Share your experience using Threat Stack Oversight [EOL]

Our usual use cases for Palo Alto Networks Cortex XSOAR are basically security automation, where we write our different rules based on different security issues like intrusions, misuse, account takeover, and account management, such as identity and access management. Based on these events, we write the signatures in Python code for these particular events by connecting to upstream and downstream systems.

We use automation to create dashboards for security operations and link these dashboards to automations, which will have standard operating procedures linked for each use case, deployable at the discretion of the security analyst. This is mainly how we use Palo Alto Networks Cortex XSOAR.

The integration capabilities of Palo Alto Networks Cortex XSOAR with third-party tools enhance our security strategy as it works with 80% of the tools we have. Being a Palo shop, we have numerous Palo products like Palo Firewall, Palo CASB, and Palo Autofocus, in addition to regular third-party automations like ServiceNow. The integration is very good, especially with the addition of AI features that require little to no programming.

Before using Palo Alto Networks Cortex XSOAR, we did not have a single tool but used different custom-written tools, as we lacked a comprehensive solution. Previously, we wrote integrations on top of SIEM tools or other incident management tools such as ServiceNow automations. However, once we adopted Cortex XSOAR, we migrated all our workflows to it.

The most valuable features of Palo Alto Networks Cortex XSOAR, especially since we are leveraging it for automation, are the Playbooks feature, followed by the command and control screen feature that allows us to aggregate multiple dashboards and create custom dashboards based on different scenarios.

Regarding Playbook automation, I find it has helped streamline our incident response workflows significantly. Previously, manual incident reviews and actions took up a lot of time. Without dashboards and single pane of glass access, the security analyst had to handle multiple data sources, incident sources, and SOP documents, leading to more manual effort and increased potential for errors. All actions required manual tracking of logs and reviews to management. With Palo Alto Networks Cortex XSOAR Playbooks, we utilize standard inbuilt automations from Palo and can create our custom automations. We integrate multiple inbuilt playbooks and write our custom playbooks for incident management, taking inputs from incident sources such as SIEM and threat intelligence, aggregating them into dashboards, and enabling relevant automations for necessary changes, logging, or actions.

The machine learning models in Palo Alto Networks Cortex XSOAR help prioritize alerts in our organization, proving to be very important as they aid our incident processing. Given that many incidents require discretion from analysts due to their relevance to our business, the ML workflows eliminate a lot of false positives.

Palo Alto Networks Cortex XSOAR analytics features significantly impact our ability to gain insights and visibility into security, which is crucial for communicating with management. Management has different preferences for seeing the most frequent threats or identifying which particular systems are targeted by threat actors, making these analytics very useful.

I think the areas of Palo Alto Networks Cortex XSOAR that could be improved are mainly in UX. We have communicated with the vendor team about this, but they are prioritizing product functionality over usability because most target customers are technical and understand a primitive UI. They face difficulties in implementing UI changes as their team is stretched. Thus, the UI/UX of the tool needs significant improvement. There are plans on their roadmap, but a lot remains to be done. Parts of the tool run on an older framework, causing slowness. Usability is a broader issue than features alone. This usability problem is common in many cybersecurity tools, unlike customer-facing applications.

Some integrations have speed issues and might not function seamlessly with different upstream configurations, requiring manual updates. These are the main pain points we encountered, particularly with UI/UX, integration speed, and the usability of certain inbuilt playbooks.

I have been working with Palo Alto Networks Cortex XSOAR since 2022, so it has been three years.

I would rate the stability and reliability of Palo Alto Networks Cortex XSOAR as a nine. Occasionally, we have had rare issues with few plugins that led to high stack usage, requiring shutdown and restart. Generally, it is highly available nine out of ten times.

I would rate Palo Alto Networks Cortex XSOAR's scalability as an eight. It is highly scalable, but we do encounter some issues here and there.

The issues with scalability arise from the speed of some integrations, as not all are perfectly tuned by Palo; some were released without complete testing. Overall, most platform requirements are met with high scalability capabilities.

I often communicate with the technical support team of Palo Alto Networks.

My experience with Palo Alto Networks technical support has been quite satisfactory, rating it an eight. Eight out of ten times, they provide valuable help. However, in two instances, I encountered service associates who were not very knowledgeable or where the tasks were complex, leading to escalations. Even then, they were timely in their responses.

Positive

Before selecting Palo Alto Networks Cortex XSOAR, our organization was using Demisto, which made it logical to transition to Cortex XSOAR. We did evaluate Splunk, but we decided that Palo Alto Networks Cortex XSOAR was the better option.

While evaluating options, Splunk lacked the number of playbook integrations that Palo Alto Networks Cortex XSOAR offered. Although I hear Splunk has improved since then, being a Palo shop provided additional advantages, including a favorable bundle discount, as everything from our CASB to cloud monitoring and firewalls is with Palo, creating a tight dependency.

The initial setup process for Palo Alto Networks Cortex XSOAR involved having the necessary infrastructure suggested by Palo, spinning up the servers, establishing dependencies, ensuring proper network segmentation, and setting up the right monitoring appliances and connections. Once the setup was complete, we moved all dependencies, basic necessary automations, and basic dashboards into the system, which comprised the beginning work.

Overall, the process has been far from straightforward.

I have faced several challenges during installation where the necessary servers require varying amounts of RAM and specific network segmentation. These requirements are not straightforward, and I realized many issues post-installation. While they advise installing a VM, the actual installation process reveals that debugging is often necessary, making it less seamless and not functional right out of the box.

I participated in the initial setup and deployment of Palo Alto Networks Cortex XSOAR.

Palo Alto Networks Cortex XSOAR has had a huge impact on our organization's mean time to resolution for incidents. As I previously described, instead of going through the entire manual process, it improves the security SOC operations efficiency tremendously, by more than 80% to 90%. I would rate this solution a nine overall.

My primary use cases for Palo Alto Networks Cortex XSOAR are malware incidents, specifically phishing-related incidents, Trojan horses, spyware, and similar threats.

The automation and marketplace features of Palo Alto Networks Cortex XSOAR are what I appreciate most. These features provide flexibility to integrate different threat intelligence feeds and playbooks, and they are enjoyable to create.

Palo Alto Networks Cortex XSOAR has had a positive impact on the mean time to resolution for incidents (MTTR), as it has significantly reduced noise. For instance, I have created custom playbooks for phishing incidents that were false positives, which automatically close incidents.

Regarding areas for improvement in Palo Alto Networks Cortex XSOAR, I want to highlight one concern about playbook creation. While I personally appreciate this approach, I have observed that junior analysts on my team find it difficult to build playbooks. If Palo Alto Networks could improve the ease of use, specifically for playbook creation, that would be beneficial, as this is a gap I have identified.

When I create a playbook for spyware or malware, I need to develop level one, level two, and sometimes level three sub-playbooks. Fetching data in the input and output fields is sometimes challenging. I have observed that junior analysts find this particularly challenging, so I believe it would be valuable to simplify the process of creating and configuring input fields and sub-playbooks.

I have been working with Palo Alto Networks Cortex XSOAR for three years.

Regarding the performance of Palo Alto Networks Cortex XSOAR, I have not experienced any lagging. All pages load quickly in just one or two seconds, and the system works smoothly even when I navigate deep into the playbook section.

Palo Alto Networks Cortex XSOAR has very good application capabilities and is highly scalable. However, scalability depends on the customer using the product, as developing more playbooks requires significant time and effort. Palo Alto Networks does provide prebuilt playbooks that can assist with this.

I have not needed to contact technical support for Palo Alto Networks Cortex XSOAR because the issues I encounter do not require CSP assistance. I was guided by a senior architect during deployment.

Neutral

I have previously used FortiSOAR as an alternative to Palo Alto Networks Cortex XSOAR for incident response and security operations.

The initial deployment of Palo Alto Networks Cortex XSOAR is very straightforward. I only needed to set up the Broker VM or CIE and then the agents, and the system began sending data immediately. This approach is beneficial for XDR purposes and enables integration with SIEM and other products to automate the response flow.

Based on my experience, two to three people are sufficient for deployment. This includes a senior architect, a junior architect or assistant architect, and one resource for training and instruction. Three people are more than adequate, although the deployment can also be accomplished with two people.

When comparing Palo Alto Networks Cortex XSOAR to FortiSOAR, the differences are evident, particularly in the user interface. I would place Palo Alto Networks Cortex XSOAR above FortiSOAR because it provides incident layout flexibility, allowing me to customize incident layouts based on specific requirements.

Palo Alto Networks Cortex XSOAR does not require any maintenance on my end. I only need to check for updates on the content packs I am using, whether they are for malware or other security purposes, since Palo Alto Networks handles all maintenance responsibilities.

The initial deployment of Palo Alto Networks Cortex XSOAR is very easy. I only needed to set up the Broker VM or CIE and then the agents, and the system began sending data immediately. This approach is beneficial for XDR purposes and enables integration with SIEM and other products to automate the response flow.

Regarding the performance of Palo Alto Networks Cortex XSOAR, I have not experienced any lagging. All pages load quickly in just one or two seconds, and the system works smoothly even when I navigate deep into the playbook section.

Palo Alto Networks Cortex XSOAR has had a positive impact on the mean time to resolution for incidents (MTTR), as it has significantly reduced noise. For instance, I have created custom playbooks for phishing incidents that were false positives, which automatically close incidents.

Palo Alto Networks Cortex XSOAR is highly scalable. However, scalability depends on the customer using the product, as developing more playbooks requires significant time and effort. Palo Alto Networks does provide prebuilt playbooks that can assist with this.

Regarding integration capabilities with other third-party tools for enhancing security, integrating tools such as VirusTotal and AutoFocus is very straightforward. I only need to set up API keys and provide URLs. As of my last check, approximately eighteen integrations are available.

I have not explored the machine learning and AI components of Palo Alto Networks Cortex XSOAR because my role focuses on creating custom use cases and playbooks to reduce MTTR. I have not utilized these features at this time.

I would rate this product an 8 out of 10.