> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/data-security-documentation/get-started-with-cortex-data-security/understand-cortex-data-security-licenses/license-allocation.md).

# License allocation

Cortex Data Security capacity is metered across two independent dimensions: the assets you protect, measured in Workload units and provided by the base license, and the activity-log data you ingest, measured in GB/day and provided through the GB ingestion add-on. Depending on the security outcomes you want, you may need capacity in one or both. This article explains what each dimension covers, what the base license includes, and how Workload units are consumed.

## Capacity dimensions

* **Asset coverage (Workloads):** Provided by the base license. This pool is consumed by the storage buckets, databases, SaaS users, and other assets you protect for posture management and classification (DSPM, AI-SPM, and Identity Security).
* **Log ingestion (GB/day):** Provided exclusively by the GB ingestion add-on. The base workload license covers asset coverage only and does not include any bundled ingestion capacity. To collect and normalize activity logs—for example, to power real-time detection and behavioral analytics—you add GB/day capacity through the GB ingestion add-on.

| Dimension                                             | Metered by      | Included in the base license                                                                                |
| ----------------------------------------------------- | --------------- | ----------------------------------------------------------------------------------------------------------- |
| Asset coverage (posture, classification)              | Workload units  | Yes. Minimum 200 Workloads.                                                                                 |
| Log ingestion (activity-log collection and analytics) | GB/day ingested | Yes. 1 GB per 50 workloads. Additional GB can be added through the GB ingestion add-on, minimum 100 GB/day. |

## Workload consumption

The base license uses a flexible, workload-based model. Workload units are drawn from a shared, fungible pool. Assets of different categories consume from the same pool simultaneously. Note the following:

* **Active users:** SaaS user consumption is calculated based on the active users protected by Data Security policies, not the total number of users in your directory.
* **Discovery versus protection:** An asset may be discovered in your inventory without consuming a license. A license is consumed only when the asset is onboarded and actively scanned.
* **Compute assets:** Generic compute assets, such as virtual machines that are not disks or buckets, are excluded from workload metering.

If you exceed your purchased workload count, Cortex Data Security displays a notification in the management console. When a cloud workload, such as a disk or bucket, is deleted in the cloud service provider, its license is released following the next periodic scan.

{% hint style="info" %}
**Note:** Cortex Data Security has the following minimum purchase requirements:

* The standalone Cortex Data Security base license requires a minimum purchase of 200 Workloads.
* The GB ingestion add-on requires a minimum of 100 GB/day.
* Cortex Data Security requires Premium Support.
  {% endhint %}


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://cortex-docs.paloaltonetworks.com/data-security-documentation/get-started-with-cortex-data-security/understand-cortex-data-security-licenses/license-allocation.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.