Cortex platform	Add-on	Add-on	Included in license
Threat Intelligence Management	Investigates indicators and files, uses indicator rules, reports, and feed integrations.	Add-on	Add-on	Included in license
Attack Surface Management	Provides internet-facing assets and ASM enrichment, external services, external IP ranges, attack surface rules and alerts, ASM widgets, and report capabilities.	Add-on	Add-on	Included in license
Identity Threat Detection & Response	Enables asset role configuration, advanced analytics alert layout, Risk Management dashboard, User/Host Risk view, designated analytics for compromised accounts, and insider threat coverage. This solution helps organizations proactively secure identities, accelerate threat response, and reduce the complexity of security operations.	Add-on	Add-on	Add-on
Forensics	Detect attacker activity by reviewing key artifacts such as event logs, registry keys, browser history, etc. Forensics simplifies investigations so you can trace every move an adversary made and swiftly contain threats from one place without needing to pivot between security tools.	Add-on	Add-on	Add-on
Host Insights	Host Insights combines Vulnerability Management, Host Inventory, and a powerful Search and Destroy feature to help you identify and contain threats. It offers a holistic approach to endpoint visibility and attack containment, helping reduce your exposure to threats so you can avoid future breaches.	Add-on	Included in license	Included in license
Extended Threat Hunting	Investigates everyday activities in real time and analyzes patterns to discover new threats, aiming to proactively minimize risk for an organization.	Add-on	Included in license	Included in license
Data Retention	Retention per dataset ensures extended access to data, strengthening threat investigation, compliance, and long-term visibility.	Add-on	Add-on	Add-on
Extended Compute Units	Additional computing resources beyond the annual allocation. You can purchase more units or enable dynamic allocation for flexible access. This ensures uninterrupted service, supports scaling during peak workloads, and optimizes resource management to maintain performance during high-demand periods.	Add-on	Add-on	Add-on
Endpoint Event Forwarding	Enables exporting the raw telemetry collected by XDR Agents and event data from cloud endpoints to external systems (if relevant).	Add-on	Add-on	Add-on
GB Event Forwarding	Enables exporting parsed logs to an external SIEM for storage, so you can keep data in your own storage in addition to the Cortex XSIAMdata layer, for compliance requirements and machine learning purposes.	Add-on	Add-on	Add-on
Advanced Email Security	Investigate and respond to threats within modern, distributed email infrastructures. The module is a scalable, API-based solution that passively analyzes cloud-hosted email environments to detect threats. It ingests data from messages, attachments, and user identities to identify early-stage threats and high-risk behaviors without requiring any changes to mail flow.	Add-on	Add-on	Add-on
Exposure Management	Gain comprehensive visibility, actionable prioritization, and automation-first remediation to help security teams proactively assess and respond to organizational exposures.	Add-on	Add-on	Add-on
DLP (Data Loss Prevention)	The Cortex Data Loss Prevention (DLP) module provides a unified and flexible solution to prevent sensitive data exfiltration. It continuously enforces policies on endpoints (even offline) across web, local, and USB channels, protecting both on-premise and cloud environments.	Add-on	Add-on	Add-on

Tiers and key capabilities