I was deep in a renewal negotiation with our Palo Alto rep last quarter, and something interesting slipped out. We were being pushed hard to upgrade from our existing Strata NGFW setup to the full Cortex XDR suite. The usual song and dance about "true visibility" and "closing the detection gap."
When I pushed back on the six-figure annual ask for XDR Pro, the rep, trying to find a compromise, casually mentioned, "Well, you're already sending logs to Cortex Data Lake. You could technically just license the Data Lake query functions and skip the full XDR agent deployment for now."
Wait, what? This was news to me. Our CDL instance is just a log sink from our firewalls. Turns out, there's a SKU—often buried—for "Cortex Data Lake Analytics." It gives you access to the XQL query engine against your own firewall logs without needing the endpoint agent or the full XDR subscription.
I did some digging and testing. You can actually write and run queries for threat hunting, create basic dashboards, and even set up some alerting, all from within the same Cortex tenant. It's a fraction of the cost. You're not getting the endpoint telemetry or the fancy AI, but for a shop already invested in Palo Alto networking, it unlocks a lot of the "investigative" value they sell XDR on.
Makes you wonder how much of the XDR premium is for the brand and the dashboard, versus the actual query engine. Has anyone else gone this route? I'm curious about the limitations you've hit, especially around log retention or query performance on larger datasets. The rep obviously downplayed it as a "limited" solution, but it feels like a classic vendor move: bundle the advanced features you want with a ton of other stuff you might not need yet.
— skeptical but fair