Exabeam and Palo Alto Networks Cortex XSOAR compete as leading security solutions, each with unique advantages. Exabeam seems to have an advantage in advanced analytics and user behavior analysis, whereas Cortex XSOAR excels in integration and automation for incident management.
Features: Exabeam offers advanced analytics, user behavior analysis, and comprehensive automation, enabling effective threat detection and investigation timeline creation. It is favored for its easy-to-use interface and cost-efficient pricing. Cortex XSOAR, known for its extensive playbook library and plugins, provides superior integration and automation capabilities. Users appreciate its machine learning integrations and adaptability, making it excellent for efficient incident management.
Room for Improvement: Exabeam requires faster updates, better documentation, and improved real-time flow analysis. Users highlight issues with false positives and request more customizable dashboards and better cloud integrations. Meanwhile, Cortex XSOAR's challenges include complex setup and high licensing costs, with users desiring easier configuration, improved pricing models, and better non-security solution integrations. More automation options and a simpler interface are also desired.
Ease of Deployment and Customer Service: Exabeam is primarily deployed on-premises and in public clouds, with support feedback indicating occasional slow responses. Cortex XSOAR supports diverse deployment options, including hybrid environments, and receives generally positive customer support feedback, although regional support could be improved. XSOAR offers more deployment flexibility compared to Exabeam.
Pricing and ROI: Exabeam is viewed as reasonably priced, offering flexible pricing models and positive ROI through tool consolidation. It is recognized for its affordability. In contrast, Cortex XSOAR is considered expensive, especially after pricing adjustments by Palo Alto. While it’s seen as valuable, the high cost is a barrier for smaller enterprises, though discounts are available for repeat purchases. Both solutions ensure substantial ROI, with pricing being a primary purchasing consideration.
Since we started working with Torq, I am handling much fewer alerts. It is becoming really easy for me to handle an alert.
By the time we officially bought Torq, we already had two workflows that were very helpful to us.
It pretty much took until we got to our first renewal where we said that this is the value we see, this is the things we want more, but that is the first place where we said we are happy enough that we want to renew.
Exabeam offers more machine learning models that detect anomalies.
I have seen a return on investment with Exabeam Fusion SIEM, and it is worth the money.
We are positioning Palo Alto Networks Cortex XSOAR, which can be used in the SOC and do a lot of automation for the customer.
The speed and quality of their answers have been pretty good, as I usually get a response within 24 hours, and they follow up well.
We can always get an answer, and the support team are experts in their own system.
Nine out of ten times, they give me a solution even if it is not the solution I wanted, and I still can get to the result.
Even with TAM support from Exabeam, many issues go unresolved.
I would rate Exabeam Fusion SIEM support team a nine out of ten; I do not give anyone a perfect score.
I also had the chance to look at the documentation, and the documentation is good.
Eight out of ten times, they provide valuable help.
Their support has been better than Anomali's and they are more responsive.
The technical support provided by Palo Alto Networks Cortex XSOAR is good.
Our case management is super scalable.
In terms of scalability, you can do as long as you can build it, and they can support it.
Regarding the ability of the solution to grow in your work environment, if it is scalable, if it fits your business requirements, and if there is room to scale up, the answer is yes, for sure.
I believe Exabeam Fusion SIEM is excellent regarding scalability, and I would rate it at approximately an eight out of ten.
Regarding Exabeam's scalability and how well it adapts to its customers' needs, I would rate it an eight.
The scalability of Palo Alto Networks Cortex XSOAR supports our growth and security needs because we can integrate various tools and continuously add more capability.
Palo Alto Networks Cortex XSOAR has very good application capabilities and is highly scalable.
The issues with scalability arise from the speed of some integrations, as not all are perfectly tuned by Palo.
Most of the time, the system is stable as long as the components that they integrate with are stable.
I have never faced any downtime or issues.
Regarding stability, I have noticed some lagging, crashing, and downtime, which is one of my largest gripes.
These problems were not frequent, and the last six to eight months have been stable.
Regarding stability, I would rate Exabeam Fusion SIEM at approximately eight to eight and a half out of ten because it is very stable.
Overall, I think Exabeam's stability level is good.
The system works smoothly even when I navigate deep into the playbook section.
I would rate the stability and reliability of Palo Alto Networks Cortex XSOAR as a nine.
Torq should offer default templates that can directly scan firewall data and automate actions.
It was able to capture data but was unable to differentiate between the agent hostname we are using and the hostname that resides on the back end of the Internet.
From an engineering perspective, I think more error messages and error handling information for our engineering team would be very helpful.
Exabeam needs to improve its documentation and provide more customization for dashboards and case management.
I have explored the SaaS version; it offers many new features.
Exabeam's integration capabilities are not good, as Exabeam has a very limited number of integrations and no out-of-box integration.
The deployment requires integration and the development of integration modules.
One of the significant issues we encounter is system slowdown when we receive an influx of alerts, which inhibits how quickly we can access the information needed for investigation.
To improve the solution, it needs to have complete features that are low-code, no-code, and should be plug-and-play.
When they bring more and more value into the platform, it makes more sense to pay that price, but still, it is expensive.
Before deciding to implement Torq, I considered that compared to our old case management platform, Torq was a much better price and had a lot better value for what you get out of the platform, which was a key consideration for the company.
It is an expensive solution, not an inexpensive solution, but we get through the flexibility.
The pricing for Exabeam Fusion SIEM is not cost prohibitive, but it was a little more than I initially thought.
For customers, it is zero versus $20 million, which is why they have to make a decision.
Torq's unified platform approach to AI SOC automation and case management has significantly benefited us by integrating the case management platform with the automation, which saves time compared to managing multiple point solutions across our security stack.
The fact that I can build whatever I want within my own imagination and skills without relying on code is the best thing about Torq.
You can copy and paste a cURL command. If you have documentation or APIs, you usually have an example on the side. You basically have all the information on how the API call should be. You can just copy that and paste it into a step, and it will just build the step for you.
Exabeam's AI capabilities, like the natural language mode, convert natural language into Exabeam queries, enhancing ease of use.
The product offers useful features like the dashboard, timeline, and session views, which enhance our security tools.
Exabeam's UEBA is the most valuable feature that I have found so far.
Execution of automatic tasks for collecting, enriching, and correlating security events from hundreds of different technologies.
If I already have an established process, I do not have to change my process to fit into the tool. I can modify the tool to fit into my process, which makes things considerably easier.
We have implemented automation features, such as automated responses to email threats and automatic configuration of target devices for blocking specific IPs.
| Product | Mindshare (%) |
|---|---|
| Palo Alto Networks Cortex XSOAR | 8.8% |
| Torq | 3.7% |
| Exabeam | 3.2% |
| Other | 84.3% |

| Company Size | Count |
|---|---|
| Small Business | 1 |
| Midsize Enterprise | 3 |
| Large Enterprise | 4 |
| Company Size | Count |
|---|---|
| Small Business | 12 |
| Midsize Enterprise | 5 |
| Large Enterprise | 7 |
| Company Size | Count |
|---|---|
| Small Business | 21 |
| Midsize Enterprise | 9 |
| Large Enterprise | 26 |
Torq is the enterprise AI SOC solution that effectively combines adaptive insights and automation to handle critical threats efficiently. It manages threat lifecycles, swiftly moving from triage to response, ensuring effective risk management.
Torq is designed to streamline security operations by aggregating telemetry across your security stack. It investigates significant risks and manages threats from triage to containment and remediation. This AI-driven tool enhances the capabilities of your SecOps team, allowing them to achieve more impactful results without introducing complicated processes.
What are the key features of Torq?In industries like finance and healthcare, Torq shows effectiveness by adapting to specific risk scenarios often encountered in these fields. Its integration with existing infrastructures makes it a valuable asset for maintaining stringent security standards, essential for protecting critical data and operations in diverse high-stakes environments.
Exabeam offers intuitive interfaces, detailed dashboards, and powerful analytics to enhance security investigations. Its machine learning detects complex threats with automation streamlining tasks for efficiency and integration with AWS.
Exabeam stands out with its robust cybersecurity management capabilities, offering advanced user behavior analytics and incident detection tools. Security teams can use its systems to monitor events, create investigative timelines, and analyze log data. While praised for easy use, it benefits from initial training for optimal utilization. Challenges include the need for better flexibility, cost-management, and enhanced AI integration. However, it facilitates seamless AWS integration, real-time updates, and vulnerability prioritization within business contexts. Improvements in dashboard customization and overall performance, especially in UI and log ingestion, could enhance usability.
What are Exabeam's key features?Exabeam is widely used across industries such as finance and government for cybersecurity management. Organizations leverage its capabilities for integrating logs, protecting sensitive environments, and supporting compliance efforts. Its tools aid in detecting anomalies and managing security operations within infrastructures effectively.
Palo Alto Networks Cortex XSOAR enhances security operations automation and integration. Users rely on its incident management capabilities and machine learning to improve response times and efficiency.
Cortex XSOAR stands out for its capability to automate and orchestrate security tasks through customizable playbooks and robust third-party integrations. Its analytics offer insights into incidents, while machine learning prioritizes alerts and reduces false positives. Despite its powerful features, users note room for improvement in documentation, interface design, and integration capabilities. Cost and complexity in setup and deployment are also concerns. Users in security operations centers benefit significantly from automated data enrichment, streamlined incident response, and efficient handling of threats like phishing and endpoint management.
What are the key features of Cortex XSOAR?Cortex XSOAR is implemented across industries for automating and streamlining security operations. Organizations use it to create playbooks, integrate with security tools, and automate repetitive tasks, thereby improving the efficiency of their security operations centers and incident management processes.
We monitor all Security Orchestration Automation and Response (SOAR) reviews to prevent fraudulent reviews and keep review quality high. We do not post reviews by company employees or direct competitors. We validate each review for authenticity via cross-reference with LinkedIn, and personal follow-up with the reviewer when necessary.