Device Security connected to the wrong Cortex Data Lake

• CSP, Entitlements 
• Hub > Device Security Services
• Palo Alto Firewalls
   

1. When onboarding Device Security Security via magic link, Cortex Data Lake instance must be active in the account and firewalls must be able to forward logs to it.
2. The CDL which is meant to be linked to Device Security Services must be activated before starting onboarding the Device Security, with firewalls sending logs to it.

• • Onboard Device Security Security with already existing CDL > Activation email contains 1 Activate button and the correct CDL has to be chosen during the activation process.
  • Onboard Device Security Security with new CDL (if a new CDL and Device Security were purchased at the same time) > Activation email contains 2 Activate buttons.

What happens if Device Security is activated with the wrong CDL license and how to fix it?

1. Contact Support and Create a case with category admin. 
2. Support team will need to off-board the tenant and create a new activation link.
3. You will have to login to a different url after the fix.