> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/multi-tenant/onboard-cortex-xsoar-multi-tenant/step-3.-allocate-incident-retention-licenses.md).

# Step 3. Allocate incident retention licenses

By default, each child tenant has 6 months of incident retention. The retention period is calculated from the date the incident was created in Cortex XSOAR. You can purchase incident retention licenses to extend the incident retention of one or more child tenants. These licenses, once purchased, are available for allocation to child tenants in Cortex Gateway.

Each incident retention license adds 1 month of incident retention. For example, a child tenant with a default of six months plus three incident retention licenses would have a total of nine months of incident retention.

{% hint style="info" %}
Once an incident retention license has been assigned to a child tenant, the license cannot be removed from the child tenant or assigned to another child tenant via the Cortex Gateway. If you need to remove or reassign an incident retention license, contact Customer Support.

If you delete a child tenant, any incident retention licenses assigned to that tenant are returned to the main account and can be reallocated.
{% endhint %}

To allocate licenses when you create a child tenant, follow the instructions when creating a tenant. For more information, see [Step 2. Create a child tenant](/cortex-xsoar-8-saas/multi-tenant/onboard-cortex-xsoar-multi-tenant/step-2.-create-a-child-tenant.md)

To allocate licenses to an existing child tenant:

1. Log into the Cortex Gateway.

   Under the main account, you can see the total number of incident retention licenses and the total number currently assigned to child tenants.
2. Hover over the child tenant until the three-dot menu appears. Open the menu and select **Manage Incident Retention Licenses**.
3. In the **Manage Incident Retention Licenses** window, assign one or more incident retention licenses to the child tenant. You cannot reduce the number of licenses already assigned.
4. Click the box to verify you understand that licenses cannot be removed or reallocated without contacting Customer Support.
5. **Save** your changes.

   To view the period for incident retention for a child tenant, go to **Settings & Info** → **Cortex XSOAR License**. This includes any retention add-ons you have purchased. For example, if you have purchased an additional 6 months of retention, you can see **12 Months of incidents retention (6 months default period + 6 months of paid licenses)**.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/multi-tenant/onboard-cortex-xsoar-multi-tenant/step-3.-allocate-incident-retention-licenses.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.