The main use case for Cortex Agentic Endpoint Security is that we are mostly replacing traditional SOCs and traditional SIEM systems like Splunk, QRadar, ArcSight, and Sentinel with XAIM that involves Cortex as its main engine. We get a lot of telemetry from Cortex from all of the endpoints and servers to the system. We also use XSOAR, which is the automation part that already exists in XAIM alongside XDR to do enrichment and investigation and also respond to issues that we see in the environment.
Unified telemetry has transformed our SOC operations and now automates complex incident response
What is our primary use case?
How has it helped my organization?
The improvements and benefits we have seen with Cortex Agentic Endpoint Security include the elimination of different silos. Once we get Cortex, all of the systems are sending logs to a specific unified data lake, and all of the data gets normalized. We are able to do investigation on whatever the sending product is, whether it is a firewall or an identity solution. All of the data gets stitched and normalized, and we see the full picture. An additional feature that is of great value for us is consolidating all of the alerts and issues into cases, joining evidence to create a complete story.
After the immediate implementation of Cortex Agentic Endpoint Security, it affects day-to-day operations by simplifying the workload, remediation time, and posture management. We as a provider get a lot of telemetry and information from the endpoints and servers that we were not able to get when we had an EDR on a different system. All of the automations and workflows speed up a lot of our investigation process, which helps us significantly.
The integration between Cortex Agentic Endpoint Security and Cortex XDR influences our Tier 1 alert triage and our incident correlation by eliminating the need for Tier 1. We do not have Tier 1 analysts in our SOC. All of the Tier 1 activities are done by playbooks and automation, and we employ Tier 2 and above analysts.
Deploying Cortex Agentic Endpoint Security has affected our visibility into non-binary or behavior-driven AI risks compared to traditional endpoint telemetry. All of the non-binaries are now being covered as Cortex Agentic Endpoint Security, which is a great addition to the endpoint itself. Cortex AES, which was formerly called Coi, brings all of the plugins, non-binary executables, all of the imports, and AI usage. This is exactly what every client of ours has been missing in the last one or two years, and we saw in the last few months that we are able to also replace some startup solutions that clients installed just for this feature. Now they get it as part of this product.
Cortex Agentic Endpoint Security reduces our alert volume, but this is mostly not just the product itself; it is part of our ongoing service. The system creates a lot of noise once we start working with analytics and UEBA and all of the advanced modules. This is exactly where the service of our professional services comes in. We see our clients' dashboards on a daily basis and identify new issues that got raised. We use playbooks to investigate, and from time to time we lower the existing correlation rules and signatures and fine-tune them. Our goal is to have zero false issues in the system because every new alert is something that we need to investigate and invest efforts in investigation, not the client. We do this on a daily basis. For the clients that we are already in production for a few months, there are almost no false issues. There are some matters that are not really important, but there are real matters that are nice to know.
Cortex Agentic Endpoint Security reduces the false positive rate significantly, more than fifty percent. I want to be on the safe side, but I will say that between fifty to eighty percent of the false issues got removed, not just by the product itself but as part of the service.
The mean time to detect and the mean time to respond improve by thousands of percentage with Cortex Agentic Endpoint Security. The mean time to respond changed from hours to minutes because we use playbooks on the first response. Mean time to detect also improved significantly; sometimes we took clients that had blind spots, and now they see everything. So it is not just improved the mean time to detect, it also improved the detection itself.
What is most valuable?
The best features of Cortex Agentic Endpoint Security include UEBA and anomaly detections, all of the activities that happened on the network that are off the baseline. Most of the time in any attack, one of the first stages is something that the system did not see before. This gives us a lot of value, along with the automation part.
When it comes to differentiating between benign tools, the criteria security analysts use includes taking a lot of advantage of the playbooks for enrichment and doing partial investigation, searching hashes on different blacklists and different IOC feeds, and searching for IP addresses and domain age. We also use our investigation systems that we built, which involves Cortex in them as a detection source.
What needs improvement?
The areas for improvement in Cortex Agentic Endpoint Security are partially covered. All of the visibility with AI usage, chatbot, and agent channel will be unified in the new version with a product they acquired called Coi. An additional improvement would be virtual patching. I know it is also on the roadmap, but all of the competitors are doing virtual patching, and it is high demand in the market.
For how long have I used the solution?
We have been working with Cortex Agentic Endpoint Security for a few years now, and in the last two years we are an MSSP partner. We have done a lot of projects and are managing Cortex for our clients.
What do I think about the stability of the solution?
The stability of Cortex Agentic Endpoint Security rates about a ten. We have used the platform for a few years now, and I do not think we ever got an unplanned downtime. Only maintenance, such as quarterly maintenance for updates, results in a few minutes of downtime for the GUI itself. Other than that, I do not remember any outage.
What do I think about the scalability of the solution?
In our organization, we have six SecOps team members that use only Cortex, and we have a team of analysts with nine analysts at the Tier 2 and Tier 3 levels. This entire department does only Cortex work.
Our clients using Cortex Agentic Endpoint Security span from three hundred employees to our biggest client, which has fifty thousand endpoints. We basically use the SMB segment in the market.
I rate the scalability of Cortex Agentic Endpoint Security as a ten because even in the sizing part, when we first start a project on planning, we do not take into account the sizing or the requirements from the infrastructure other than for licensing. Implementation for two hundred endpoints and fifty thousand endpoints is the same process on our side, and the systems on both clients work the same. Clients with one hundred gigabytes of daily storage are working the same as clients with one terabyte of daily storage, and we do not see any difference in the queries. I believe Palo Alto scales up based on client needs without our intervention.
How are customer service and support?
I rate the technical support for Cortex Agentic Endpoint Security as not always the best. As I see it in most of the big companies, the support is not something you want to talk to every day. However, we as a provider are the first in our country that are certified as a Palo Alto PS team, so we can offer the support on our behalf. We invest a lot to know the product through training, certification, and other methods. A lot of the time we handle issues by ourselves. On the specific XAIM and Cortex, I know that on the vendor side, currently, if you open a ticket, you already get escalated by default to a superior support team. This makes things a bit easier and better, but most of the time we try to take care of it all on our own.
I would rate their vendor support as seven.
What was our ROI?
Cortex Agentic Endpoint Security reduces the total cost of ownership by at least ten percent. We are replacing several systems and different silos with one system, so it is at least covered by the different EDR that got replaced, the new visibility solution, and vulnerability management if the client had it. Identity protection is now a new feature in Cortex Agentic Endpoint Security that also replaces solutions like Silverfort or Okta.
What's my experience with pricing, setup cost, and licensing?
Regarding pricing for Cortex Agentic Endpoint Security, the Palo Alto brand is considered a higher range price. However, given the current market and because we are an MSSP, we are able to offer our clients even more attractive pricing. It has become the commodity standard and is no longer the most expensive product. It is expensive, but it is not much different than its competitors when we are talking about the full suite of capabilities.
Which other solutions did I evaluate?
When comparing Cortex Agentic Endpoint Security with other solutions on the market, I think it is one of the best EDRs. I used a bit of CrowdStrike, so I know CrowdStrike is doing a lot of the same work, but once you add all of the additional features of XAIM and sending third-party logs to the system and using automation, this makes Cortex Agentic Endpoint Security superior to all of the other vendors. However, I think the main competitor for the EDR platform is Falcon by CrowdStrike, and Microsoft Defender on some of the higher end of the license tiers is also competitive.
What other advice do I have?
Regarding deployment, most of our clients are hybrid. We have only one client that does not have any footprint on the cloud, but most of our clients are hybrid. We have a few clients that are cloud-native, and they do not have anything on-premises. The majority of our clients are hybrid.
The cloud environments for our clients mainly involve AWS, Azure, and GCP. I would say approximately forty percent Azure, forty percent AWS, and the remaining twenty percent are GCP, Oracle Cloud, and others.
The maintenance of Cortex Agentic Endpoint Security is very easy. All of the endpoint work is managed from the GUI itself. You can select two hundred endpoints, right-click, and update them, uninstall them, or change their policy with a few clicks. Only the first deployment part needs to be taken care of outside of the system using the client deployment system, but once the agent is installed, everything is managed from Cortex Agentic Endpoint Security itself.
For others looking into Cortex Agentic Endpoint Security, my recommendation to others reading reviews on PeerSpot is to always do a POC. If you can use our services, then do it.
Which deployment model are you using for this solution?
Hybrid Cloud
If public cloud, private cloud, or hybrid cloud, which cloud provider do you use?
Other
