topic Re: Data Ingestion License Violation in Cortex XDR Discussions

Data Ingestion License Violation

jruck — Thu, 18 Apr 2024 18:37:01 GMT

After our Cortex XDR tenant was upgraded to 3.9 we started receiving the following error: "License Violation warning Based on a 7 day average calculation from February 24th 2024 to March 1st 2024, your daily ingestion quota is exceeded."

Looking at the Data Ingestion Dashboard it appears our NGFW data ingestion is reporting to has significantly increased since the upgrade. I checked the ACC monitor for Palo Alto Logging traffic on the firewall and it has not changed. The NGFW shows 500GB sent to Cortex Data Lake the last 7 days and the Cortex XDR Data Ingestion dashboard shows 3.87TB in the last 7 days.

I opened a case with support but wondering if anyone else has received this warning.

Re: Data Ingestion License Violation

aspatil — Tue, 05 Mar 2024 05:13:04 GMT

Hello @jruck ,

Thanks for reaching out on LiveCommunity!

Glad to know that you have already opened TAC case. Keeping the conversation open for others to share the same.

Regards.

Re: Data Ingestion License Violation

Catalin_Butiseaca — Tue, 05 Mar 2024 10:05:34 GMT

Hi @jruck

Let us know what is PA resolution in your case. We got the same warning few days ago.

Regards.

Re: Data Ingestion License Violation

micomi — Tue, 05 Mar 2024 13:25:20 GMT

We do have the same issue. TAC told me, that this is a known issue but I didn't get further information about a fix yet.

Re: Data Ingestion License Violation

aholdt — Wed, 06 Mar 2024 10:02:14 GMT

We are seeing the same issue. Did you get any response from support?

Re: Data Ingestion License Violation

micomi — Wed, 06 Mar 2024 14:49:34 GMT

I just got the information from TAC that there was an issue in some calculations. TAC also mentioned they solved this issue and from tomorrow the ingestion values should be normal again

Re: Data Ingestion License Violation

Catalin_Butiseaca — Wed, 06 Mar 2024 14:51:30 GMT

Hi All,

I can also confirm what @micomi said above, we received the same answer from PA. I already can see it normal for today.

Best.