The solution is used for security.
Hybrid Cyber Security Team Lead at dndx
Easy to use and scalable
Pros and Cons
- "Palo Alto is easy to use."
- "The dashboard could be better."
What is our primary use case?
What is most valuable?
Palo Alto is easy to use.
What needs improvement?
The dashboard could be better.
For how long have I used the solution?
I have used Palo Alto Network Cortex for six months.
Buyer's Guide
Palo Alto Networks Cortex XSOAR
October 2025
Learn what your peers think about Palo Alto Networks Cortex XSOAR. Get advice and tips from experienced pros sharing their opinions. Updated: October 2025.
873,003 professionals have used our research since 2012.
What do I think about the stability of the solution?
There are issues with stability as it was giving false positives and has bugs. I rate the stability a seven out of ten.
What do I think about the scalability of the solution?
It is a scalable solution. There are two hundred users using the solution at present. I rate the scalability an eight out of ten.
What about the implementation team?
The solution was deployed by analysts.
What other advice do I have?
I rate the overall solution an eight out of ten.
Which deployment model are you using for this solution?
On-premises
Disclosure: My company has a business relationship with this vendor other than being a customer.
Intern Cybersecurity at a computer software company with 10,001+ employees
The drag-and-drop interface enables analysts with no programming knowledge to create playbooks easily
Pros and Cons
- "The drag-and-drop interface enables analysts with no programming knowledge to create playbooks easily."
- "XSOAR could have more integration options."
What is our primary use case?
I'm currently evaluating XSOAR to see what the solution can do. I'm playing around with the various features.
What is most valuable?
The drag-and-drop interface enables analysts with no programming knowledge to create playbooks easily.
What needs improvement?
XSOAR could have more integration options.
For how long have I used the solution?
I have used XSOAR for two months.
What do I think about the stability of the solution?
XSOAR is stable.
How was the initial setup?
Setting up XSOAR is straightforward and takes about 30 minutes. It doesn't require any special technology to implement it in any architecture. You create a virtual machine, move the file to it, launch the installer, and let it run. It doesn't require any complex tasks.
What other advice do I have?
I rate Palo Alto Networks Cortex XSOAR nine out of 10.
Disclosure: My company does not have a business relationship with this vendor other than being a customer.
Buyer's Guide
Palo Alto Networks Cortex XSOAR
October 2025
Learn what your peers think about Palo Alto Networks Cortex XSOAR. Get advice and tips from experienced pros sharing their opinions. Updated: October 2025.
873,003 professionals have used our research since 2012.
Business Development Manager at a tech services company with 51-200 employees
Has good stability and an easy initial setup process
Pros and Cons
- "The solution is easy to deploy."
- "The solution's technical support could be better."
What is our primary use case?
We use the solution to create playbooks for all the operational programs.
What needs improvement?
The solution's integration with non-security solutions will be helpful.
For how long have I used the solution?
We have been using the solution for almost two years now.
What do I think about the stability of the solution?
The solution is stable. I rate its stability an eight.
What do I think about the scalability of the solution?
I rate the solution's scalability as an eight. It is complex to scale.
How are customer service and support?
The solution's technical support team takes longer to reply to the queries.
How would you rate customer service and support?
Neutral
How was the initial setup?
The solution's initial setup process is straightforward.
What's my experience with pricing, setup cost, and licensing?
The solution's cost is reasonable. I rate its pricing as a five.
What other advice do I have?
I rate the solution an eight.
Which deployment model are you using for this solution?
On-premises
Disclosure: My company has a business relationship with this vendor other than being a customer. Partner
Security Project Manager at a retailer with 10,001+ employees
Reliable, overall beneficial capabilities, but feature improvement needed
Pros and Cons
- "The most valuable features of Palo Alto Networks Cortex XSOAR are its overall track record and features that fit our use case."
- "Palo Alto Networks Cortex XSOAR could improve the Panorama feature. We had to turn it off because it was not working properly."
What is our primary use case?
We are using Palo Alto Networks Cortex XSOAR for automation.
What is most valuable?
The most valuable features of Palo Alto Networks Cortex XSOAR are its overall track record and features that fit our use case.
What needs improvement?
Palo Alto Networks Cortex XSOAR could improve the Panorama feature. We had to turn it off because it was not working properly.
For how long have I used the solution?
I have been using Palo Alto Networks Cortex XSOAR for approximately six months.
What do I think about the stability of the solution?
Palo Alto Networks Cortex XSOAR is a stable solution.
What do I think about the scalability of the solution?
The scalability of Palo Alto Networks Cortex XSOAR is fine for what we are using it for.
We have our SecOps department of user 50 people that are using the solution for alerts. We plan to increase usage in the future.
How are customer service and support?
The support from Palo Alto Networks Cortex XSOAR could improve. However, a lot of the support is poor.
What about the implementation team?
We have three people in the security operations that do the maintenance and support of Palo Alto Networks Cortex XSOAR.
What's my experience with pricing, setup cost, and licensing?
The price of Palo Alto Networks Cortex XSOAR is comparable to other solutions in the market.
What other advice do I have?
I rate Palo Alto Networks Cortex XSOAR a six out of ten.
Disclosure: My company does not have a business relationship with this vendor other than being a customer.
Senior Information Technology Support Engineer at TSCNET Services GmbH
Easy to install, able to expand, and reliable
Pros and Cons
- "It’s easy to install."
- "The integration could be better. Cortex, for example, does not work with iPhone."
What is our primary use case?
We primarily use the solution for network inspection.
What is most valuable?
The solution works well.
It’s easy to install.
It’s stable.
The solution can scale as needed.
What needs improvement?
The stability could be better.
The integration could be better. Cortex, for example, does not work with iPhone.
For how long have I used the solution?
I’ve been using the solution for less than one year.
What do I think about the stability of the solution?
Right now, it’s been stable for us. We may consider something from Microsoft in the future. It’s possible it could be more stable.
What do I think about the scalability of the solution?
The solution is quite scalable. If a company needs to expand it, it can do so.
How are customer service and support?
At the moment, we don’t actually get support from Palo Alto as we’ve never needed any help. I can’t say how helpful or responsive they would be.
Which solution did I use previously and why did I switch?
We’ve also worked with CrowdStrike. We switched as we weren’t happy with their detection capabilities.
How was the initial setup?
The installation is very easy to set up. It’s not overly complex or difficult.
The deployment took less than a week. I recall we had it up and running within a couple of days.
What about the implementation team?
In our case, we went to a consultant for installation assistance. However, a company might likely be able to handle it on its own.
What's my experience with pricing, setup cost, and licensing?
I can’t speak to the exact cost of the solution.
What other advice do I have?
This is a SaaS product.
I’d rate the solution nine out of ten.
Disclosure: My company does not have a business relationship with this vendor other than being a customer.
Consulente immobiliare at Libero
I have no complaints about the stability
Pros and Cons
- "I have no complaints about Cortex's stability."
What is our primary use case?
I'm using Cortex XSOAR to manage our network security.
For how long have I used the solution?
I've been using Cortex XSOAR for about one year.
What do I think about the stability of the solution?
I have no complaints about Cortex's stability.
What do I think about the scalability of the solution?
As far as I know, Cortex XSOAR's scalability is okay. I'm just a user, so I don't know.
How was the initial setup?
Setting up Cortex is straightforward. This use case is the easiest to implement. I had help from two or three technicians.
What other advice do I have?
I rate Palo Alto Networks Cortex XSOAR eight out of 10. I would recommend it to others.
Which deployment model are you using for this solution?
On-premises
Disclosure: My company does not have a business relationship with this vendor other than being a customer.
Vice President Global Technology Infrastructure Automation at a financial services firm with 10,001+ employees
Detects and whitelists certain IP addresses based on where they're coming from
Pros and Cons
- "The solution is very reliable."
- "The solution is very expensive."
What is our primary use case?
We use Palo Alto as a firewall, a system for detecting and whitelisting certain IP addresses or to block certain IP addresses based on where they're coming from. We then send the logs to another log management tool for more forensics and analysis before we make a decision.
We're basically using Palo Alto for firewalling and sending those logs to another security monitoring tool to make decisions based on analytics that it provides us.
What is most valuable?
The solution is very reliable. The performance is great.
The scalability of the solution is excellent.
We find the solution to be very robust. Palo Alto has been in the industry a long time and the solution reflects that.
The initial setup is very straightforward. It's not hard to deploy.
What needs improvement?
The solution is very expensive. They would get more clients if it wasn't so pricey.
For how long have I used the solution?
I've been using the solution for about four years at this time. It's been a while.
What do I think about the stability of the solution?
The solution is very reliable in terms of performance. It doesn't crash or freeze. There are no bugs or glitches.
What do I think about the scalability of the solution?
The solution is extremely scalable. If a company needs to expand it, it can do so easily.
How are customer service and technical support?
The technical support has been very good. Palo Alto is top of the line. They've been in the industry a long time and their support team reflects that knowledge. We are very satisfied with their level of support.
Which solution did I use previously and why did I switch?
I also work with Fortinet. We've used them for around the same amount of time.
How was the initial setup?
We found the initial setup to be quite straightforward. It's not hard to do. A company shouldn't have too much of a problem getting it up and running.
What's my experience with pricing, setup cost, and licensing?
I cannot speak to the exact cost of the solution or how much our organization pays.
However, it is my understanding that the product is extremely expensive.
What other advice do I have?
I'm not sure which version of the solution we're using at this time.
I'd rate the solution at an eight out of ten. We've been quite pleased with its capabilities. The only thing is it is pretty expensive.
I'd recommend other users work both with Palo Alto and Fortinet. They are great together. They compliment each other nicely.
Disclosure: My company does not have a business relationship with this vendor other than being a customer.
Delivery Manager at a tech services company with 1,001-5,000 employees
User-friendly and robust with good technical support
Pros and Cons
- "The automation is excellent."
- "When Palo Alto bought the solution, the pricing increased by 1.5 times. There's been a 50% increase, which is a lot."
What is our primary use case?
I primarily pitch and sell this solution to our customers. We do product assessments and consult with customers for the most part.
Clients can use it for automation.
What is most valuable?
The solution has very good integration capabilities. It's really the best at integration. Inside every integration, there are certain commands which we can call upon, which makes it very useful as a product.
The automation is excellent.
The product is very robust.
With this solution, we can do dynamic remediation.
It's a product that is constantly upgrading and improving.
It's a user-friendly solution.
Technical support is very helpful and responsive.
What needs improvement?
We'd like to be able to add as many integrations as possible. We would like more options for our clients.
A few times, I have noticed some bugs. That may be due to the fact that they are consistently upgrading the product. With new releases, a few bugs might get through.
The solution is expensive. They should work to make it less costly for the customer.
For how long have I used the solution?
I've been working with the solution for the past five years or so at this point. It's been a while.
What do I think about the stability of the solution?
There are a few bugs here and there when new releases happen. We've used it from version four all the way to version six and have dealt with a few bugs, however, that is expected. That's always some in any products. It's fine for us.
Mostly, the stability is okay. The integration keeps on triggering every time. It has jobs that are learning all the time. It's based on completely API integrations. As long as there is compatibility, the solution is pretty available. It is always ready to go.
What do I think about the scalability of the solution?
We haven't tried to scale, however, as per the technical documents which I have read, it should be understood by the customer before it is deployed. It all depends on how many integrations or how many triggering points a company has. You need to have an idea of the scope. Remediation can take a minute or two, however, it will still be possible. There isn't too much of a concern for scaling right now.
We have one or two customers using the solution for their own purposes. We are consulting with two more customers. We do plan to increase usage in the future.
How are customer service and technical support?
We've dealt with technical support in the past. They're 100% responsive and they have a lot of channels in which to talk to them. You can always get a hold of them and they are very knowledgeable. We are quite satisfied with their level of support.
How was the initial setup?
Initially, we found the implementation to be a bit difficult. However, now we have done it quite a few times for clients, and we find it to be very straightforward and simple. You get used to the process. You learn how to do it. It's simple.
What about the implementation team?
We implement the solution for our clients as consultants.
What's my experience with pricing, setup cost, and licensing?
The licensing is paid on a yearly basis. It is quite expensive.
When Palo Alto bought the solution, the pricing increased by 1.5 times. There's been a 50% increase, which is a lot.
What other advice do I have?
We are a partner for Palo Alto. I have been certified with them. I did certifications around their certificates when they were Demisto, however, right now, we are Palo Alto partners.
It's not a SIEM product, however, it's a next-gen automation platform for SIEM SOC services.
I'd advise companies considering the solution to assess the existing environment before they go ahead and choose something. This solution is basically built for a vast organization or a medium and big organization. Smaller organizations have other options which are available to them that might be more appropriate.
Companies should assess the product before it's brought on, as the cost is high. Businesses need to check their budget around that, and whether it will be flexible or not.
It's also important to have a proper engineering and design team to implement that product.
I'd rate the solution at a nine out of ten overall.
Which deployment model are you using for this solution?
Public Cloud
If public cloud, private cloud, or hybrid cloud, which cloud provider do you use?
Disclosure: My company has a business relationship with this vendor other than being a customer. Partner
Buyer's Guide
Download our free Palo Alto Networks Cortex XSOAR Report and get advice and tips from experienced pros
sharing their opinions.
Updated: October 2025
Popular Comparisons
Microsoft Sentinel
IBM Security QRadar
AWS Security Hub
Arctic Wolf Managed Detection and Response
ThreatConnect Threat Intelligence Platform (TIP)
NetWitness NDR
Sumo Logic Security
ServiceNow Security Operations
Fortinet FortiSOAR
Google Security Operations
Buyer's Guide
Download our free Palo Alto Networks Cortex XSOAR Report and get advice and tips from experienced pros
sharing their opinions.
Quick Links
Learn More: Questions:
- Which Do You Recommend, Phantom or Demisto?
- Which solution do you prefer: Microsoft Sentinel or Palo Alto Networks Cortex XSOAR?
- Which SOAR product has the better value: Palo Alto Networks Cortex XSOAR or Swimlane? Why?
- What are the Top 5 cybersecurity trends in 2022?
- What is the difference between SIEM and SOAR platforms?
- What is an incident response playbook and how is it used in SOAR?
- What are the latest trends in Security Operations Center (SOC)?
- What tools and solutions do you use for automated incident response in an enterprise in 2022?
- How to evaluate SIEM detection rules?
- Why a Security Operations Center (SOC) is important?



















