Cortex XSIAM Reviews

I am trying to check the solution for a new organization I have moved to. Previously, I used the older version of the solution.

The flexibility for creating manual workflows stands out. Although it is time-consuming, it offers significant flexibility. 

Additionally, from a ticketing point of view, the platform works very well.

In our organization, we are using Cortex XSIAM for full-fledged SOC monitoring services. We onboard all the devices and network devices, and all the possible syslogging devices, everything is on one tool.

Since implementing Cortex XSIAM, incident response times have been significantly reduced by approximately twenty percent.

We are a partner, and we train people. However, we have not installed the product for a customer yet.

We started to work with Cortex due to the relationship between IBM and Palo Alto. One of the valued aspects of the product is its use of artificial intelligence to detect security vulnerabilities. The ease of use, simplicity in product setup, and the ability to optimize rules are crucial aspects.

At our organization, we have implemented Cortex XSIAM as our primary Security Information and Event Management (SIEM) solution. We've also harnessed its capabilities for our store operations. Our approach has been to strategically design it as the foundation for our in-house Security Operations Center (SOC), with a strong emphasis on incorporating store automation seamlessly into our security infrastructure.

Our primary focus with it has been to build and strengthen our security program. We have essentially developed a comprehensive security program around it. By using it as our SIEM solution, we've achieved the benefit of having a centralized, single interface for our security operations. Thanks to the capabilities of Security Orchestration, Automation, and Response (SOAR), our relatively smaller team has been able to efficiently manage our security operations. Another notable advantage is our ability to capture a lot of information that would have otherwise gone unnoticed. To illustrate this, consider that we've successfully integrated and correlated various log data from multiple sources. Viewing all this data from a unified perspective has allowed us to identify issues that might not have been detected individually but are indicative of more significant problems or threats.

It is just a replacement in front of CrowdStrike or Trend Micro. I'll pitch Cortex because it can do the same thing. So if there's competition with CrowdStrike or with Trend Micro, and the customer can't afford CrowdStrike pricing, then I'll suggest Cortex.

It is an effective solution in terms of performance and functionalities.

Cortex XSIAM serves as a comprehensive solution that combines the functionalities of both SIM (Security Information and Event Management) and EDR (Endpoint Detection and Response) with added automation capabilities. It streamlines the entire process into a single, unified solution. Its operation involves data collection, detection, response, and integration. Unlike traditional SIMs, it doesn't only deal with logs but also collects network traffic data and information from various security controls and systems. This holistic approach allows for a more comprehensive understanding of the entire attack cycle. It excels in threat detection and has the potential for even more extensive integration in the future.

It provides a level of detection capabilities that's hard to achieve with other tools, such as traditional SIMs. The key differentiator lies in its holistic analysis, which grants it a broader perspective on the entire attack lifecycle. Unlike solutions composed of multiple integrated components, Cortex XSIAM stands out because it's built as a unified solution. It operates on a single, extensive database which enables it to excel in detecting threats and anomalies across the network and endpoints, delivering a highly effective and comprehensive security solution.