Configuring Cortex Data Lake

The last step is to make sure CDL storage is distributed across the different log types. By default, the total log space is unassigned, so no logs will be collected until a certain number of logs have been assigned to each type of log you are interested in. Access CDL directly via https://logging-service.apps.paloaltonetworks.com/storage/status?instance=<instancename> if you know the instance name, or go to apps.paloaltonetworks.com and click the Cortex Data Lake tile.

As shown in the following screenshot, access the Configuration menu and set storage quotas (in %) for the log types that are of interest. Any log types that are left empty will not receive quotas:

Figure 4.38 – Assigning log storage to log types

Once storage has been assigned, logs can be viewed in the Explore section. If some troubleshooting needs to be done, the Prisma system logs can be accessed through the Explore menu as well.