> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/data-security-documentation/onboard-and-configure/plan-and-prepare.md). # Plan and prepare Before you get started with Cortex Data Security, consider the following deployment and data ingestion requirements to ensure a successful onboarding process. ### Deployment considerations * **Log Storage**: Determine the amount of log storage you need for your Cortex Data Security deployment. Talk to your partner or sales representative to determine whether you must purchase additional storage within the Cortex Data Security tenant. * **Region Selection**: Determine the region in which you want to host Cortex Data Security and any associated services, such as Directory Sync Service. If you plan to stream data from a Strata Logging Service instance, it must be in the same region as Cortex Data Security. For more information, see [Supported regions](/data-security-documentation/onboard-and-configure/deployment-checklist/activation/supported-regions.md). ### Data ingestion planning Cortex Data Security enables you to ingest data from a wide range of third-party vendors and security services. During the onboarding process, you should identify the data sources and connectors you plan to use to ensure comprehensive visibility and protection. Data sources and connectors typically fall into the following categories: * **Cloud Service Provider (CSP) onboarding**: Mandatory for initial onboarding to discover cloud assets and manage security posture. You must select and configure at least one CSP (AWS, Azure, GCP, or OCI) during the onboarding wizard. * **Database as a Service (DBaaS)**: Ingest data from managed database services such as Databricks, MongoDB Atlas, or Snowflake. * **Identity sources**: Connect to identity providers like Okta, OneLogin, or Ping Identity to correlate user activities with data access. * **On-Premise data collection**: Collect data from on-premise log sources that are not necessarily tied to a specific vendor, typically using the Broker VM and its data collector applets, such as DSPM Fileshare and DSPM Database. * **Data Security Threat Detection**: Ingest logs and events from various security vendors to enable advanced threat detection and response, such as Google Workspace, Box, Dropbox, or Slack. #### **Configuring data sources** Detailed configuration steps, vendor-specific requirements, and supported ingestion methods, such as connectors or standard data sources, are maintained in a centralized vendor catalog. Except for [CSP Onboarding](/data-security-documentation/onboard-and-configure/csp-onboarding.md) (which is integrated into the mandatory onboarding workflow), you should refer to the [Cortex Data Security Data Sources and Connectors](/data-security-documentation/cortex-data-security-data-sources-and-connectors/what-are-cortex-data-security-data-sources-and-connectors.md) chapter for technical instructions on how to ingest data from specific third-party products. For a list of the entire vendor catalog, see the topics under [Vendor-specific data sources and connectors](/data-security-documentation/cortex-data-security-data-sources-and-connectors/vendor-specific-data-sources-and-connectors.md). ### Cloud scan planning If you plan to onboard cloud accounts, decide on a scan mode before you start: * **Cloud Scan (Recommended)**: Runs scanning in the Palo Alto Networks-managed environment with no additional setup or compute cost. * **Outpost Scan**: Runs scanning on infrastructure you host for data-residency or compliance requirements and requires additional cloud provider permissions and resources. For a comparison of the two modes and guidance on when to choose Outpost Scan, see [Outpost fundamentals and planning](/data-security-documentation/onboard-and-configure/csp-onboarding/outpost-onboarding/outpost-fundamentals-and-planning.md). --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://cortex-docs.paloaltonetworks.com/data-security-documentation/onboard-and-configure/plan-and-prepare.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.