No more typing reviews! Try our Samantha, our new voice AI agent.

Cybereason XDR vs LogRhythm UEBA [EOL] comparison

Why PeerSpot?
Sponsored
 

Comparison Buyer's Guide

Executive SummaryUpdated on Oct 26, 2025

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Categories and Ranking

Cortex XDR by Palo Alto Net...
Sponsored
Average Rating
8.6
Reviews Sentiment
6.7
Number of Reviews
122
Ranking in other categories
Endpoint Protection Platform (EPP) (4th), Endpoint Detection and Response (EDR) (5th), Extended Detection and Response (XDR) (3rd), Ransomware Protection (2nd), AI-Powered Cybersecurity Platforms (1st)
Cybereason XDR
Average Rating
8.6
Reviews Sentiment
6.7
Number of Reviews
3
Ranking in other categories
Extended Detection and Response (XDR) (23rd)
LogRhythm UEBA [EOL]
Average Rating
7.0
Reviews Sentiment
6.5
Number of Reviews
11
Ranking in other categories
No ranking in other categories
 

Featured Reviews

ABHISHEK_SINGH - PeerSpot reviewer
Senior Process Expert at A.P. Moller - Maersk
Gained full visibility and streamlined threat detection through behavior-based insights and AI integration
Initially, we got to have a lot of false positives when we onboarded, but nowadays it's quite smooth. We have fine-tuned our security policies and allowed different levels of policies to get rid of those false positives. Currently, we are getting a fairly good amount of incidents that are not false positives or benign, but actionable items. The process is streamlined. In the initial days, the operations used to get involved in a lot of benign and other activities, but now the process is streamlined. We are leveraging the auto-detection and remediation plans. The operations teams are now more involved in other business roles as well, not just looking into the logs and fetching out what's happening there. They have fixed a lot of things. Initially, they didn't have IAC code drift detection, cloud posture management, or security posture management, but they have those now. They purchased different vendors and did a merger with that. They have now Prisma Cloud that gets integrated and now they are working with Cortex Cloud. Everything that was negative has now been addressed, and the product altogether looks to be in a very better and mature shape now. Currently, it's more or less detecting the workloads with AI-based best practices. Since most organizations are consuming AI agents and other things, we are looking forward to seeing what other feature enhancements Palo Alto can support in that.
Peter Nowak - PeerSpot reviewer
Business Development Manager for Cybereason at Bechtle
Integration of multiple firewalls enables advanced threat detection
The integration of data from firewalls and Active Directory is most valuable. Cybereason XDR facilitates two-way communication, where the firewall sends data to the Cybereason system, and it can communicate with the firewall to stop unwanted communication. Customers can deal with multiple types of firewalls with ease. The behavioral analytics help detect advanced threats when attackers use existing software. The multilayered protection approach, including NGAV, integrates XDR detection with antivirus to assess and counter threats effectively.
Venda E - PeerSpot reviewer
Cloud Option Engineer at a tech vendor with 10,001+ employees
Behavior analytics has improved insider threat detection and reduces false positives for our team
The best features LogRhythm UEBA [EOL] offers are its behavioral balancing, baselining, risk scoring, and correlation with SIEM events, and what stands out most is risk scoring, which gives clear visibility into which user behaviors are genuinely risky and helps our team to focus on the highest priority threats without drowning in noise. Risk scoring helps us to quickly identify which users' activity needs immediate attention by clearly ranking threats based on impact and likelihood; it changes our day-to-day operations by reducing time spent on low-risk alerts and allowing the team to prioritize investigations and response actions more effectively and consistently. LogRhythm UEBA [EOL] has positively impacted our organization by improving our ability to detect insider threats and compromised accounts earlier, resulting in better security visibility, reduced false positives, and faster investigations and response times, which helped the team operate more effectively with greater confidence. I observed a noticeable reduction in false positive alert volume, which shortened the investigation time per incident, improving the mean time to detect and respond, and helping identify high-risk user activities earlier, which prevented potential security incidents from escalating.

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Pros

"I've found the solution to be highly scalable for enterprises."
"There are a lot of lead solutions in this space, however, Palo Alto is number one."
"The initial setup isn't too bad."
"I like the centralized console and the predictive analysis it does of malware. It is very stable and also scalable."
"The most valuable aspect of Cortex XDR by Palo Alto Networks for me is its integration with AI detection, where we get to know the behavioral detection based on users, traffic patterns, and different services that we consume."
"If you are looking for security, mainly for advanced threat prevention from ransomware and malware attacks, I would recommend Cortex."
"Cortex XDR by Palo Alto Networks's ability to block sophisticated threats in real time is quite good and is on par with SentinelOne's."
"Monitoring is most valuable."
"Cybereason XDR's most useful feature is the investigation."
"The solution has an investigation feature, which is useful for building storylines."
"The integration of data from firewalls and Active Directory is most valuable."
"It is easy to monitor users and that is how the solution is adding value to our firm."
"I typically use the product for reducing cyber risk, and I can investigate attacks more quickly using machine learning tools."
"The most valuable features are file activity monitoring and registry activity monitoring."
"LogRhythm UEBA’s best feature is the dashboard. It provides several graphs, charts, and event logs."
"The solution's most valuable features are the graphical user interface and the reporting."
"I definitely think that it's good at finding things automatically, versus trying to define it."
"LogRhythm UEBA [EOL] has positively impacted our organization by improving our ability to detect insider threats and compromised accounts earlier, resulting in better security visibility, reduced false positives, and faster investigations and response times, which helped the team operate more effectively with greater confidence."
"The capability of pinpointing specific cyber incidents is a valuable feature for us."
 

Cons

"The GUI could be improved. It's a little bit cumbersome. It could be more user-friendly."
"Cortex XDR should have a lightweight agent, and the agent size should not be heavy."
"Although I would say this product is highly-rated, it could probably do more because nothing does everything that you want."
"It would be good if they could make an exception for applications. Sometimes, it can be a bit of a challenge to make exceptions for certain applications that have been used as rogue."
"This is a very costly product."
"The solution can never really be an on-premises solution based simply on the way it is set up. It needs metadata to run and improve. Having an on-premises solution would cut it off from making improvements."
"It tends to do 99.9% of things. The only thing I'd like is single sign-on authentication into their cloud platform so that my users can be properly authenticated against it."
"There are some false positives."
"Cybereason's customer support could be better."
"The one thing we sometimes have issues with is its integration with other security applications like antiviruses."
"Customer service is rated as a five out of ten. When they work and reach the right level, they are helpful, but getting to the right person can be time-consuming."
"There could be more integrations with other data sources like NDR systems."
"Better dashboarding. At the moment, the dashboard only has an hour."
"We're now exploring the cloud version but unfortunately we've found that they are lagging in that space."
"The product could be user-friendly for someone who doesn’t have any prior experience working with it."
"The on-premises LogRhythm is not very scalable. When considering packets per second or the MPS needed for additional logs such as web application logs, scalability is usually found in cloud products."
"The solution is very expensive. There are also costs beyond the standard licensing fee."
"The only problem is that the agents consume too much memory and system resources; the memory and resource consumption is high."
"It would be helpful if there were more guidance provided for integrating with unsupported devices."
"In general, if something needs to be improved in the algorithm, it would be the dashboards."
 

Pricing and Cost Advice

"Cortex XDR’s pricing is very reasonable."
"If one wishes to work with another team or large number of users at a future point, he must purchase a license for them."
"Our license will require renewal in August, after which the maintenance will continue as usual."
"In terms of the cost Cortex XDR by Palo Alto Networks is very expensive because we are a Mexican company and when you translate dollars to pesos the cost is very high. The solution is very expensive for Mexican companies. I understand that they have international prices, but I do not think it offsets the price enough for many companies in countries, such as Mexico. The amount it is reduced is not a massive percentage."
"Cortex XDR's pricing is ok."
"I am using the Community edition."
"Traps pays for itself within the first 16 months of a three-year subscription. This is attributed to OPEX savings, as security teams spent less time trying to identify and isolate malware for analysis as a result of a reduction in malware incidents, false positives, and breach avoidance."
"Cortex XDR by Palo Alto Networks is an expensive solution."
"The solution is cheaper than Microsoft Defender. It has a subscription and no standard license."
"The pricing is nice when compared to other products in the industry."
"I rate the product's pricing a three out of ten. However, the cloud version is expensive. You need to hire professional services for deployment and migrations, which can be expensive."
"It is quite a budget-friendly product."
"As LogRhythm UEBA is pretty expensive, I'd give its pricing a seven out of ten."
"Licensing is on a yearly basis. It's not expensive compared to its competitors."
report
Use our free recommendation engine to learn which Extended Detection and Response (XDR) solutions are best for your needs.
920,769 professionals have used our research since 2012.
 

Top Industries

By visitors reading reviews
Comms Service Provider
14%
Outsourcing Company
12%
Construction Company
10%
Manufacturing Company
10%
Manufacturing Company
12%
Outsourcing Company
10%
Computer Software Company
9%
University
8%
Comms Service Provider
12%
Retailer
11%
Outsourcing Company
10%
Construction Company
10%
 

Company Size

By reviewers
Large Enterprise
Midsize Enterprise
Small Business
By reviewers
Company SizeCount
Small Business50
Midsize Enterprise21
Large Enterprise57
No data available
By reviewers
Company SizeCount
Small Business4
Midsize Enterprise4
Large Enterprise4
 

Questions from the Community

Cortex XDR by Palo Alto vs. Sentinel One
Cortex XDR by Palo Alto vs. SentinelOne SentinelOne offers very detailed specifics with regard to risks or attacks. ...
Comparing CrowdStrike Falcon to Cortex XDR (Palo Alto)
Cortex XDR by Palo Alto vs. CrowdStrike Falcon Both Cortex XDR and Crowd Strike Falcon offer cloud-based solutions th...
How is Cortex XDR compared with Microsoft Defender?
Microsoft Defender for Endpoint is a cloud-delivered endpoint security solution. The tool reduces the attack surface,...
What needs improvement with Cybereason XDR?
There could be more integrations with other data sources like NDR systems. Additionally, technical support has been s...
What is your primary use case for Cybereason XDR?
I use Cybereason XDR for customers who don't have a SOC or managed SOC yet and want to be protected on more than thei...
What advice do you have for others considering Cybereason XDR?
I rate Cybereason XDR a nine out of ten. I recommend having hands-on experience and doing some threat hunting to fami...
What needs improvement with LogRhythm UserXDR?
In general, if something needs to be improved in the algorithm, it would be the dashboards. The dashboards with solut...
What is your primary use case for LogRhythm UserXDR?
I typically use the product for reducing cyber risk, and I can investigate attacks more quickly using machine learnin...
What advice do you have for others considering LogRhythm UserXDR?
I would not necessarily recommend LogRhythm due to its complexity and lack of modularity. I would always recommend Sp...
 

Also Known As

Cyvera, Cortex XDR, Palo Alto Networks Traps
No data available
LogRhythm UserXDR, LogRhythm Enterprise UEBA
 

Overview

 

Sample Customers

CBI Health Group, University Honda, VakifBank
MOTOROLA MOBILITY
Information Not Available
Find out what your peers are saying about SentinelOne, TrendAI, Palo Alto Networks and others in Extended Detection and Response (XDR). Updated: October 2026.
920,769 professionals have used our research since 2012.