Palo Alto Networks Cortex XSOAR Reviews

Our usual use cases for Palo Alto Networks Cortex XSOAR are basically security automation, where we write our different rules based on different security issues like intrusions, misuse, account takeover, and account management, such as identity and access management. Based on these events, we write the signatures in Python code for these particular events by connecting to upstream and downstream systems.

We use automation to create dashboards for security operations and link these dashboards to automations, which will have standard operating procedures linked for each use case, deployable at the discretion of the security analyst. This is mainly how we use Palo Alto Networks Cortex XSOAR.

The integration capabilities of Palo Alto Networks Cortex XSOAR with third-party tools enhance our security strategy as it works with 80% of the tools we have. Being a Palo shop, we have numerous Palo products like Palo Firewall, Palo CASB, and Palo Autofocus, in addition to regular third-party automations like ServiceNow. The integration is very good, especially with the addition of AI features that require little to no programming.

Before using Palo Alto Networks Cortex XSOAR, we did not have a single tool but used different custom-written tools, as we lacked a comprehensive solution. Previously, we wrote integrations on top of SIEM tools or other incident management tools such as ServiceNow automations. However, once we adopted Cortex XSOAR, we migrated all our workflows to it.

The most valuable features of Palo Alto Networks Cortex XSOAR, especially since we are leveraging it for automation, are the Playbooks feature, followed by the command and control screen feature that allows us to aggregate multiple dashboards and create custom dashboards based on different scenarios.

Regarding Playbook automation, I find it has helped streamline our incident response workflows significantly. Previously, manual incident reviews and actions took up a lot of time. Without dashboards and single pane of glass access, the security analyst had to handle multiple data sources, incident sources, and SOP documents, leading to more manual effort and increased potential for errors. All actions required manual tracking of logs and reviews to management. With Palo Alto Networks Cortex XSOAR Playbooks, we utilize standard inbuilt automations from Palo and can create our custom automations. We integrate multiple inbuilt playbooks and write our custom playbooks for incident management, taking inputs from incident sources such as SIEM and threat intelligence, aggregating them into dashboards, and enabling relevant automations for necessary changes, logging, or actions.

The machine learning models in Palo Alto Networks Cortex XSOAR help prioritize alerts in our organization, proving to be very important as they aid our incident processing. Given that many incidents require discretion from analysts due to their relevance to our business, the ML workflows eliminate a lot of false positives.

Palo Alto Networks Cortex XSOAR analytics features significantly impact our ability to gain insights and visibility into security, which is crucial for communicating with management. Management has different preferences for seeing the most frequent threats or identifying which particular systems are targeted by threat actors, making these analytics very useful.

I think the areas of Palo Alto Networks Cortex XSOAR that could be improved are mainly in UX. We have communicated with the vendor team about this, but they are prioritizing product functionality over usability because most target customers are technical and understand a primitive UI. They face difficulties in implementing UI changes as their team is stretched. Thus, the UI/UX of the tool needs significant improvement. There are plans on their roadmap, but a lot remains to be done. Parts of the tool run on an older framework, causing slowness. Usability is a broader issue than features alone. This usability problem is common in many cybersecurity tools, unlike customer-facing applications.

Some integrations have speed issues and might not function seamlessly with different upstream configurations, requiring manual updates. These are the main pain points we encountered, particularly with UI/UX, integration speed, and the usability of certain inbuilt playbooks.

I have been working with Palo Alto Networks Cortex XSOAR since 2022, so it has been three years.

I would rate the stability and reliability of Palo Alto Networks Cortex XSOAR as a nine. Occasionally, we have had rare issues with few plugins that led to high stack usage, requiring shutdown and restart. Generally, it is highly available nine out of ten times.

I would rate Palo Alto Networks Cortex XSOAR's scalability as an eight. It is highly scalable, but we do encounter some issues here and there.

The issues with scalability arise from the speed of some integrations, as not all are perfectly tuned by Palo; some were released without complete testing. Overall, most platform requirements are met with high scalability capabilities.

I often communicate with the technical support team of Palo Alto Networks.

My experience with Palo Alto Networks technical support has been quite satisfactory, rating it an eight. Eight out of ten times, they provide valuable help. However, in two instances, I encountered service associates who were not very knowledgeable or where the tasks were complex, leading to escalations. Even then, they were timely in their responses.

Positive

Before selecting Palo Alto Networks Cortex XSOAR, our organization was using Demisto, which made it logical to transition to Cortex XSOAR. We did evaluate Splunk, but we decided that Palo Alto Networks Cortex XSOAR was the better option.

While evaluating options, Splunk lacked the number of playbook integrations that Palo Alto Networks Cortex XSOAR offered. Although I hear Splunk has improved since then, being a Palo shop provided additional advantages, including a favorable bundle discount, as everything from our CASB to cloud monitoring and firewalls is with Palo, creating a tight dependency.

The initial setup process for Palo Alto Networks Cortex XSOAR involved having the necessary infrastructure suggested by Palo, spinning up the servers, establishing dependencies, ensuring proper network segmentation, and setting up the right monitoring appliances and connections. Once the setup was complete, we moved all dependencies, basic necessary automations, and basic dashboards into the system, which comprised the beginning work.

Overall, the process has been far from straightforward.

I have faced several challenges during installation where the necessary servers require varying amounts of RAM and specific network segmentation. These requirements are not straightforward, and I realized many issues post-installation. While they advise installing a VM, the actual installation process reveals that debugging is often necessary, making it less seamless and not functional right out of the box.

I participated in the initial setup and deployment of Palo Alto Networks Cortex XSOAR.

Palo Alto Networks Cortex XSOAR has had a huge impact on our organization's mean time to resolution for incidents. As I previously described, instead of going through the entire manual process, it improves the security SOC operations efficiency tremendously, by more than 80% to 90%. I would rate this solution a nine overall.

My main use case for Palo Alto Networks Cortex XSOAR has been automating SOC operations and incident response. I developed and maintained automated playbooks for these purposes.

One example is automating the phishing incident response using Palo Alto Networks Cortex XSOAR. When Microsoft Sentinel generated a phishing alert, Palo Alto Networks Cortex XSOAR automatically enhanced the alert by collecting IOCs such as URLs, IP addresses, file hashes, and email metadata. It queried the threat intelligence source to determine whether the indicators were malicious. If the risk score exceeded our threshold, the playbooks automatically isolated the affected endpoint through Microsoft Defender for Endpoint, disabled the Active Directory account, created a ServiceNow incident, and notified the SOC team. This significantly reduced the manual effort and improved our mean time to respond (MTTR). I also customized and maintained Palo Alto Networks Cortex XSOAR playbooks integrated with Microsoft Sentinel, Defender for Endpoint, CrowdStrike, and ServiceNow, and used PowerShell and Python scripts.

Alert integration from Microsoft Sentinel or CrowdStrike is one component of my workflow. IOC enrichment using threat intelligence sources such as MISP and Recorded Future is another. I apply automated decision logic based on severity, confidence, and predefined conditions. Response and action includes host isolation and disabling compromised accounts, followed by ticket creation. I then handle notifications and documentation. I follow these steps consistently. Besides incident response automation, I focused on making the playbooks modular and reusable. I integrated Palo Alto Networks Cortex XSOAR with Microsoft Sentinel, Microsoft Defender for Endpoint, CrowdStrike Falcon, ServiceNow, MISP, and Recorded Future.

I can perform playbook automation, extension and integration, case management, IOC enhancement, automated response and actions, collaboration, and reporting.

Playbook automation was a feature that was truly essential. Our SOC handled a high volume of alerts, and manually investigating every incident was time-consuming. I built customized Palo Alto Networks Cortex XSOAR playbooks to automate repetitive tasks such as IOC enhancement, checking threat intelligence, and isolating compromised endpoints through Microsoft Defender for Endpoint. Playbook automation had the biggest operational impact through the integration with Microsoft Sentinel and Palo Alto Networks Cortex XSOAR tools.

The positive impact was on SOC incident response tasks and standardizing our response process. Before automation, analysts spent considerable time on manual activities including IOC enhancement, host isolation, account disablement, and ticket creation. We reduced the manual effort, improved consistency, and reduced our mean time of response. The major benefit was improved collaboration. Palo Alto Networks Cortex XSOAR centralized incident management, automated notifications, and maintained a complete audit trail, making it easier for SOC analysts, incident response, and other security teams to work together throughout the investigation. The business value it provided was reducing the MTTR through the automated response workflow. It also reduced the manual analyst effort by automating repetitive SOC tasks, centralized incident handling using reusable playbooks, improved visibility by integrating multiple security platforms into a unified workflow, and enabled analysts to focus on complex investigations instead of repetitive operational tasks.

Overall, I have a very positive experience with Palo Alto Networks Cortex XSOAR. If I could improve one thing, it would be making playbook development and troubleshooting more effective. As automation workflows become more complex, debugging them takes time. I would also like to see more AI-assistant recommendations for playbook optimization and incident prioritization, along with out-of-the-box templates for common SOC use cases. Those enhancements would help teams deploy automation faster and reduce the learning curve for new analysts. The biggest area for improvement is simplifying playbook development and debugging. The playbooks are very powerful, but complex workflows can be time-consuming to troubleshoot. Better visual debugging tools or more AI assistance would be helpful.

One additional enhancement would be more built-in guidelines for troubleshooting failed playbook executions and integration issues. That would make it easier for SOC teams to identify the root cause and maintain the automation as environments grow.

I did not give Palo Alto Networks Cortex XSOAR a perfect 10 because complex playbook development and troubleshooting can be challenging, especially in a large enterprise environment with many integrations. I would also like to see more AI-assistant recommendations for playbook optimization and incident prioritization. Overall, it is a powerful and reliable SOC platform that has significantly improved our SOC operations and incident response.

I have a total of eleven years of experience, and in the US, I have two-plus years of experience.

I found Palo Alto Networks Cortex XSOAR to be highly scalable. In our enterprise environment, it handled a growing number of security alerts and integrated well with multiple platforms, including Microsoft Sentinel, Microsoft Defender for Endpoint, CrowdStrike, Azure, AWS, and threat intelligence sources. I rate its scalability a nine out of ten. It scaled well for the enterprise environment, though managing a very large number of playbooks can be a challenge.

I was not involved in the selection or replacement of the SOAR platform, so I cannot say whether Palo Alto Networks Cortex XSOAR replaced another solution. My role was mainly focusing on a migration from a previous SOAR platform.

I was not involved in evaluating alternative solutions before Palo Alto Networks Cortex XSOAR was selected.

I was not involved in the procurement or licensing process, so I cannot comment on the pricing or setup cost. My role focused on the technical implementation, including developing playbooks and integrating Palo Alto Networks Cortex XSOAR with Microsoft Sentinel. I was only involved in the day-to-day activities.

I saw a clear return on investment, primarily through improved operational efficiency rather than reduced headcount. By implementing Palo Alto Networks Cortex XSOAR playbooks, I automated repetitive SOC tasks such as IOC enrichment, alert triggers, host isolation, and incident ticket creation. The time to respond was reduced by approximately sixty percent, which specifically reduced the manual effort required from analysts. I also automated log correlation and IOC scanning with PowerShell and Python, reducing manual analyst effort by around sixty-five percent.

The governance and security model of Palo Alto Networks Cortex XSOAR is strong. I appreciate that access can be controlled through role-based access control (RBAC). Audit logs provide traceability for automated actions, and integrations can be managed securely across the SOC ecosystem for the AI capability. I believe it is important that the AI recommendations remain transparent and explainable, with human approval for high-impact response actions overall. I believe the governance and security model is solid, but organizations should still apply proper access controls and regular reviews and oversight of the automated workflow.

In my experience, the AI capabilities of Palo Alto Networks Cortex XSOAR are generally accurate and reliable for identifying suspicious behavior, prioritizing alerts, and assisting with investigations. However, I do not treat the AI output as a final decision. I use it to accelerate analysis but validate the findings using telemetry, threat intelligence, and other security data before taking containment actions. Overall, AI is a valuable assistant that improves SOC efficiency, but human validation remains important for high-impact incidents.

I recommend using Palo Alto Networks Cortex XSOAR because it is very effective, provides time efficiency, and reduces manpower needs. It is also easy to handle. I rate Palo Alto Networks Cortex XSOAR a nine out of ten overall.

My experience with Cortex XSOAR began around three to four years ago. Today, I work with Cortex XSOAR as a partner of Palo Alto, which defines my role and relationship. We have customers who require the same solution for their security operations center, and we generally offer Cortex XSOAR for that purpose.

As a partner of Palo Alto, we consider Cortex XSOAR mainly for all the functions required to automate or orchestrate the security operations of the customer, and primarily for some of the BFSI customers, we have proposed this solution to our customers.

The biggest advantage in Cortex XSOAR that I see is its extensive AI capabilities, where it unifies all your log collection mechanisms and can ingest the logs from almost all of the end devices. It has a strong inbuilt mechanism to correlate that data and uses AI and ML to ensure automation of most alerts and alarms based on defined policies to minimize manual intervention.

Playbook Automation is a really good feature that enables automated response, where the tool itself can automate the playbook and respond to any alerts and alarms in an automated way.

The integration aspect is strong. Whatever third-party tools we have used, it is easy to get them integrated with firewalls supporting multi-vendor firewalls like FortiNet and Cisco, and it supports those third-party components.

The machine learning models help prioritize alerts in the organization because they can prioritize alerts based on severity, and accordingly, your automation can be aligned to it by scoring based on different severity levels to define priorities such as high or low.

The analytics features have a significant impact on our ability to gain insights into security threats. The features relate mostly to how strong the platform is from the analytic perspective, leveraging natural language-based analytics and aligning the overall architecture with MITRE Attack mapping, along with providing a centralized unified dashboard for different users. I think it is pretty strong from that analytics perspective, scoring better even compared to other tools.

One area for improvement I see in Cortex XSOAR is the cost. It is too costly, although it offers a lot of features for security operation centers, especially in complex environments, but the overall cost of ownership is high, making it not easy to maintain for small or SMB customers.

Compared to competitors, if I compare Cortex XSOAR with Zscaler or any other vendor, they are leaders from an automation perspective. However, there are competitors such as Splunk and FortiNet. FortiNet offers a cost-efficient solution but lacks technical strength compared to Palo Alto, making Cortex XSOAR's overall technical ability and the value it provides superior.

I work with Palo Alto, as I have been doing for around four years now.

The platform is stable, and I reliably see no glitches or latency problems.

Regarding scalability for Cortex XSOAR, I believe it is highly scalable based on its microservices and container-based architecture, allowing scaling up without affecting the ongoing production environment.

Customer service from Palo Alto is generally good compared to other players, with a good technical assistance center. My experience is positive as we interact as partners on behalf of the customer. On a scale from zero to ten for support, I would give it eight.

I am dealing with FortiNet and Splunk SOAR, as we consider them and maintain partnerships with multiple OEMs. We use Splunk as well as FortiNet.

Compared to competitors, if I compare Cortex XSOAR with Zscaler or any other vendor, they are leaders from an automation perspective. However, there are competitors such as Splunk and FortiNet, where FortiNet offers a cost-efficient solution but lacks technical strength compared to Palo Alto, making Cortex XSOAR's overall technical ability and the value it provides superior.

The type of implementation matters. FortiNet looks a bit easier to use compared to Cortex XSOAR, but overall, if we compare features, Palo Alto is able to provide more capabilities.

There is a value for money and return on investment. Customers have their own budgets, and while it offers value, this is feedback I have received from customers regarding Cortex XSOAR.

We can quantify the reduction. It is more than sixty to seventy percent reduction in the MTTR, as per documents from Palo Alto, and with proper implementation, we can improve MTTR by up to sixty-five to seventy-five percent.

We have indeed deployed Palo Alto products on AWS cloud for one of the medium banks, leveraging the AWS Marketplace for Cortex. As an individual, I primarily deal with Palo Alto and Cisco. I manage the security components, including firewalls, SASE, and SD-WAN, but Splunk now being part of Cisco is not directly handled by me. I would like to see improvements from Cortex XSOAR to simplify complexity on their dashboard since they deal with a lot of data that can be simplified to enhance platform usability. I gave this review a rating of nine out of ten.

I work with Palo Alto Networks Cortex XSOAR only, not Zscaler. I have been working with Palo Alto Networks Cortex XSOAR for around three to four years now. We are a partner of Palo Alto Networks Cortex XSOAR.

We have customers who require Palo Alto Networks Cortex XSOAR for their security operation center. We generally offer Cortex XSOAR to meet those needs.

We consider Palo Alto Networks Cortex XSOAR mainly for functions required to automate and orchestrate the security operations of the customer. We have proposed this solution to some of our BFSI customers.

Palo Alto Networks Cortex XSOAR has numerous AI capabilities. It unifies all log collection mechanisms and can ingest logs from almost all end devices. The platform has a very strong inbuilt mechanism to correlate that data. Palo Alto Networks Cortex XSOAR uses AI and ML to ensure that they can automate most alerts and alarms based on policies defined so that minimal manual intervention can be ensured.

I use playbook automation with Palo Alto Networks Cortex XSOAR and have provided it to some of our customers. It is a valuable feature where we can automate the response part through playbook automation. The tool itself can automate the playbook and can respond to alerts and alarms in an automated way.

Whatever third-party tools we have used, it is straightforward to get them integrated with Palo Alto Networks Cortex XSOAR. The platform supports multi-vendor firewalls such as Fortinet and Cisco, and it is supporting most of these third-party components.

Machine learning models can help to prioritize alerts in the organization based on severity and accordingly align automation to it. The platform does the scoring based on different severity levels and then defines the priority whether it is high priority or low priority, and it addresses incidents accordingly.

The features we are discussing mostly relate to how strong Palo Alto Networks Cortex XSOAR is from the analytics perspective. We can leverage natural language-based analytics and align the overall architecture with MITRE ATT&CK mapping. The centralized, unified dashboard it can present is powerful, with different dashboards for CISOs based on the analysis which this platform has built in. It is very strong from the analytics perspective and would score better than other tools in comparison.

Palo Alto Networks Cortex XSOAR can reduce the Mean Time to Resolution (MTTR) drastically because there is a lot of automation which has already been implemented. AI and ML can automate incident response, and there are many out-of-the-box solutions which are implemented as a part of the playbook or any other ecosystem which has been developed around the platform. MTTR is a uniquely positioning point for Cortex XSOAR because all these analytics and correlation contribute to reducing the MTTR, which is the actual output.

According to the documents and positioning which Palo Alto Networks does, more than 60 to 70% reduction in MTTR is what we can target with this platform if it is properly implemented and configured. We can improve up to 65 to 75% of MTTR.

One disadvantage or thing which can be improved in Palo Alto Networks Cortex XSOAR is the cost because it is too costly. I know that it offers many things for any security operation center, especially for complex environments, but overall, the cost of ownership is too high. This is something which needs to be taken care of. From the technical side, unless a customer has very specific requirements stating they do not want to put all eggs in a single basket, the product is very good from the scalability perspective and from the time to put the platform in production. Everything is fine, but the cost is concerning. For small or SMB or small enterprise customers, it is really not that easy to maintain the tool from the commercial perspective.

There is ROI for Palo Alto Networks Cortex XSOAR without doubt, but because customers have their own budgets, this is the only feedback which I have received from customers where we have positioned Cortex XSOAR.

I have been working with Palo Alto Networks Cortex XSOAR for around three to four years now.

The platform is stable, and you can rely on it.

Scalability is something which is again a unique value proposition which Cortex XSOAR offers because it is based on microservices and container-based architecture. Scalability is not a problem. We can scale it up as and when required without affecting the existing or ongoing production environment.

Customer service overall from Palo Alto Networks is good in comparison with other players. They have a good technical assistance center. For us, it is good because we interact as a partner also on behalf of the customer, and customers also interact with Palo Alto's technical support.

We are considering other solutions because we have partnerships with multiple other OEMs. We also work with Splunk and Fortinet.

From the overall value which may be required today from the overall automation perspective with Palo Alto Networks Cortex XSOAR, they are certainly the leaders. There are other competitors such as Splunk and Fortinet. Fortinet with their FortiSOAR provides a cost-efficient solution, but they are not as technically strong as Palo Alto. Splunk is also present in the market. These are some of the competition, but from the overall technical ability perspective and the value which Cortex XSOAR can provide is superior from my experience.

Implementation depends on what type of implementation we are discussing with Palo Alto Networks products. Fortinet may appear to be a bit easier, but overall, when we compare it feature to feature, Fortinet probably may not have all the capabilities which Palo Alto can provide.

I would give a rating of eight for support. As a platform, I rate Palo Alto Networks Cortex XSOAR at nine or even ten from the overall platform perspective based on my technical knowledge and experience with the platform. I would give a rating of ten for the product. An improvement which can be done is from the overall complexity perspective in Palo Alto Networks Cortex XSOAR. I know it is dealing with a lot of data from many data sources, so if they can add more simplification to their dashboard, it would certainly help further to make this platform more useful. My overall review rating for this product is nine.

My main use case for Palo Alto Networks Cortex XSOAR is that we use it as a SOAR platform, Security Orchestration and Response tool for our security incidents.

I can give you a quick specific example of how we use Palo Alto Networks Cortex XSOAR for a security incident: we have created a lot of playbooks and workflows within Palo Alto Networks Cortex XSOAR and we receive incidents when the criteria is met for the incident based on the rules. Once it triggers, it comes into our queue where we work on those incidents as our daily operations.

I think that is the main use case that we have for Palo Alto Networks Cortex XSOAR.

The best features Palo Alto Networks Cortex XSOAR offers are seamless automations, customized workflows for incidents, and integrations with other tools within the organization or environment and ease of analysis or triage for new beginners.

Seamless automations and customized workflows have helped my team in several instances where we would like to generate automated emails to the people in the organization, either for awareness or for escalation. We can connect Palo Alto Networks Cortex XSOAR to Outlook APIs and then send out emails without writing the email itself. I think it works best in automation.

The stages or status of the incident really helps us in filtering the incidents and also working on the incidents that are in a particular stage. Palo Alto Networks Cortex XSOAR is most useful from start to finish.

Palo Alto Networks Cortex XSOAR has impacted my organization positively because it has these automations and customized workflows. If you have a custom SOC environment in your organization, Palo Alto Networks Cortex XSOAR really helps. It can adapt to your custom SOC environment or your custom escalations, your way of triaging and working on incidents from start to end. That is where you can best trust Palo Alto Networks Cortex XSOAR and it has impacted positively.

Palo Alto Networks Cortex XSOAR can be improved if it can include AI modules within Palo Alto Networks Cortex XSOAR as a product or at least as a summarizing feature. If that is there, I think it would make it easier for analysts to go through the alert.

Another area I can suggest is the searching or reporting feature where you have to write a query, which is definitely good for searching your incidents. However, if you have long queries and if you want to take out reports, that is when the real challenge comes in. Probably an advanced search within Palo Alto Networks Cortex XSOAR incidents tab could address this.

I have been using Palo Alto Networks Cortex XSOAR for three years.

Palo Alto Networks Cortex XSOAR is stable.

I think Palo Alto Networks Cortex XSOAR is pretty scalable; the entire cybersecurity team is using it.

The customer support for Palo Alto Networks Cortex XSOAR is great because it was Palo Alto Networks and we had other products within the pool.

I would rate the customer support for Palo Alto Networks Cortex XSOAR as 9 out of 10.

I did not previously use a different solution before Palo Alto Networks Cortex XSOAR; there was no other XSOAR or SOAR platform that we used.

In my current role, I have not really been exposed to the metrics or monetary save that demonstrate how Palo Alto Networks Cortex XSOAR has positively impacted my organization.

I do not think I can comment on a business relationship with this vendor other than being a customer. I definitely believe we are using Palo Alto Networks Cortex XSOAR as a product, but I am not sure if I can comment on other business relationships.

I have seen a return on investment for Palo Alto Networks Cortex XSOAR; it did save a good amount of time in my previous organization, but I am not sure about my current organization.

My experience with pricing, setup cost, and licensing for Palo Alto Networks Cortex XSOAR is that I was just a consumer as an analyst. I was not part of deploying cost, license, procurement, or proof of concept. As a consumer, I know only so much.

I do not think my organization evaluated other options before choosing Palo Alto Networks Cortex XSOAR because when I joined the organization, they were already using it. I am not sure what options they had in mind.

I would advise others looking into using Palo Alto Networks Cortex XSOAR to go through the work plan or the war room or the workflow that is created for their team. It gives out a lot of syntax or a skeleton structure for their incidents and incident types. If they have a boot camp available, they should get started with boot camp and then go for the incidents. I would rate my overall experience with Palo Alto Networks Cortex XSOAR as 8 out of 10.

Cortex XSOAR is especially valuable for our clients in a manufacturing environment. They have multiple locations, which is the main reason they need to work with Palo Alto Networks Cortex XSOAR.

The biggest advantage of Palo Alto Networks Cortex XSOAR for us and our clients is the support that we are getting from Palo Alto Networks. Additionally, the futuristic technology that they are providing is exceptional.

I am really happy with the analytics part. The visibility and granularity that we are getting from them is at a different level.

Currently, we haven't worked on playbook automation.

It is very difficult to work on the integration part when it comes to implementation. However, when we implement properly, we have a good enhancement.

The biggest challenge when we implement is that we need to have properly certified experienced engineers to do that. Otherwise, it is very difficult to get it implemented.

It is not easy to integrate with other tools. If we have experienced certified engineers, then it will be an easy task. Otherwise, if we don't have certified engineers, it is very difficult. We can't just pass it to the customers and say that they can get it done from their knowledge. We need to have the proper certified experienced engineers to get it done.

It is both difficult to implement, deploy, and integrate the product.

When we position Palo Alto Networks Cortex XSOAR, we are targeting the ISP level and high enterprise customers who can afford that solution. The price will be high, but the solution is absolutely superb. Therefore, we are highly focusing on those kinds of products for the ISP side and high-level enterprise customers.

Still, we are not doing those kinds of things regarding machine learning models in Palo Alto Networks Cortex XSOAR.

The biggest challenge we are facing is the pricing factor and the implementation. We need to have the proper engineers for the implementation and the pricing factor. Otherwise, we are not experiencing any kind of issues.

We prefer if we could get to do configurations and push them throughout the cloud for remote sessions. For remote locations, if we could push configurations and everything through the cloud, that would be great.

I have been working with Palo Alto Networks for almost one decade.

In terms of reliability, we haven't experienced latency problems, but stability-wise, it is almost at 99%, which shows good stability.

Scalability-wise, it is very easy to expand.

The biggest advantage of Palo Alto Networks Cortex XSOAR for us and our clients is the support that we are getting from Palo Alto Networks.

On-premises is the usual deployment model for our clients.

It is possible to quantify return on investment here between 10 to 20.

It is possible to quantify return on investment here between 10 to 20.

When we position Palo Alto Networks Cortex XSOAR, we are targeting the ISP level and high enterprise customers who can afford that solution. The price will be high, but the solution is absolutely superb. Therefore, we are highly focusing on those kinds of products for the ISP side and high-level enterprise customers.

The biggest challenge we are facing is the pricing factor and the implementation. We need to have the proper engineers for the implementation and the pricing factor. Otherwise, we are not experiencing any kind of issues.

Regarding Palo Alto Networks Cortex XSOAR compared to other vendors like FortiNet, the architecture and the solutions provided by Palo Alto Networks are at a very advanced level. For FortiGate, we can do implementation and everything if you are familiar with the GUI. However, it is not the same for Palo Alto Networks Cortex XSOAR.

I would rate this product a 9 out of 10.

We are more of a SI and reseller, not really acting as a customer ourselves. We are reselling Palo Alto Networks Cortex XSOAR and SentinelOne. We are dealing with all Palo Alto products, related to firewalls, including Fortinet, Palo Alto, Check Point, and Cisco.

When these services go live, we will see their full potential. I am dealing with Palo Alto products such as firewalls and SASE, which we have proposed to multiple customers, and we have positioned Palo Alto Networks Cortex XSOAR for a few customers.

The customer was already using Micro Focus, which provided a bundle with their SIEM and SOAR product, requiring a lot of manual work and configuration. To replace that, we are positioning Palo Alto Networks Cortex XSOAR, which can be used in the SOC and do a lot of automation for the customer, but it was expensive, making it essential for the customer to evaluate whether ROI is coming from the business model, as they are also acting as a SOC provider.

Palo Alto Networks Cortex XSOAR is a good product with enhanced and efficient playbooks, as demonstrated during our use case simulations. We have implemented automation features, such as automated responses to email threats and automatic configuration of target devices for blocking specific IPs.

The analytics feature in Palo Alto Networks Cortex XSOAR is impressive. The solution is quite exhaustive regarding integrations, with many pre-integrations available, especially for market-leading products. There might be challenges with make-in-India products, as they tend not to build the necessary connectors. This depends on whether you are selling to enterprises or other customers. For government customers, you might encounter many Indian products, such as firewalls, which could pose integration challenges unless you have open APIs. However, for market-leading products, there are ready-made integrations available.

To improve the solution, it needs to have complete features that are low-code, no-code, and should be plug-and-play. We need to see improvements in that area to facilitate cyber analysts.

Currently, we are not using it in-house; however, we have explored whether we should create our next-generation SOC using IBM QRadar, Elastic, or maybe some other product such as Fortinet.

The technical support provided by Palo Alto Networks Cortex XSOAR is good. I would rate their support around nine out of ten.

Positive

Comparing pricing to Micro Focus, they were offering bundles, making it free with their SIEM. For customers, it is zero versus $20 million, which is why they have to make a decision.

The customer was already using Micro Focus, which provided a bundle with their SIEM and SOAR product, requiring a lot of manual work and configuration. To replace that, we are positioning Palo Alto Networks Cortex XSOAR, which can be used in the SOC and do a lot of automation for the customer, but it was expensive, making it essential for the customer to evaluate whether ROI is coming from the business model, as they are also acting as a SOC provider.

Comparing pricing to Micro Focus, they were offering bundles, making it free with their SIEM. For customers, it is zero versus $20 million, which is why they have to make a decision.

We are considering Splunk, which has a good market presence in the niche. Second is QRadar, which also has a good market presence, but the future with IBM is uncertain. Third is Elastic, which is doing great now as they have formed some partnerships; it will be a good product providing these kinds of services in the future.

We act as a SI with tie-ups with different EDR vendors. We are providing Palo Alto Networks Cortex XSOAR and SentinelOne as our main products.

We have given certain POCs, but we are not using it in-house. We are evaluating different products for our next-generation SOC, considering market conditions and pricing as key factors.

I found it easy to use and configure at the time of evaluation. I have not seen how the machine learning models help prioritize alerts, but this will be evaluated when shown to customers.

I would recommend Palo Alto Networks Cortex XSOAR for big companies only because it may be costly, so small companies will not adopt it unless they have a clear mindset to proceed with this product for specific reasons. It is easy to integrate within existing systems, especially with third-party solutions.

Based on my experience, I would rate Palo Alto Networks Cortex XSOAR a six out of ten.

My primary use cases for Palo Alto Networks Cortex XSOAR are malware incidents, specifically phishing-related incidents, Trojan horses, spyware, and similar threats.

The automation and marketplace features of Palo Alto Networks Cortex XSOAR are what I appreciate most. These features provide flexibility to integrate different threat intelligence feeds and playbooks, and they are enjoyable to create.

Palo Alto Networks Cortex XSOAR has had a positive impact on the mean time to resolution for incidents (MTTR), as it has significantly reduced noise. For instance, I have created custom playbooks for phishing incidents that were false positives, which automatically close incidents.

Regarding areas for improvement in Palo Alto Networks Cortex XSOAR, I want to highlight one concern about playbook creation. While I personally appreciate this approach, I have observed that junior analysts on my team find it difficult to build playbooks. If Palo Alto Networks could improve the ease of use, specifically for playbook creation, that would be beneficial, as this is a gap I have identified.

When I create a playbook for spyware or malware, I need to develop level one, level two, and sometimes level three sub-playbooks. Fetching data in the input and output fields is sometimes challenging. I have observed that junior analysts find this particularly challenging, so I believe it would be valuable to simplify the process of creating and configuring input fields and sub-playbooks.

I have been working with Palo Alto Networks Cortex XSOAR for three years.

Regarding the performance of Palo Alto Networks Cortex XSOAR, I have not experienced any lagging. All pages load quickly in just one or two seconds, and the system works smoothly even when I navigate deep into the playbook section.

Palo Alto Networks Cortex XSOAR has very good application capabilities and is highly scalable. However, scalability depends on the customer using the product, as developing more playbooks requires significant time and effort. Palo Alto Networks does provide prebuilt playbooks that can assist with this.

I have not needed to contact technical support for Palo Alto Networks Cortex XSOAR because the issues I encounter do not require CSP assistance. I was guided by a senior architect during deployment.

Neutral

I have previously used FortiSOAR as an alternative to Palo Alto Networks Cortex XSOAR for incident response and security operations.

The initial deployment of Palo Alto Networks Cortex XSOAR is very straightforward. I only needed to set up the Broker VM or CIE and then the agents, and the system began sending data immediately. This approach is beneficial for XDR purposes and enables integration with SIEM and other products to automate the response flow.

Based on my experience, two to three people are sufficient for deployment. This includes a senior architect, a junior architect or assistant architect, and one resource for training and instruction. Three people are more than adequate, although the deployment can also be accomplished with two people.

When comparing Palo Alto Networks Cortex XSOAR to FortiSOAR, the differences are evident, particularly in the user interface. I would place Palo Alto Networks Cortex XSOAR above FortiSOAR because it provides incident layout flexibility, allowing me to customize incident layouts based on specific requirements.

Palo Alto Networks Cortex XSOAR does not require any maintenance on my end. I only need to check for updates on the content packs I am using, whether they are for malware or other security purposes, since Palo Alto Networks handles all maintenance responsibilities.

The initial deployment of Palo Alto Networks Cortex XSOAR is very easy. I only needed to set up the Broker VM or CIE and then the agents, and the system began sending data immediately. This approach is beneficial for XDR purposes and enables integration with SIEM and other products to automate the response flow.

Regarding the performance of Palo Alto Networks Cortex XSOAR, I have not experienced any lagging. All pages load quickly in just one or two seconds, and the system works smoothly even when I navigate deep into the playbook section.

Palo Alto Networks Cortex XSOAR has had a positive impact on the mean time to resolution for incidents (MTTR), as it has significantly reduced noise. For instance, I have created custom playbooks for phishing incidents that were false positives, which automatically close incidents.

Palo Alto Networks Cortex XSOAR is highly scalable. However, scalability depends on the customer using the product, as developing more playbooks requires significant time and effort. Palo Alto Networks does provide prebuilt playbooks that can assist with this.

Regarding integration capabilities with other third-party tools for enhancing security, integrating tools such as VirusTotal and AutoFocus is very straightforward. I only need to set up API keys and provide URLs. As of my last check, approximately eighteen integrations are available.

I have not explored the machine learning and AI components of Palo Alto Networks Cortex XSOAR because my role focuses on creating custom use cases and playbooks to reduce MTTR. I have not utilized these features at this time.

I would rate this product an 8 out of 10.

We use Palo Alto Networks Cortex XSOAR for incident response as a case management tool. All of our alerts from different tools come into this central place as we have multiple SIEMs. We have items coming from Anomali and other platforms that are not SIEM tools that we bring in. This is our central place where our SOC analysts can work and determine if they need to perform incident response on the alerts they have. It provides them with the ability to do data enrichment, so it has all the information we can provide upfront. They can find out the username, phone number, email address, where they work, and all that information. If it involves a malware file, they can get all the details from VirusTotal, such as the file name, how often it has been in the environment, and similar information. We built a lot of automation around it. From that, we track our case metrics, which helps us leverage how long it takes us to investigate and mitigate any threats.

What I appreciate most about Palo Alto Networks Cortex XSOAR is that it is very open, even more so than Anomali. I can create various custom automations and custom fields. There is significant customization ability in this platform. If I already have an established process, I do not have to change my process to fit into the tool. I can modify the tool to fit into my process, which makes things considerably easier.

All of our alerts from different tools come into this central place as we have multiple SIEMs. We have items coming from Anomali and other platforms that are not SIEM tools. This serves as our central location where our SOC analysts can work and determine if incident response is needed. The platform provides data enrichment capabilities, offering information upfront so analysts do not have to search for it. They can access details such as username, phone number, email address, and workplace information. For malware files, they can retrieve details from VirusTotal, including file names and environment presence. We have built substantial automation around these features, which also helps us track case metrics, investigation time, and threat mitigation duration.

For Palo Alto Networks Cortex XSOAR, there is always room for improvement. One of the significant issues we encounter is system slowdown when we receive an influx of alerts, which inhibits how quickly we can access the information needed for investigation.

I have been using Palo Alto Networks Cortex XSOAR since 2018, for about seven years.

I would rate the stability of Palo Alto Networks Cortex XSOAR a six out of ten.

The scalability of Palo Alto Networks Cortex XSOAR supports our growth and security needs because we can integrate various tools and continuously add more capability. Whatever we can envision with this tool, we can implement. We have not reached a limit on the amount of items we can have in the platform. We manage scaling effectively. Though we experience slowdowns during simultaneous operations, once we get through that period, performance returns to normal and we can process things quickly. There does not seem to be any limitation on the amount of data or alerts we put through the platform.

I follow up with Palo Alto Networks Cortex XSOAR support when issues occur. Their support has been better than Anomali's and they are more responsive. The main challenge we encounter with their support is that their engineers, who handle escalated issues, are located in the Middle East. We often need to accommodate their time zone for meetings. I would rate their support a six out of ten.

Neutral

The deployment of Palo Alto Networks Cortex XSOAR started on-premises and then moved to the cloud. The on-premises deployment was very simple, using a standard shell file. The setup instructions are straightforward - you execute the shell file on the server, agree to terms, and fill in some data points such as passwords. After completing these guided questions and steps, the installation is automated. You do not have to intervene, and it spins up and starts itself. The process is painless to set up.

My advice would be to understand your use cases and ensure this solution addresses them. Test it against other products in the market. Whatever you can envision, you can probably implement. The platform is very supportive of different integrations and tools. I would suggest learning Python or having someone with Python understanding as they develop things in the platform. Having a code-based background is beneficial as the platform is very code-centric for the playbooks. Having that background or at least logic could be helpful. This review rates Palo Alto Networks Cortex XSOAR 9 out of 10.

I am familiar with Palo Alto Networks Cortex XSOAR products, particularly with Cortex. Palo Alto Networks Cortex XSOAR is primarily used for IOC enrichment, IOC harvesting, and correlation, followed by automation.

The integration has positively impacted my organization's mean time to resolution, as both mean time to detect and respond have improved, enabling earlier detection and response.

The playbook automation helped streamline my incident response time by removing delays from the human side and reducing the mean time to respond.

Some advantages I would like to mention include automation which was really helpful for IOC harvesting. It actually reduced the response time by approximately 60 percent.

I did notice some drawbacks, as it is a bit complex. The deployment and implementation are complex in nature.

Integration with third-party tools had some issues, particularly with open source platforms, but enterprise tools integrated just fine. The exact platform we integrated required custom solutions, especially with open-source tools.

I have been using this solution for over two years.

I have come across technical support and found their response to be fast and helpful.

The deployment requires a huge amount of time, approximately five to six months since it was a national project.

I was also involved in the deployment of Palo Alto Networks Cortex XSOAR project.

We had two people from our side who took part in it, including a PM and another technical person while I was the technical architect and solutions architect.

For the capability, I think the pricing and licensing cost for Palo Alto Networks Cortex XSOAR is reasonable.

Overall, I am satisfied with how Palo Alto Networks Cortex XSOAR works for me, as it had a positive impact on my organization's performance.

Most of the tools we integrated into the solution also had AI, and the efficiency started from a couple of places, not just starting from Cortex.

The analytical features of Palo Alto Networks Cortex XSOAR streamline my ability to gain insights and visibility into security threats, especially due to integrations with threat intelligence sources.

I have utilized Palo Alto Networks Cortex XSOAR's playbook automation, which was part of the automation we implemented. I give this solution a rating of 9 out of 10.