Palo Alto Networks Cortex XSOAR Reviews

We use Palo Alto Networks Cortex XSOAR for incident response as a case management tool. All of our alerts from different tools come into this central place as we have multiple SIEMs. We have items coming from Anomali and other platforms that are not SIEM tools that we bring in. This is our central place where our SOC analysts can work and determine if they need to perform incident response on the alerts they have. It provides them with the ability to do data enrichment, so it has all the information we can provide upfront. They can find out the username, phone number, email address, where they work, and all that information. If it involves a malware file, they can get all the details from VirusTotal, such as the file name, how often it has been in the environment, and similar information. We built a lot of automation around it. From that, we track our case metrics, which helps us leverage how long it takes us to investigate and mitigate any threats.

What I appreciate most about Palo Alto Networks Cortex XSOAR is that it is very open, even more so than Anomali. I can create various custom automations and custom fields. There is significant customization ability in this platform. If I already have an established process, I do not have to change my process to fit into the tool. I can modify the tool to fit into my process, which makes things considerably easier.

All of our alerts from different tools come into this central place as we have multiple SIEMs. We have items coming from Anomali and other platforms that are not SIEM tools. This serves as our central location where our SOC analysts can work and determine if incident response is needed. The platform provides data enrichment capabilities, offering information upfront so analysts do not have to search for it. They can access details such as username, phone number, email address, and workplace information. For malware files, they can retrieve details from VirusTotal, including file names and environment presence. We have built substantial automation around these features, which also helps us track case metrics, investigation time, and threat mitigation duration.

I have worked on multiple use cases related to network security and cybersecurity. In network security, I've created multiple playbooks to fetch data from multiple firewalls. 

We can also upgrade them in parallel to Axon. Apart from that, we can block URLs and IPs in real time. It takes less than five minutes to block something. You don't have to push a policy or create a rule on the firewall directly. You just upload the IOC (Indicator of Compromise), URL, or IP into a SharePoint sheet, and it gets blocked within five minutes.

Those are the kinds of use cases I've created. In addition, we've automated several tasks, including Nikto vulnerability scans and SOCL (Security Orchestration, Automation, and Response) tasks. 

We've also created multiple threat intelligence playbooks, fetching data through the MITRE framework and following compliances like HIPAA. It's a very good tool.

XSOAR support the company's compliance and regulatory requirements. For example, I'm working with multiple clients from different industries—one from manufacturing, another from healthcare, and one from banking. Each of these clients has its own compliance policies. XSOAR is a product that allows you to meet all regulatory requirements effectively. The flexibility in XSOAR is much greater compared to other tools.

Security-wise, the integration of IAM and SSO in XSOAR is straightforward. For example, I'm currently working with an Indian client that must adhere to RBI regulations. These regulations require that data remain within the Indian subcontinent and not be sent overseas when using cloud services.

For instance, FortiSOAR has data centres in Dallas and Australia. Google Chronicle has data centres in Europe, Japan, and the US. However, XSOAR also has a data centre in India, which is essential for meeting local regulatory requirements. This makes XSOAR a very suitable option for such needs.

The primary use case for Cortex XSOAR is as an orchestration automation platform. I use it to execute automatic tasks for collecting, enriching, and correlating security events from hundreds of different technologies. It involves incident orchestration and automation in the selection of security analysts to be involved in event handling.

The solution is an orchestration automation platform. Three main features can help me: execution of automatic tasks for collecting, enriching, and correlating security events from hundreds of different technologies that I can integrate into the platform. Each incident collected is orchestrated with automation that selects the security analyst to be involved, or provides complex execution plans for managing security incidents.

I have created a couple of playbooks for a few clients using Cortex XSOAR. For example, we created a phishing playbook that checks the reputation of IP addresses or URLs using various reputation checker platforms. We've integrated Firepower Threat Defense, as well as Aviso IPTP and Cisco Talos for comparing the results. These were some of the use cases we worked on.

Using Cortex XSOAR has helped us create complex playbooks and streamline our security operations through automation. The integration capabilities with other solutions, like Cortex XDR and various SIEM solutions, have improved our incident management and detection capabilities.

For organizations that are stable with their security operations, like those with around 50 members in their security team running full-phased operations 24/7, Cortex is necessary. They can automate many processes and build their own scripts. Then, we use it for Flashflakes. 

But for a smaller organization with binding budgets and who is unaware of security, they may end up wasting money on it. This is an expensive tool. We have to use it wisely, or it’s easy to mistrust its value.

Previously, when Demisto was, there was a community edition; we could use it, reinstall it, and customize it. Since Palo Alto took over, it has become more financially oriented. It's business, but they could offer a pro model and a lighter model for different needs. 

For example, creating a pro model alongside a lighter model could be beneficial, like FortiSOAR or others providing a lighter model that focuses on the automation segment, where you could integrate maybe five or ten playbooks and integrations for day-to-day operations. This would make it more accessible to everyone.

Currently, Cortex XSOAR operates on a larger scale, which may not be necessary for all. If there's a minimum budget of around 50k or 80k for SOAR, having a scaled-down version of Cortex XSOAR would be advantageous. This would allow integration with current business operations at a minimal cost, saving money while still leveraging the capabilities of Cortex XSOAR.

And if there's a need to scale up later, moving to a pro model could be an option. That's something that's missing on the business side but could greatly aid incident response, as we're all trying to secure organizations from threats. Having such an option would make it a more socially viable cost and still provide widespread use.

In future releases, I would like to see more differential models could be implemented, instead of having a one-size-fits-all approach.

It is a security orchestration and automation tool.

It basically lets us automate and orchestrate tasks across all your security tools. Imagine integrating our vulnerability management tool with XSOAR. For example, we get a ServiceNow ticket requesting a scan for a specific server before it goes live. XSOAR can trigger that scan automatically, streamlining the entire process. That's the power of XSOAR—automating repetitive tasks and freeing up your security team for more strategic work.

The most valuable feature is its capability to automate responses and collect information for any security event before you even delve into the details.

It's a vast product with an active roadmap, so I'm satisfied with it for now. It's very efficient at data collection and correlation. 

The solution is user-friendly and easy to configure.

Palo Alto needs to develop more AI-centric products. Also, the price could be cheaper. It doesn’t have infinite connectors.

Cortex XSOAR is our desktop endpoint security standard. We deploy it on the desktops, monitor the events, and ensure the endpoints stay clean and inoculated. The client is a retail company with salespeople on the floor and roving notebooks that employees bring with them to various locations. We needed a solution that allows us to protect those endpoints no matter where they are. We deployed them through Active Directory using a group policy system. 

Customers don't always have endpoints that are part of their Active Directory, but we chose to use ADGPO to ensure any user logging into our domain(s) had the product installed. There are about 600 users spread out across three locations and six dealerships.

Well since we have deployed Cortex, we have not had any serious malware concerns. I believe Cortex or Traps as it were has helped immensely in keeping our end-user community safe.

That said, cortex has not been without its headaches. For one thing, recently it stopped updating clients and wouldn't allow new installations due to a MS patch that needed to be deployed. It wasn't obvious to me what was occurring as there were zero logs indicating the reason for the failures. We started having desktops falling out of compliance faster and I had to do a bit of digging to find out what was causing it. 

Another dig I have is in the Cortex Dashboard, there are a large numbers of machines that don't show associated usernames. This keeps growing over time. I still been able to determine the cause of this. I have some ideas its due to the way Palo Alto Networks determines who a user is. They look at AD authentication logs and associate the IP address of the user as he joins the network. Then this IP stays associated with that user for about 45 minutes after the user leaves his desktop. So the desktop becomes orphaned when the IP is no longer applicable. 

So in summary, the product has stood up to its core-capabilities, but is lacking in useable actionable logs.