No more typing reviews! Try our Samantha, our new voice AI agent.

Cortex XSIAM vs Exabeam comparison

Sponsored
 

Comparison Buyer's Guide

Executive SummaryUpdated on Jan 2, 2025

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

ROI

Sentiment score
4.7
Cortex XDR reduces operational costs, offers better value than Microsoft Defender, and enhances ROI via automation and integration.
Sentiment score
4.3
Cortex XSIAM achieved savings over $500,000 by automating over half of detection and response, optimizing incident management.
Sentiment score
6.3
Exabeam Fusion SIEM provides cost savings, a seven out of ten ROI rating, and enhanced security with machine learning.
They appreciate the rich telemetry data from the solution, as it provides in-depth threat identification.
Cyber Security Manager at Welab bank
Cortex XDR by Palo Alto Networks helps to reduce my total cost of ownership significantly.
Detection and Response Consultant at Inovasys
In Cortex XDR by Palo Alto Networks, most of the remediation is automated and the accuracy is quite good.
Network Security Engineer at Cyberwell Solution
Exabeam offers more machine learning models that detect anomalies.
Analyst at a government with 1,001-5,000 employees
I have seen a return on investment with Exabeam Fusion SIEM, and it is worth the money.
Enterprise Account Manager South at a outsourcing company with 201-500 employees
 

Customer Service

Sentiment score
7.0
Cortex XDR support is praised for expertise and responsiveness, but faces inconsistency and regional communication issues. Ratings: 8-9/10.
Sentiment score
6.1
Cortex XSIAM technical support experiences vary, with premium support praised for expertise, while distributor-based support quality fluctuates.
Sentiment score
6.3
Exabeam's customer service is praised for responsiveness but faces concerns over response delays and regional support limitations.
The technical support from Palo Alto deserves a mark of ten because they reach out within an hour whenever assistance is needed.
Head of data centers at a non-profit with 10,001+ employees
There is no back and forth, and they know what we are asking for and come up with the best resolution for a solution.
Senior Process Expert at A.P. Moller - Maersk
If any of these services are missed, it becomes a problem in terms of support tickets, follow-up, or special configuration that needs to be done in the system.
Chief of IT Architecture at a financial services firm with 10,001+ employees
With premium support, core Palo Alto technical experts handle issues directly.
Team Lead, Security at seamlessinfotech.com
It is ineffective in terms of responding to basic queries and addressing future requirements.
Associate Director at a financial services firm with 5,001-10,000 employees
I had a dedicated person allocated for supporting, and even with them, it was very good.
Cybersecurity Architect at a computer software company with 10,001+ employees
Even with TAM support from Exabeam, many issues go unresolved.
Lead Technical Engineer Security at a tech services company with 11-50 employees
I would rate Exabeam Fusion SIEM support team a nine out of ten; I do not give anyone a perfect score.
Enterprise Account Manager South at a outsourcing company with 201-500 employees
I also had the chance to look at the documentation, and the documentation is good.
Solution Architect at CTC
 

Scalability Issues

Sentiment score
7.6
Cortex XDR efficiently manages extensive workloads across company sizes, praised for scalability, cloud capabilities, and high user satisfaction.
Sentiment score
6.6
Cortex XSIAM excels in scalability and cloud deployment, though integration affects performance and some prefer more on-premises functionality.
Sentiment score
7.3
Exabeam is praised for scalability, ease of expansion, and SaaS benefits, despite minor performance concerns with filters and latency.
You can onboard 10,000 endpoints in just hours, which demonstrates the excellent scalability of this product.
Assistant Security Architect at Cloudnomics
Activating the newly purchased licenses is instantaneous, allowing installations without adjustments since it's cloud-based.
Junior Security Analyst at ITSEC Asia
Cortex XDR by Palo Alto Networks can be expanded anytime by purchasing another license without any issues related to scalability.
Head of data centers at a non-profit with 10,001+ employees
Without proper integration, scaling up with more servers is meaningless.
Associate Director at a financial services firm with 5,001-10,000 employees
The SOC team is responsible for fully managing Cortex XSIAM.
Cybersecurity Architect at a computer software company with 10,001+ employees
Cortex XSIAM is highly scalable.
SOC Analyst at OVELOSEC
I believe Exabeam Fusion SIEM is excellent regarding scalability, and I would rate it at approximately an eight out of ten.
Enterprise Account Manager South at a outsourcing company with 201-500 employees
Regarding Exabeam's scalability and how well it adapts to its customers' needs, I would rate it an eight.
Solution Architect at CTC
 

Stability Issues

Sentiment score
8.0
Cortex XDR is praised for reliable stability and improved performance, despite rare lag during high-stress data loads.
Sentiment score
7.5
Cortex XSIAM is cloud-based, reliable, with minimal maintenance, and occasional update issues are quickly resolved, enhancing performance.
Sentiment score
7.2
Exabeam is stable, meeting user expectations, with minor issues like errors and patch-related downtime resolved swiftly.
Cortex remains fast and responsive, even with increasing data and alerts.
Final Year Student at Gitam University
The thresholds we've seen on our firewall boxes at some instances reached 80% to 85%, but even at that level of utilization, we don't observe any latency or any issues reported with respect to accessing the application.
Senior Process Expert at A.P. Moller - Maersk
Cortex XDR is stable, offering high quality and reliable performance.
Cyber Security Manager at Welab bank
The product was easy to install and set up and worked right.
Owner at Xelere
With continuous integration that the colleagues probably are doing, it is becoming better and better.
Cybersecurity Architect at a computer software company with 10,001+ employees
Overall, Cortex XSIAM is stable.
SOC Analyst at OVELOSEC
These problems were not frequent, and the last six to eight months have been stable.
Lead Technical Engineer Security at a tech services company with 11-50 employees
Regarding stability, I would rate Exabeam Fusion SIEM at approximately eight to eight and a half out of ten because it is very stable.
Enterprise Account Manager South at a outsourcing company with 201-500 employees
Overall, I think Exabeam's stability level is good.
Solution Architect at CTC
 

Room For Improvement

Cortex XDR needs better integration, pricing, UI, feature parity, and automation, while reducing resource use and false positives.
Cortex XSIAM needs better integration, usability, pricing, data management, and support for enhanced performance and flexibility.
Exabeam needs improved real-time analysis, customization, and integration, alongside better UI, documentation, and quicker updates and response times.
Improving reporting and dashboard customization, along with the addition of real-time and exportable reports, would help SOC teams greatly.
Final Year Student at Gitam University
The inclusion of this feature would allow the application of DLP policies alongside antivirus policies via a single agent and console, making it more competitive as other OEMs often offer DLP solutions as part of their antivirus products.
Pre Sales Architect at network techlab
If the per GB data could be provided at a certain level free of cost or at the same cost which the customer is taking for the entire bundle, that would be better.
Cyber Security Information Security Specialist at MHM Holding GmbH
Obtaining validation for integrations from Palo Alto takes around eight months, which is quite long.
Associate Director at a financial services firm with 5,001-10,000 employees
Cortex XSIAM needs improvements in terms of data onboarding, parsers, and third-party integration supports.
SOC Analyst at OVELOSEC
Cortex XSIAM is on the expensive side and requires substantial improvement in pricing.
Solutions Architect at ostec
Exabeam needs to improve its documentation and provide more customization for dashboards and case management.
Lead Technical Engineer Security at a tech services company with 11-50 employees
I have explored the SaaS version; it offers many new features.
Analyst at a government with 1,001-5,000 employees
Exabeam's integration capabilities are not good, as Exabeam has a very limited number of integrations and no out-of-box integration.
Solution Architect at CTC
 

Setup Cost

Cortex XDR offers competitive pricing between $55-$90, though setup costs are high, with flexible licensing for cloud and on-prem use.
Cortex XSIAM is expensive with variable pricing, complexity in licensing, and additional costs for functionalities and resources.
Exabeam's pricing is seen as reasonable and flexible, competitive against pricier rivals, with no extra costs beyond licensing.
The pricing on SentinelOne is far more reasonable and cheaper than Cortex XDR by Palo Alto Networks.
Consultant at a tech services company with 1,001-5,000 employees
I would say it is definitely not a cheap product, considering how mature it is and how scalable all Palo Alto products are together.
Senior Process Expert at A.P. Moller - Maersk
Cortex XDR is perceived as expensive by some customers, yet offers dynamic pricing.
Cyber Security Manager at Welab bank
The first impression is that XSIAM would be more expensive than others we tried.
Owner at Xelere
The product is very expensive.
Associate Director at a financial services firm with 5,001-10,000 employees
Cortex XSIAM is pretty expensive, and the licensing process is not very comfortable.
Director at MICROLOGIC NETWORKS PRIVATE LIMITED
The pricing for Exabeam Fusion SIEM is not cost prohibitive, but it was a little more than I initially thought.
Enterprise Account Manager South at a outsourcing company with 201-500 employees
 

Valuable Features

Cortex XDR offers advanced AI-driven analytics, multi-layered security, and automation, enhancing threat detection and incident response efficiency.
Cortex XSIAM enhances incident response with automation, integration, and machine learning, providing comprehensive network security and threat identification.
Exabeam offers user-friendly analytics, automation, clear dashboards, and strong integration, excelling in security investigations and incident response.
It incorporates AI for normal behavior detection, distinguishing unusual operations.
Cyber Security Manager at Welab bank
The product provides automation responses in case of a threat attack, severity assessments, centralized manageability, and comprehensive compliance features, resulting in reduced costs.
Pre Sales Architect at network techlab
It includes machine learning to easily analyze data and detect complex threats across endpoints, networks, or clouds.
Final Year Student at Gitam University
The advanced visualization capabilities of the product are important for understanding security trends in an organization.
Solutions Architect at ostec
To have Cortex XSIAM available is to basically have integration of all log sources, all alerting, and so on and so forth from firewalls and different tools, to get everything in one place, and afterwards to be able to build on the information that is coming.
Cybersecurity Architect at a computer software company with 10,001+ employees
One of the valued aspects of the product is its use of artificial intelligence to detect security vulnerabilities.
Owner at Xelere
Exabeam's AI capabilities, like the natural language mode, convert natural language into Exabeam queries, enhancing ease of use.
Lead Technical Engineer Security at a tech services company with 11-50 employees
The product offers useful features like the dashboard, timeline, and session views, which enhance our security tools.
Analyst at a government with 1,001-5,000 employees
Exabeam's UEBA is the most valuable feature that I have found so far.
Solution Architect at CTC
 

Categories and Ranking

Cortex XDR by Palo Alto Net...
Sponsored
Ranking in AI-Powered Cybersecurity Platforms
1st
Average Rating
8.4
Reviews Sentiment
6.8
Number of Reviews
112
Ranking in other categories
Endpoint Protection Platform (EPP) (4th), Endpoint Detection and Response (EDR) (6th), Extended Detection and Response (XDR) (4th), Ransomware Protection (2nd)
Cortex XSIAM
Ranking in AI-Powered Cybersecurity Platforms
8th
Average Rating
8.6
Reviews Sentiment
6.7
Number of Reviews
16
Ranking in other categories
Security Information and Event Management (SIEM) (15th), Identity Threat Detection and Response (ITDR) (7th)
Exabeam
Ranking in AI-Powered Cybersecurity Platforms
9th
Average Rating
7.8
Reviews Sentiment
6.6
Number of Reviews
21
Ranking in other categories
Security Information and Event Management (SIEM) (14th), User Entity Behavior Analytics (UEBA) (1st), Security Incident Response (5th), Threat Intelligence Platforms (TIP) (9th), Security Orchestration Automation and Response (SOAR) (10th)
 

Featured Reviews

ABHISHEK_SINGH - PeerSpot reviewer
Senior Process Expert at A.P. Moller - Maersk
Gained full visibility and streamlined threat detection through behavior-based insights and AI integration
Initially, we got to have a lot of false positives when we onboarded, but nowadays it's quite smooth. We have fine-tuned our security policies and allowed different levels of policies to get rid of those false positives. Currently, we are getting a fairly good amount of incidents that are not false positives or benign, but actionable items. The process is streamlined. In the initial days, the operations used to get involved in a lot of benign and other activities, but now the process is streamlined. We are leveraging the auto-detection and remediation plans. The operations teams are now more involved in other business roles as well, not just looking into the logs and fetching out what's happening there. They have fixed a lot of things. Initially, they didn't have IAC code drift detection, cloud posture management, or security posture management, but they have those now. They purchased different vendors and did a merger with that. They have now Prisma Cloud that gets integrated and now they are working with Cortex Cloud. Everything that was negative has now been addressed, and the product altogether looks to be in a very better and mature shape now. Currently, it's more or less detecting the workloads with AI-based best practices. Since most organizations are consuming AI agents and other things, we are looking forward to seeing what other feature enhancements Palo Alto can support in that.
reviewer2541030 - PeerSpot reviewer
Cybersecurity Architect at a computer software company with 10,001+ employees
Unified security monitoring has simplified incident response and improved automated threat handling
The firewall side can make some improvements. I know the firewall on Cortex XSIAM is based on Windows. From what I have experienced so far, I have seen that the policies you can create are actually very in-depth. I mean, you can do most of the things and a lot of integration that you actually want. So if I want to choose to send things to WildFire, for example, I can choose to send it, I can choose to not send it. This basically offers flexibility to implement Cortex XSIAM in more standardized places where you maybe have a certification. I would say that the thing that maybe needs a bit more improvement is the fact that the one with the firewall because I have seen some things there that are kind of hard to manage. You do not really have a very easy way to manage those, unless you actually know where you have put them. So it is very inflexible. In the rest, you have a lot of playbooks that you can do and you can do lots of automation, which is actually easy to manage from what I have seen from my colleagues.
reviewer2265966 - PeerSpot reviewer
Enterprise Account Manager South at a outsourcing company with 201-500 employees
Advanced analytics have transformed our threat detection and streamlined incident investigations
I would appreciate seeing additional dashboards in Exabeam Fusion SIEM or perhaps more options or the ability to customize them further. While we can customize them currently, there may be additional options available. I value the outcomes navigator because it matches the log piece to the use cases, which is helpful. The correlation rules are excellent. I am interested in whether there are additional threat intelligence feeds available that we could use, whether we can integrate our own, or if we could ingest different ones.
report
Use our free recommendation engine to learn which Security Information and Event Management (SIEM) solutions are best for your needs.
900,644 professionals have used our research since 2012.
 

Top Industries

By visitors reading reviews
Construction Company
12%
Financial Services Firm
11%
Manufacturing Company
10%
Comms Service Provider
9%
Computer Software Company
12%
Manufacturing Company
10%
Financial Services Firm
10%
Government
6%
Financial Services Firm
12%
Manufacturing Company
10%
Comms Service Provider
7%
Computer Software Company
7%
 

Company Size

By reviewers
Large Enterprise
Midsize Enterprise
Small Business
By reviewers
Company SizeCount
Small Business46
Midsize Enterprise20
Large Enterprise52
By reviewers
Company SizeCount
Small Business9
Midsize Enterprise2
Large Enterprise5
By reviewers
Company SizeCount
Small Business12
Midsize Enterprise5
Large Enterprise7
 

Questions from the Community

Cortex XDR by Palo Alto vs. Sentinel One
Cortex XDR by Palo Alto vs. SentinelOne SentinelOne offers very detailed specifics with regard to risks or attacks. ...
Comparing CrowdStrike Falcon to Cortex XDR (Palo Alto)
Cortex XDR by Palo Alto vs. CrowdStrike Falcon Both Cortex XDR and Crowd Strike Falcon offer cloud-based solutions th...
How is Cortex XDR compared with Microsoft Defender?
Microsoft Defender for Endpoint is a cloud-delivered endpoint security solution. The tool reduces the attack surface,...
What is your experience regarding pricing and costs for Cortex XSIAM?
I did not participate in pricing discussions for Cortex XSIAM solutions, so I cannot provide a review regarding price...
What needs improvement with Cortex XSIAM?
Cortex XSIAM is on the expensive side and requires substantial improvement in pricing. There are other features that ...
What is your primary use case for Cortex XSIAM?
With Cortex XSIAM, we installed an agent on Active Directory on-premise. We connected our Firewalls to the Data Lake ...
What are the biggest differences between Securonix UEBA, Exabeam, and IBM QRadar?
It mostly depends on your use-cases and environment. Exabeam and Securonix have a stronger UEBA feature set, friendli...
What is your experience regarding pricing and costs for Exabeam Fusion SIEM?
I would say the pricing for Exabeam Fusion SIEM is not cost prohibitive, but it was a little more than I initially th...
What needs improvement with Exabeam Fusion SIEM?
I would appreciate seeing additional dashboards in Exabeam Fusion SIEM or perhaps more options or the ability to cust...
 

Also Known As

Cyvera, Cortex XDR, Palo Alto Networks Traps
No data available
No data available
 

Overview

 

Sample Customers

CBI Health Group, University Honda, VakifBank
Information Not Available
Hulu, ADP, Safeway, BBCN Bank
Find out what your peers are saying about Cortex XSIAM vs. Exabeam and other solutions. Updated: May 2026.
900,644 professionals have used our research since 2012.