> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/investigate-and-respond-to-threats/threat-intel-management/get-started-with-threat-intel-management/licenses.md).

# Licenses

Cortex XSOAR requires a yearly license per user. Multi-year licenses are available.

**License usage**

This table describes the types of Cortex XSOAR licenses which are used in the following circumstances:

| Version                                      | Usage                                                                                                                                     | License                                                   |
| -------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------- |
| Cortex XSOAR (Enterprise) Edition            | Built for customers who need a complete security automation solution.                                                                     | Includes the SOAR Enterprise and TIM Enterprise licenses. |
| Cortex XSOAR Threat Intel Management Edition | Built for Threat Intelligence and Security Operations teams who need threat intelligence-based automation.                                | Includes the TIM Enterprise license only.                 |
| Cortex XSOAR Starter Edition                 | Built for Security Operations and Incident Response customers who need case management with collaboration and playbook-driven automation. | Includes the SOAR Enterprise license only.                |

**License quota**

The following table describes the license quotas of each version in Cortex XSOAR.

|                                | XSOAR TIM (TIM only)                   | XSOAR Starter Edition (SOAR only)                               | XSOAR (SOAR + TIM)                     |
| ------------------------------ | -------------------------------------- | --------------------------------------------------------------- | -------------------------------------- |
| Integrations                   | Unlimited                              | Unlimited                                                       | Unlimited                              |
| Incident Management            | 30-day history                         | Unlimited                                                       | Unlimited                              |
| Incident Triggered Automations | 166 daily                              | Unlimited                                                       | Unlimited                              |
| Job Triggered Automations      | Unlimited                              | Unlimited                                                       | Unlimited                              |
| Intel Feeds                    | Unlimited                              | 5 active feeds, 100 indicators/fetch                            | Unlimited                              |
| Threat Intel Library           | Unlimited                              | Intelligence detail view and relationship data are not included | Unlimited                              |
| Unit 42 Intelligence           | Unlimited UI access, 5k/day API points | Not included                                                    | Unlimited UI access, 5k/day API points |

{% hint style="info" %}

### Note

Intel feed quotas are based on the selected **Fetches Indicators** field in the integration instance settings, not the enabled status. Disabling an integration instance does not affect the Intel feed quota. For example, if the AWS Feed is enabled and is fetching indicators and you don't want to include this in your quota, open the integration settings and clear the \*\*Fetches Indicators \*\*checkbox.
{% endhint %}


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/investigate-and-respond-to-threats/threat-intel-management/get-started-with-threat-intel-management/licenses.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.