License allocation

Cortex Data Security capacity is metered across two independent dimensions: the assets you protect, measured in Workload units and provided by the base license, and the activity-log data you ingest, measured in GB/day and provided through the GB ingestion add-on. Depending on the security outcomes you want, you may need capacity in one or both. This article explains what each dimension covers, what the base license includes, and how Workload units are consumed.

Capacity dimensions

• Asset coverage (Workloads): Provided by the base license. This pool is consumed by the storage buckets, databases, SaaS users, and other assets you protect for posture management and classification (DSPM, AI-SPM, and Identity Security).
• Log ingestion (GB/day): Provided exclusively by the GB ingestion add-on. The base workload license covers asset coverage only and does not include any bundled ingestion capacity. To collect and normalize activity logs—for example, to power real-time detection and behavioral analytics—you add GB/day capacity through the GB ingestion add-on.

Dimension	Metered by	Included in the base license
Asset coverage (posture, classification)	Workload units	Yes. Minimum 200 Workloads.
Log ingestion (activity-log collection and analytics)	GB/day ingested	Yes. 1 GB per 50 workloads. Additional GB can be added through the GB ingestion add-on, minimum 100 GB/day.

Workload consumption

The base license uses a flexible, workload-based model. Workload units are drawn from a shared, fungible pool. Assets of different categories consume from the same pool simultaneously. Note the following:

• Active users: SaaS user consumption is calculated based on the active users protected by Data Security policies, not the total number of users in your directory.
• Discovery versus protection: An asset may be discovered in your inventory without consuming a license. A license is consumed only when the asset is onboarded and actively scanned.
• Compute assets: Generic compute assets, such as virtual machines that are not disks or buckets, are excluded from workload metering.

If you exceed your purchased workload count, Cortex Data Security displays a notification in the management console. When a cloud workload, such as a disk or bucket, is deleted in the cloud service provider, its license is released following the next periodic scan.

Note: Cortex Data Security has the following minimum purchase requirements:

• The standalone Cortex Data Security base license requires a minimum purchase of 200 Workloads.
• The GB ingestion add-on requires a minimum of 100 GB/day.
• Cortex Data Security requires Premium Support.