Try our new research platform with insights from 80,000+ expert users

Pros & Cons summary

Buyer's Guide

Get pricing advice, tips, use cases and valuable features from real users of this product.
Get the report

Prominent pros & cons

PROS

Cortex XSOAR excels in automation and playbook creation, significantly aiding security operation centers by handling about 50% of the work.
It offers extensive integration capabilities with a comprehensive list of plugins, allowing seamless incorporation with various tools and platforms.
Its orchestration features provide a high-level overview of critical log information, efficiently coordinating across different devices.
The platform enhances cybersecurity through effective threat intelligence integration and streamlined responses to security events.
Many users appreciate its scalability, reliability, and overall impact on improving organizational cybersecurity.

CONS

Implementing Palo Alto Networks Cortex XSOAR requires significant vendor involvement, and it should be easier for partners.
The documentation for building automation is not very good and requires improvement.
The pricing increased by 50% after Palo Alto acquired it, making it very expensive.
Managing its setup phase is complicated, and the technical support could be improved with faster response times.
The lack of SIEM functionalities and insufficient integration options are notable drawbacks of Palo Alto Networks Cortex XSOAR.
 

Palo Alto Networks Cortex XSOAR Pros review quotes

reviewer1714731 - PeerSpot reviewer
Nov 11, 2021
Palo Alto has gotten the investigators more presence to actually go in the report because being that the platform will email the investigator that it's been assigned to, now the investigators will jump in there and start going through the review process a lot quicker.
NikhilSharma2 - PeerSpot reviewer
Aug 23, 2024
The orchestration in XSOAR is significantly easier compared to other SOAR tools I've used.
Donald Keeber - PeerSpot reviewer
Feb 1, 2024
I chose Cortex XSOAR because the client also has Palo Alto firewalls. I can incorporate the data from the Palo Alto firewalls into Cortex and send it into the same data lake to manipulate that data. It lets me manage and monitor the data in one place.
Learn what your peers think about Palo Alto Networks Cortex XSOAR. Get advice and tips from experienced pros sharing their opinions. Updated: August 2025.
867,341 professionals have used our research since 2012.
Chetankumar Savalagimath - PeerSpot reviewer
Oct 19, 2023
For organizations that are stable with their security operations, like those with around 50 members in their security team running full-phased operations 24/7, Cortex is necessary.
CC
May 12, 2025
What I appreciate most about Palo Alto Networks Cortex XSOAR is that it is very open, even more so than Anomali.
DayaramGoyal - PeerSpot reviewer
Aug 18, 2025
Palo Alto Networks Cortex XSOAR is a good product with enhanced and efficient playbooks, as demonstrated during our use case simulations.
reviewer1469436 - PeerSpot reviewer
Sep 8, 2021
It has an extensive list of integrations that are available out of the box which makes it easy to start.
Chetankumar Savalagimath - PeerSpot reviewer
May 15, 2021
The automation is excellent.
DL
Jul 21, 2022
They have a portal where you can find any kind of integration that you need.
Mostafa-Ahmed - PeerSpot reviewer
Oct 1, 2023
What I like most about Palo Alto Networks Cortex XSOAR is how user-friendly it is for development. It is much simpler to work with compared to similar tools I've used.
 

Palo Alto Networks Cortex XSOAR Cons review quotes

reviewer1714731 - PeerSpot reviewer
Nov 11, 2021
In terms of improvement, it needs to be more modular. It's not. When you're working in layouts and you create specific apps within layouts, there's no portability right now in order to reuse that code across multiple layouts. I can't take a tab and say I want to use this tab on these other layouts. I have to physically go in there and recreate it from scratch, which is maddening.
NikhilSharma2 - PeerSpot reviewer
Aug 23, 2024
The user interface (UI) is quite heavy and takes time to load, which is a major drawback.
Donald Keeber - PeerSpot reviewer
Feb 1, 2024
I would like to see Cortex become less dependent on Active Directory and group policies to manage the deployment. Maybe I need to update my understanding of how to deploy it, but that's the way I know how to use it.
Learn what your peers think about Palo Alto Networks Cortex XSOAR. Get advice and tips from experienced pros sharing their opinions. Updated: August 2025.
867,341 professionals have used our research since 2012.
Chetankumar Savalagimath - PeerSpot reviewer
Oct 19, 2023
Previously, when Demisto was, there was a community edition; we could use it, reinstall it, and customize it. Since Palo Alto took over, it has become more financially oriented. It's business, but they could offer a pro model and a lighter model for different needs.
CC
May 12, 2025
One of the significant issues we encounter is system slowdown when we receive an influx of alerts, which inhibits how quickly we can access the information needed for investigation.
DayaramGoyal - PeerSpot reviewer
Aug 18, 2025
It was expensive, making it essential for the customer to evaluate whether ROI is coming from the business model, as they are also acting as a SOC provider.
reviewer1469436 - PeerSpot reviewer
Sep 8, 2021
I would love to see more flexibility on what we can display and design on the dashboards.
Chetankumar Savalagimath - PeerSpot reviewer
May 15, 2021
When Palo Alto bought the solution, the pricing increased by 1.5 times. There's been a 50% increase, which is a lot.
DL
Jul 21, 2022
It's only one cloud right now. It might be helpful for some companies to have an on-premies option.
Mostafa-Ahmed - PeerSpot reviewer
Oct 1, 2023
It doesn't offer automatic internet reports out of the box.