> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/data-security-documentation/get-started-with-cortex-data-security/understand-cortex-data-security-licenses/license-allocation.md).

# License allocation

Cortex Data Security capacity is metered across two independent dimensions: the assets you protect, measured in Workload units and provided by the base license, and the activity-log data you ingest, measured in GB/day and provided through the GB ingestion add-on. Depending on the security outcomes you want, you may need capacity in one or both. This article explains what each dimension covers, what the base license includes, and how Workload units are consumed.

## Capacity dimensions

* **Asset coverage (Workloads):** Provided by the base license. This pool is consumed by the storage buckets, databases, SaaS users, and other assets you protect for posture management and classification (DSPM, AI-SPM, and Identity Security).
* **Log ingestion (GB/day):** Provided exclusively by the GB ingestion add-on. The base workload license covers asset coverage only and does not include any bundled ingestion capacity. To collect and normalize activity logs—for example, to power real-time detection and behavioral analytics—you add GB/day capacity through the GB ingestion add-on.

| Dimension                                             | Metered by      | Included in the base license                                                                                |
| ----------------------------------------------------- | --------------- | ----------------------------------------------------------------------------------------------------------- |
| Asset coverage (posture, classification)              | Workload units  | Yes. Minimum 200 Workloads.                                                                                 |
| Log ingestion (activity-log collection and analytics) | GB/day ingested | Yes. 1 GB per 50 workloads. Additional GB can be added through the GB ingestion add-on, minimum 100 GB/day. |

## Workload consumption

The base license uses a flexible, workload-based model. Workload units are drawn from a shared, fungible pool. Assets of different categories consume from the same pool simultaneously. Note the following:

* **Active users:** SaaS user consumption is calculated based on the active users protected by Data Security policies, not the total number of users in your directory.
* **Discovery versus protection:** An asset may be discovered in your inventory without consuming a license. A license is consumed only when the asset is onboarded and actively scanned.
* **Compute assets:** Generic compute assets, such as virtual machines that are not disks or buckets, are excluded from workload metering.

If you exceed your purchased workload count, Cortex Data Security displays a notification in the management console. When a cloud workload, such as a disk or bucket, is deleted in the cloud service provider, its license is released following the next periodic scan.

{% hint style="info" %}
**Note:** Cortex Data Security has the following minimum purchase requirements:

* The standalone Cortex Data Security base license requires a minimum purchase of 200 Workloads.
* The GB ingestion add-on requires a minimum of 100 GB/day.
* Cortex Data Security requires Premium Support.
  {% endhint %}


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/data-security-documentation/get-started-with-cortex-data-security/understand-cortex-data-security-licenses/license-allocation.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.