> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.7/learn-about-cortex-xsoar/get-started-with-cortex-xsoar/understand-cortex-xsoar-licenses.md). # Understand Cortex XSOAR licenses Learn about licensing in Cortex XSOAR On-prem 8.7 (EoL). Cortex XSOAR requires a yearly license per user. Multi-year licenses are available. #### License usage This table describes the types of Cortex XSOAR licenses which are used in the following circumstances: | Version | Usage | License | | -------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------- | | Cortex XSOAR (Enterprise) Edition | Built for customers who need a complete security automation solution. | Includes the SOAR Enterprise and TIM Enterprise licenses. | | Cortex XSOAR Threat Intel Management Edition | Built for Threat Intelligence and Security Operations teams who need threat intelligence-based automation. | Includes the TIM Enterprise license only. | | Cortex XSOAR Starter Edition | Built for Security Operations and Incident Response customers who need case management with collaboration and playbook-driven automation. | Includes the SOAR Enterprise license only. | **Multi-Tenant** Cortex XSOAR Enterprise, Threat Intel Management, and the Starter editions are all available for multi-tenant deployments, with a multi-tenant license. Cortex XSOAR multi-tenant deployments are designed for MSSPs (managed security service providers) and enterprises that require strict data segregation but also need the flexibility to share and manage critical security practices across tenant accounts. The multi-tenant license (for example PAN-DEMISTO-MSSP) includes a main tenant. You can install as many child tenants as required using the installer. **Development/Production tenants** In Cortex XSOAR you can use a content management system with a remote repository to develop and test content. If you want a development tenant, you need to download the installer and add the development tenant license after installation. #### License quota The following table describes the license quotas of each version in Cortex XSOAR.
XSOAR TIM (TIM only)XSOAR Starter Edition (SOAR only)XSOAR (SOAR + TIM)
IntegrationsUnlimitedUnlimitedUnlimited
Incident Management30-day historyUnlimitedUnlimited
Incident Triggered Automations166 dailyUnlimitedUnlimited
Job Triggered AutomationsUnlimitedUnlimitedUnlimited
Intel FeedsUnlimited5 active feeds, 100 indicators/fetchUnlimited
Threat Intel LibraryUnlimitedIntelligence detail view and relationship data are not includedUnlimited
Unit 42 IntelligenceUnlimited UI access, 5k/day API pointsNot includedUnlimited UI access, 5k/day API points
{% hint style="info" %} ### Note Intel feed quotas are based on the selected **Fetches Indicators** field in the integration instance settings, not the enabled status. Disabling an integration instance does not affect the Intel feed quota. For example, if the AWS Feed is enabled and is fetching indicators and you don't want to include this in your quota, open the integration settings and clear the \*\*Fetches Indicators \*\*checkbox. {% endhint %} #### Cortex XSOAR users Cortex XSOAR has audit users and full users. **Audit user** Audit users have read-only permission in Cortex XSOAR, meaning they cannot edit system components and data, or run commands, scripts, and playbooks. Audit users can view incidents, dashboards, and reports. **Full user** Full users have read-write permission in Cortex XSOAR, meaning they can view and edit system components and data. They can investigate incidents, run scripts and playbooks, chat in the War Room, and more. Full users’ access to Cortex XSOAR is determined by their assigned role. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.7/learn-about-cortex-xsoar/get-started-with-cortex-xsoar/understand-cortex-xsoar-licenses.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.