Data Ingestion License Violation

[jruck]

After our Cortex XDR tenant was upgraded to 3.9 we started receiving the following error: "License Violation warning Based on a 7 day average calculation from February 24th 2024 to March 1st 2024, your daily ingestion quota is exceeded."

Looking at the Data Ingestion Dashboard it appears our NGFW data ingestion is reporting to has significantly increased since the upgrade. I checked the ACC monitor for Palo Alto Logging traffic on the firewall and it has not changed. The NGFW shows 500GB sent to Cortex Data Lake the last 7 days and the Cortex XDR Data Ingestion dashboard shows 3.87TB in the last 7 days.

I opened a case with support but wondering if anyone else has received this warning.

[aspatil]

Hello @jruck ,

Thanks for reaching out on LiveCommunity!

Glad to know that you have already opened TAC case. Keeping the conversation open for others to share the same.

Regards.

[Catalin_Butiseaca]

Hi @jruck 

Let us know what is PA resolution in your case. We got the same warning few days ago.

Regards.

[micomi]

We do have the same issue. TAC told me, that this is a known issue but I didn't get further information about a fix yet.

[aholdt]

We are seeing the same issue. Did you get any response from support?

[micomi]

I just got the information from TAC that there was an issue in some calculations. TAC also mentioned they solved this issue and from tomorrow the ingestion values should be normal again

[Catalin_Butiseaca]

Hi All, 

I can also confirm what @micomi said above, we received the same answer from PA. I already can see it normal for today.

Best.