Cortex XDR by Palo Alto Networks Reviews

At the internet page, we use Palo Alto Firewall, and for endpoint protection, we use Cortex XDR by Palo Alto Networks.

We purchased Cortex XDR by Palo Alto Networks licenses from a vendor known as PCS in India.

The main benefit of using Cortex XDR by Palo Alto Networks while employing Palo Alto Firewall at the internet edge is that it improves security on our endpoint devices, integrating seamlessly with Palo Alto Firewalls to deliver comprehensive network, analyst, and security details all in a single dashboard, which allows us to manage everything from our network devices.

One of our cases in the dashboard showed that one of our endpoints was interrupted with malware, and when we did not know what type of malware it was, we searched on the AI-driven model within Cortex XDR by Palo Alto Networks to identify the malware, its effects, and mitigation strategies, which serves as a beneficial example.

The best feature of Cortex XDR by Palo Alto Networks is that it provides end-to-end encryption and control over the security of the end devices, and it also offers a simplified web interface to understand each and every aspect from an analyst's perspective, including details about antivirus, malware, and viruses on a simplified GUI management for all the endpoints we have deployed in the network.

Cortex XDR by Palo Alto Networks is compatible with AI-driven solutions and provides all the data fetched from the internet in a single place.

Cortex XDR by Palo Alto Networks blocks threats in real-time and provides a detailed overview, including case details and artifacts, and it provides comprehensive details in the dashboard.

From the perspective of a security analyst, Cortex XDR by Palo Alto Networks reduces the workload because it provides a detailed workflow and artifacts in a single dashboard, enabling me to easily track malicious IPs and various activity details, including AI-driven insights about these malicious sources.

If Palo Alto reduces the pricing slightly for their products, it would make them more scalable in markets such as India and globally for cybersecurity.

Pricing flexibility is the main area of improvement I see. If Palo Alto reduces some prices on their devices and licensing solutions, it would enhance the scalability of their product significantly in the Indian market.

I have been working with Cortex XDR by Palo Alto Networks for around nine to ten months.

The tech support for Palo Alto is fantastic. When I contact them, they respond immediately to tickets and phone calls, leading to an excellent experience.

I rate the technical support of Palo Alto at nine out of ten.

Before Cortex XDR by Palo Alto Networks, we were using Fortinet SASE.

We decided to switch to Cortex XDR by Palo Alto Networks because Palo Alto is a well-known vendor providing reliable security devices such as firewalls and Cortex XDR by Palo Alto Networks, which is regarded as one of the safest products globally.

When I joined my company, we started transitioning from other products to Palo Alto Networks. In terms of competition, there are multiple competitors in the market for Cortex XDR by Palo Alto Networks.

The main difference I see is that Fortinet products can lag in behavior during network operation, which often leads to device hanging and lacks GUI management, while with Palo Alto, I have not encountered such issues.

In comparison to Fortinet, I do not see any disadvantages of Palo Alto, but I can identify several shortcomings of Fortinet.

The implementation of Palo Alto cybersecurity solutions is somewhat complex compared to Fortinet.

TCS, the vendor through which we procured Palo Alto, provided implementation guidance to our team and helped us deploy Palo Alto in our network.

The cost of Cortex XDR by Palo Alto Networks depends on the number of users, as we must purchase licenses according to how many we want to deploy in the network, which is purely dependent on the company's income department.

The cost also depends on the users of the company.

Since we integrated Cortex XDR by Palo Alto Networks into our network, alert triage times have decreased significantly.

In a monthly scenario, the alert triage time is reduced by approximately ten to fifteen percent.

The workload is reduced by approximately fifteen to twenty percent, and the time saved is also around fifteen to twenty percent.

As of now, I do not notice any missing information in Cortex XDR by Palo Alto Networks from my side.

I do not expect any new features to be added to Cortex XDR by Palo Alto Networks in the future because it already provides a simplified GUI and management that I find very satisfactory.

I rate Cortex XDR by Palo Alto Networks at eight as a product and nine as a solution. I do not assign it a ten because while Palo Alto is the best now, we cannot predict the future and there are other good vendors such as Check Point that might come into prominence.

To other organizations considering Cortex XDR by Palo Alto Networks, I recommend definitely considering it.

I would recommend Cortex XDR by Palo Alto Networks over other solutions.

For users who want to start using Cortex XDR by Palo Alto Networks, my advice is to switch immediately from other vendors to Palo Alto.

I find that the onboarding process for Palo Alto is very good overall.

Palo Alto is one of the most stable and scalable vendors in the market, which is why I admire their OS and devices.

I rate Cortex XDR by Palo Alto Networks with an overall review rating of eight.

Cortex XDR by Palo Alto Networks has been in use for more than two or three years, starting in 2022.

The most important features of Cortex XDR by Palo Alto Networks are the tight integration with the Palo Alto environment. It is not just an EDR solution, but a full security suite with automation as the main driver, as well as the networking side.

EDR solutions are generally lacking on the networking side as they focus solely on the endpoint side. The SOAR side is another valuable feature because it is being used extensively, particularly the Triage functionality and effective triage without human intervention.

In the future with new AI technologies, there is significant potential. A POC is currently being conducted with ARIS, the Palo Alto AI offering, and it is planned to be purchased for the next year.

When using Cortex XDR by Palo Alto Networks in a tightly populated environment, all vulnerabilities, threats, and zero-days that can affect the environment become visible, along with how to mitigate them in a fast way to detect and mitigate.

More integration and marketing would be beneficial. This is a full cloud solution, but there are some GRC-related issues that can be bypassed to some extent. In the future, there may be some issues in the environment because although the product receives telemetry and it works, it is actually getting much more information for analysis.

The preference would be to have separated isolated zones where if working in the Middle East, that data should reside in the Middle East, be analyzed and processed, and not be shared through other regions.

The ESA, customer success, and focus services are paid for, and these services can be utilized for other products as well, which is a huge advantage. However, if you do not have Palo Alto in your environment, you are paying these additional services just for Cortex XDR by Palo Alto Networks, so it is not a cost-effective solution.

Cortex XDR by Palo Alto Networks is stable with no performance issues.

Cortex XDR by Palo Alto Networks is scalable.

A special agreement exists with Palo Alto for customer focus and customer success services, so it is not a problem.

Before that, when comparing with other vendors, if you do not have customer CS and PS services, there are two services, and PS as well. Three services have been purchased: customer success, focus services, and professional services.

If all three services are purchased, it is very straightforward. If any of these services are missed, it becomes a problem in terms of support tickets, follow-up, or special configuration that needs to be done in the system. All three services are being paid for. From this perspective, if all three services are purchased and they come with the cost, it is superb. If any of these services are missed or if you do not get a chance to implement these services, it becomes a problem.

Negative

As the IT Security landscape is changing in unprecedented level, Cortex XDR is being selected for major detection, mitigation with rapid Automation capabilities covered in this solution.

In the initial phases, the setup of Cortex XDR by Palo Alto Networks was not straightforward because the product was new. There were some issues, but as the market increased, I can assure that if the project were done this year, it would be much faster and more convenient.

Three years ago, the integration and deployment were not very fast. There were some issues at that time. Now, if the project were started from scratch this year or next year, there would not be any problem.

From the correlation perspective, Cortex XDR by Palo Alto Networks is ahead of CrowdStrike.

Cortex XDR by Palo Alto Networks has been used extensively. This organization is one of the largest Palo Alto companies in the region.

Palo Alto is the core of the security infrastructure in the environment. The products in use related to Palo Alto on the XDR side are mainly integrated with the EDR side, automation, and reporting. It is integrated with Palo Alto XSOAR, Prisma Cloud, Palo Alto firewalls, Prisma Access, and the client side. The cloud SOC side and XDR cloud are also being used. The only thing that has not been tested is the AI Cortex XDR AI agent. Other than this, all functionalities for the XDR side are being used. It is a combination of EDR and automation, as well as logging with Triage.

There is hands-on experience working with Cortex XDR by Palo Alto Networks.

Palo Alto is the main vendor driving the XDR market. It is not an EDR which solely relies on the endpoint agent. The difference is that integration and collection of other log sources and the detection and mitigation technologies are highly valued. It is possible to integrate firewalls, another vendor firewall. It is not just collecting logs, but also making meaning of that log or action compared to other devices.

It is working at the endpoint side, the networking side, the response side, the vulnerability side, as well as the governance side. It is much more sophisticated in terms of detection and mitigation compared to CrowdStrike. CrowdStrike is the main vendor in the market or the head-to-head vendor that can compare with Cortex XDR by Palo Alto Networks.

What is missing in the XDR side is the hype, as EDR started before XDR. As you know, EDR response came first, then XDR followed. CrowdStrike got all the benefits of being first, and then Palo Alto came after. From the customer side, CrowdStrike is much more used in the market, so it has received much more information and IOCs coming from the endpoint compared to Palo Alto. However, Palo Alto IOCs are mainly coming from not only the endpoint side but also from the networking side, cloud side, and any other telemetry mainly from the Palo Alto ecosystem.

CrowdStrike markets itself as the independent vendor which can integrate with major security vendors. You can integrate Palo Alto products with CrowdStrike, you can integrate InfoBlox with CrowdStrike, or you can integrate any product with CrowdStrike because it is an API-driven integration and publicly available in the market. On the XDR side, Palo Alto should make this integration available so that you can integrate it.

Triage can be performed more than two or three times much faster compared to classical triage. However, human intervention is still needed because the product is in English. Since the main language is not English, somebody from the SOC level two conducts additional triage for high and critical incidents.

The main point is related to Palo Alto because the ESA licensing approach is being used. Credits are being received for the Strata side, XDR side, and cloud side. The credit usage is very convenient, but this product is not cheap. Hefty money is being paid to work with and use this product compared to other solutions. In short, this is not a cheap solution.

It cannot be recommended to small companies. It is good for large companies who want the best solutions because Palo Alto offers the best of the best solutions and have the money to pay for it.

Regarding value, security value versus real monetary cost is an effective solution. However, when going into deep analysis, whether this product is needed and if it gives real value is uncertain. It is working fine, but it is not known if it is a deal breaker in terms of cost optimization and effectiveness. It is good.

First, if you have many products with Palo Alto on the networking side, SOAR side, cloud side, and cloud security, Cortex XDR by Palo Alto Networks is the right choice.

If you want an independent solution which is more rapid to deploy and agile, XDR may not be the right choice. Customers need to take into account their usage of the Palo Alto environment. If there is heavy Palo Alto usage, XDR is the right choice. If there is no Palo Alto in the environment, EDR instead of XDR is recommended.

This review gives Cortex XDR by Palo Alto Networks a rating of 8 out of 10.

We are using Cortex XDR by Palo Alto Networks for analysis parts, incident response, and monitoring of alerts.

While we were doing implementation, it was our first time, and we were facing some errors in adding the hosts, servers, and endpoints in Cortex XDR by Palo Alto Networks. We now get the current features, such as the current status of all the hosts and servers. After that initial period, we are not facing any type of challenges.

Cortex XDR by Palo Alto Networks has changed the way our security team detects, investigates, and responds to threats significantly, as it quarantines many types of alerts, including ransomware and malware alerts, by itself. It is doing good work, and we have good features such as live response, where we can take an RDP of any desktops or laptops to check for malware, and the sandboxing feature is also quite valuable, with good reporting on files.

One major outcome our organization achieved with Cortex XDR by Palo Alto Networks is that it is a good tool for analysis, remediation, and incident response, with no negative points in terms of budget and overall effectiveness. In a positive way, it is a good tool for the analysis part, remediation parts, investigations, and incident response. For everything, Cortex XDR by Palo Alto Networks is a good tool. As per budget and everything, it is very good. In the negative way, I cannot find any negative point in it. As per its price and all, it is a very good tool.

Cortex XDR by Palo Alto Networks is user friendly. First of all, its UI is user friendly. When we are using Cortex XDR by Palo Alto Networks on any servers and endpoints, it works very smoothly without buffering problems, and we have many features which are not available in other XDRs.

One improvement I would like to see in Cortex XDR by Palo Alto Networks is for the user interface to be more user friendly after recent updates, as the changes initially posed a challenge but became manageable after working on it for about 15 days. After gaining hands-on experience with it for 15 days, it is now good.

From the features perspective, I feel there are no missing features, and overall, it is good.

I have been working with Cortex XDR by Palo Alto Networks for two years.

I have not experienced any crashes, downtimes, or performance issues with Cortex XDR by Palo Alto Networks.

I find Cortex XDR by Palo Alto Networks to be scalable.

The customer service and technical support from Palo Alto Networks are good. On a scale of 1 to 10, I would rate the tech support for Cortex XDR by Palo Alto Networks as nine.

The initial setup process and deployment of Cortex XDR by Palo Alto Networks was straightforward.

I have not seen a return on investment in the traditional sense, as our company purchased Cortex XDR by Palo Alto Networks after using a different tool, which had a price about 40 to 50 percent more than Cortex XDR by Palo Alto Networks.

Cortex XDR by Palo Alto Networks was purchased directly from Palo Alto, not through the AWS marketplace or local channels.

We evaluated many products, including different EDRs by various organizations. Cortex XDR by Palo Alto Networks convinced us with its powerful toolset and quick response capability. The quick response allows analysts to act swiftly, and when comparing features and pricing with other products, we found Cortex XDR by Palo Alto Networks to have competitive features at a lower price, which led to our decision to choose it. It is a powerful tool, and the main thing we have received by Cortex XDR by Palo Alto Networks is a quick response. If an analyst gets a quick response, he can do quick actions. By comparing the different products, we have seen the features which Cortex XDR by Palo Alto Networks is providing as per other products and as per their prices, and Cortex XDR by Palo Alto Networks price is 50 percent less with the same features.

I have no specific recommendations for organizations considering Cortex XDR by Palo Alto Networks, but I would like to ask what feedback or courses Palo Alto Networks will provide. I have rated this review at 9.5 out of 10.

We have created use cases for Cortex XDR by Palo Alto Networks depending on customer requests and infrastructure, so there were many use cases that we developed.

There was a request from a customer regarding non-personal accounts to be listed, which I handled using Cortex XDR by Palo Alto Networks.

There are multiple use cases when different users use different applications, and during that period, we implemented Cortex XDR by Palo Alto Networks according to those use cases.

Cortex XDR by Palo Alto Networks has multiple features, including forensics, host insight, event collection, and checking different features such as recording, data lake storage, behavior profiling, inventory, search and destroy.

Cortex XDR by Palo Alto Networks has positively impacted my organization by being very user-friendly, and whenever we integrate it, the integration is seamless and we receive quick responses.

Since using Cortex XDR by Palo Alto Networks, our MTTR has reduced, which means the mean time to resolve any ticket has been reduced.

I have seen almost a thirty to forty percent reduction in costs or time since using Cortex XDR by Palo Alto Networks for a month.

There are many ways Cortex XDR by Palo Alto Networks can be improved, especially since there are bugs in the product. When normalizing anything or when issues occur, we have to open a priority one or priority two ticket with Palo Alto, so it should accept and resolve it on priority.

Whenever product level support is needed for Cortex XDR by Palo Alto Networks, it should provide a response because a ticket that is raised should receive a response.

I have been using Cortex XDR by Palo Alto Networks for five years.

Cortex XDR by Palo Alto Networks is relatively stable, but there are some glitches.

Cortex XDR by Palo Alto Networks has huge scalability, and you can deploy it according to your requirements.

I am facing issues with customer support for Cortex XDR by Palo Alto Networks, so I am not satisfied with customer support.

It took my team almost one month or more to start seeing meaningful value from Cortex XDR by Palo Alto Networks after deployment.

I have seen a return on investment with Cortex XDR by Palo Alto Networks, as both money and time have been saved, which is a great solution.

My experience with pricing, setup cost, and licensing for Cortex XDR by Palo Alto Networks is that it is at a much higher rate.

I would rate Cortex XDR by Palo Alto Networks at an eight out of ten because it is a good product, but the main problems are with support, such as ticket opening and response times, which reduce the overall rating. Beyond that, the product is good and it works.

Regarding Cortex XDR by Palo Alto Networks' AI capabilities, I think there is improvement on a day-by-day basis, and that is a positive thing.

The accuracy and reliability of Cortex XDR by Palo Alto Networks' AI output is good as of now, but there are many things that need improvement, especially regarding security and governance on AI, which depends on feedback whenever there is any breach, as we have opened a ticket with the support team and they are conducting data collection.

Cortex XDR by Palo Alto Networks is deployed in my organization mostly as a hybrid cloud.

From a security perspective for Cortex XDR by Palo Alto Networks, we faced challenges with accessibility and determining how data routing would go to Cortex, which required patience and architectural level understanding. This is something that takes time, but once it is done, you will be satisfied.

What ultimately convinced me to choose Cortex XDR by Palo Alto Networks over other solutions was that it had a more user-friendly GUI and was overall more friendly.

If I had to highlight one major outcome my organization achieved with Cortex XDR by Palo Alto Networks, it would be a reduction in incident response time, and it is more focused on the attack surface.

Cortex XDR by Palo Alto Networks has changed the way my security team detects, investigates, and responds to threats by allowing us to see what is happening in the window, distinguishing between true positives and false positives through training, analysis, and AI, so we can take precise decisions to block and take necessary action on the end machine, whether it might be a firewall, web, or cloud.

Cortex XDR by Palo Alto Networks has helped me communicate security value or risk reduction to leadership and executives through a dashboard where I can project outcomes.

I recommend Cortex XDR by Palo Alto Networks for others looking into using it.

My overall review rating for Cortex XDR by Palo Alto Networks is eight out of ten.

I use Cortex XDR by Palo Alto Networks in my company, which is a finance organization. Currently, more than 50,000 to 60,000 people are using Cortex XDR by Palo Alto Networks in my company. We do not have an administrator for Cortex XDR by Palo Alto Networks.

All features of Cortex XDR by Palo Alto Networks are good; the feature particularly important to me is malware detection, which is good.

Cortex XDR by Palo Alto Networks has changed the way my security team detects, investigates, and responds to threats, as we are able to see the files, unwanted files, unsecured files, and unauthorized files, so we are quarantining them. Additionally, it is able to block USB access.

The major outcome my organization achieved with Cortex XDR by Palo Alto Networks is that we find malware files and identify vulnerabilities that attackers could exploit. We are able to highlight these findings and ask the team to review the process, identify which executable files are vulnerable, obtain CVE data, and identify the hosts that are vulnerable to published CVEs.

I have faced some issues with Cortex XDR by Palo Alto Networks; there is room for improvement in the sense that certain options prevent us from seeing and segregating data. For example, we have servers as well as endpoints, but segregation is not available in some areas, such as device control violation.

Segregation in Cortex XDR by Palo Alto Networks means I want to select and filter only servers, but that filter is not available. When I want to write a query in some other areas, I am not able to identify where I want to filter very narrowly. I am unable to see filters for servers separately and for workstations separately.

I would like to see additional features in Cortex XDR by Palo Alto Networks such as a query builder, then a dashboard for device control violation, and I want a separate dashboard with queries as well.

I would also add that if the dashboard of Cortex XDR by Palo Alto Networks remains more user interactive, it will be much better. We have not created any dashboard and have only seen the predefined ones. Additional dashboards would be helpful, such as one for device connection lost, where we can see every hour's data from a single point.

I have been using Cortex XDR by Palo Alto Networks since September.

I would rate their technical support for Cortex XDR by Palo Alto Networks as a nine.

Before Cortex XDR by Palo Alto Networks, I did not work with other products.

The initial setup of Cortex XDR by Palo Alto Networks did not present any difficulty; we did not face any kind of difficulty.

I installed Cortex XDR by Palo Alto Networks with the help of a consultant. The implementation of Cortex XDR by Palo Alto Networks took approximately not very long; it was very easy.

Before choosing Cortex XDR by Palo Alto Networks, I did evaluate other options.

Cortex XDR by Palo Alto Networks has helped me communicate security value or risk reduction to leadership or executives, as risk reduction is evident. We have not fine-tuned it yet, but we have just procured it as a new tool. However, we are able to see some of the cases which are genuine, and hopefully the results will be good.

The pricing for Cortex XDR by Palo Alto Networks is fine.

I bought Cortex XDR by Palo Alto Networks from a third party.

I would rate this product overall as a nine.

The best features of Cortex XDR by Palo Alto Networks are apparent when I compare it to other tools. Palo Alto is more difficult initially, but once you start learning how to use it, particularly the query language, you realize its power. When we use MDE, it uses KQL, which is similar to SQL. However, Cortex XDR by Palo Alto Networks uses XQL, which is more difficult but allows you to get significantly more information. Once you become familiar with it, it is a more powerful tool. For example, Cortex XDR by Palo Alto Networks has an automatic tool, which is a sandbox for local analysis that is incredibly useful for malware detection. I would say that I prefer Cortex XDR by Palo Alto Networks over MDE. To sum it up, it is a stronger tool for me.

The way we detect, investigate, or respond to threats with Cortex XDR by Palo Alto Networks is basically the same as with other tools, but once we start using Cortex XDR by Palo Alto Networks, we have different tools for different clients. When we use Palo Alto, it is basically the same, but we normally get a little bit more time because if we want to make a strong investigation for one incident, we have to make queries and look at different parts of the interface. There is a part of the interface called alert debug, which is more technical. If you click on the incident in alert debug, you can see the whole information of the incident in raw JSON format. To sum it up, it will make the investigation slower, but as I said before, it is better for the investigation because you have more information.

In Cortex XDR by Palo Alto Networks, there are areas that have room for improvement. I have been working with XQL, the language they are using, and they can really work on that language. The main difference between CrowdStrike, MDE, and Cortex XDR by Palo Alto Networks is that Cortex XDR by Palo Alto Networks is the most powerful tool, but XQL is a challenge. When I see colleagues who are not that experienced, they are looking for how to use XQL. They could either use another language to ingest the data sets, which is the main reason why they use XQL, or make XQL easier with tutorials. The difficult part for analysts is learning how to use Cortex XDR by Palo Alto Networks and how to look for information. However, once they know the language, the interface part is very easy. To sum it up, I would say either implement another language, which is not a real solution, or create tutorials to make it easier for analysts to learn XQL.

I have used Cortex XDR by Palo Alto Networks for one year and a half.

Cortex XDR by Palo Alto Networks is a strong tool, but it is true that digesting information sometimes makes the tool go a little bit slower. I would rate this as a seven.

Cortex XDR by Palo Alto Networks is very scalable, but I do not think it is affordable for a small enterprise. For a small enterprise, MDE would be more appropriate, but that is another question. Regarding scalability, because of the data digesting, I do not really know how it will work for a small enterprise. I would rate this as an eight.

The technical support for Cortex XDR by Palo Alto Networks is very good. Once I talked to technical support in a live chat, and it was helpful. I think it may have been AI, but it solved my question. I would rate this as a ten.

Cortex XDR by Palo Alto Networks requires maintenance. However, not for me personally, because I am not the one doing the updates. I know that sometimes L2 and L3 teams from a SOC have to coordinate with the updates that the tool makes so they can use some parts of the interfaces. The point is that my team in L2 and L3 does not really have to do anything for the updates. The tool updates itself, and in the new patch, we are told what the new part is, but not from our part in the SOC. You do not have to do anything.

It depends on the user and how serious you are going to take the learning path of the language with Cortex XDR by Palo Alto Networks. Taking into account all the different interfaces and a normal user starting with the tool in L1, I would say that to completely dominate the tool, if you want to reach proficiency level five, you can achieve this in one month. However, to completely dominate the tool, it can take four to six months because it depends on how many incidents you get to see. I do not know if a new user from another SOC gets to see all the incidents I see. However, in my SOC, I would say that in six or seven months, you can achieve mastery.

My overall rating for Cortex XDR by Palo Alto Networks is a ten. It is my favorite tool, along with CrowdStrike, and I would rate it as a ten.

I have used Cortex for more than I worked in Cortex. I have around 2.1 years of experience using Cortex XDR, but currently, I am using Cortex.

My main use case for Cortex is to prepare the chart flow of the main Cortex XDR. In Cortex XDR, we have to alert for our auto-triaging and repetitive tasks, and we use it for triage automatically. We use it for CTI Cyber Threat Intelligence enrichment, such as IP, URL, and IOCs, automatically. It also has reputation checks using VirusTotal, abuse.ch, and others for the purpose of the uses in Cortex XDR. It also includes playbook automation. For example, Cortex has many playbooks for phishing, malware, infection, ransomware, and lateral movement. These playbooks automatically conduct the entire investigation and response. In case management, it stores details, timelines, evidence, and others for easier incident tracking. From the SOC perspective, we have to reduce false positive cases, and it reduces duplicate alerts, allowing our SOC analyst to respond faster. On the other hand, for the use of the EDR, Cortex provides detection behavior, attack prevention, and can always identify file-less and memory-based attacks and UEBA normally.

An additional point I need to add in Cortex XDR is manual commands during the investigation, such as Cortex war room commands, IP reputation checks, hash look analysis, and endpoint isolation. These help us to conduct a faster investigation. Additionally, we need to create and modify playbooks according to the organization and the needs of the organization's use cases, for example, auto-disabling a user in case of a suspicious login, auto-quarantining an endpoint with malware, and an auto-phishing and investigation workflow. We use Cortex for reporting to generate incident summary reports, post-incident reviews, and RCA documentation. We integrate it with tools such as SIEM, EDR, firewall, email security, web, and others for alert correlation.

The best features of Cortex are automated incident response, playbook automation, cyber threat intelligence, and management. It includes case and incident management, such as incident details, evidence, timelines, and using the dashboard. There is a war room for investigation and to consume alert correlation rules to reduce noise and false positives. It has over 700 integrations. It works with SIEM, EDR, firewall, email security, the cloud environment, and many others. Additionally, it has endpoint detections, behavior analytic UEBA, and machine learning-based detection using ML modules to detect advanced threats. There's a centralized data lake and customized dashboard reports.

I find automation through the playbook to be the most valuable feature I use day-to-day. Playbooks save analyst time. If used for Cortex, it saves the analyst's time with a reduction in false positives. For IOC enrichment, we utilize MTDR, mean time to respond, to resolve incidents faster.

I notice a positive impact since using Cortex. We experience a faster, quicker response. Regarding positive changes, if we have a short positive, we investigate the IP, URL, VirusTotal, and abuse.ch. We use XDR, and it's fast and reliable with no human error. It automatically works to reduce the workload of the SOC analyst, thus decreasing manual work.

There are no other improvements Cortex needs in my opinion.

I have around 2.1 years of experience using Cortex XDR, but currently, I am using Cortex.

Cortex is stable in my experience.

Cortex has good scalability and can handle growth and increased workloads well.

The customer support from Cortex is very good and very useful.

Positive

I did not use a different solution before.

My experience with pricing, setup cost, and licensing is that it is high, but it is better for the SOC environment and for the users.

I notice time saving as a return on investment.

My experience with pricing, setup cost, and licensing is that it is high, but it is better for the SOC environment and for the users.

Before choosing Cortex, we looked at different platforms for automation and chose one after reviewing which one was performing higher in the market, apart from Cortex.

My advice for others looking into using Cortex is that it is very easy to use and very useful for the customer environment, whether it's a public or private one. It is extremely helpful from a SOC perspective, requiring very little time to manage situations, especially during integration, which is necessary. Cortex is very useful and cost-effective, in addition to being very easy to use.

My company has a business relationship with the Cortex vendor for business purposes.

I would rate this product a 7 out of 10.

My main use case for Cortex XDR by Palo Alto Networks is to secure the agents and hosts, and I use Cortex portal for troubleshooting and explaining security incidents.

It helps because it gives a lot of detailed information regarding the situation, what was happening, which processes were involved, and at which exact time it happened. This information helped us a lot to determine what really happened.

I can give a specific example of how I use Cortex XDR by Palo Alto Networks in my daily work. We are getting a notification in our ticketing system from Cortex once the incident appears in Cortex system. Then I analyze the logs and all the information gathered by Cortex agent and I check all the processes which were involved. Then I consult with my colleagues, and after that, I consult with the user, trying to figure out why it happened.

The best features Cortex XDR by Palo Alto Networks offers are Live Sessions with the host. I can connect to the host directly through Cortex, block the host, cut off the network on the host, and manage the hashes from the processes. I can allow or block each and every process on the host or in the general ecosystem. Those are the best features.

On a daily basis, I find myself using the allowing and blocking of hashes from certain services or processes the most, and those are the features I am using most frequently.

Cortex XDR by Palo Alto Networks has helped us a lot with securing the whole environment and the whole IT structure. Since every computer has Cortex agent installed, now we have full knowledge of what is happening on the client, even on computers which are not managed by our MDM. This has helped us a lot to make the whole organization secure, and we can take action right away. Cortex is a single point for us when it comes to managing security operations on the hosts.

I can share specific outcomes or improvements I have seen since deploying Cortex XDR by Palo Alto Networks. Once we implemented this tool, at the beginning we had a lot of incidents, almost all incidents were created by the users, due to a lack of awareness, knowledge, and security awareness from the user's perspective. After we had a lot of awareness campaigns about this tool and about proper behavior on the internet or in daily work, we reduced the number of incidents by up to 80 to 90 percent.

Cortex XDR by Palo Alto Networks can be improved.

I would like to see easily manageable filters in Cortex XDR by Palo Alto Networks which can help us to reduce the noise from Cortex, meaning the false positives or not really important situations happening on the hosts. This might improve the use of Cortex platform.

On a scale of 1 to 10, I would rate Cortex XDR by Palo Alto Networks an 8. I am really happy about using this tool and this platform. In some cases, there are too many options for me, and it is a bit too hard to find some settings which I really need to implement. Maybe making the interface a bit more user-friendly would help. But I would say that is the only thing.

I have been using Cortex XDR by Palo Alto Networks for over three years.

I think Cortex XDR by Palo Alto Networks AI capabilities in terms of governance and security is a really good idea, and I believe it is going to help us a lot in terms of quickly solving incidents or finding some useful features on the platform itself.

Regarding Cortex XDR by Palo Alto Networks AI capabilities for accuracy and reliability of output, I believe those kinds of tools are still in development mode or stage, so I believe it is going to be only better and better in the future.

I believe the biggest security challenge we were facing before implementing Cortex XDR by Palo Alto Networks is just people's awareness in terms of security behavior. Before Cortex XDR, we did not have any tool which might be so active on the host itself, since Cortex is blocking actions on the clients right away, which previously did not happen. Now it is way easier to manage those situations, and since we have this tool, we can react right away. Almost all dangerous situations are blocked on the hosts, preventing issues in the whole infrastructure. The whole organization is more secure. With the security awareness campaigns, we are having less and less such situations and security incidents, which is good.

I was not the one who chose Cortex XDR by Palo Alto Networks, the company was. I believe the main reason for choosing Cortex XDR by Palo Alto Networks was that the company is using the network devices and network hardware from Palo Alto. Almost all of our network infrastructure is built on those devices, making it a natural choice to use their tools.

Since Cortex XDR by Palo Alto Networks and Cortex agents are really powerful tools in terms of prevention, blocking unwanted situations and incidents helps us a lot with taking action right away. If the incident was really dangerous, we can take action and block the client right away from the platform. We can then spend some time analyzing or contacting the users or someone responsible for this, but with the secure environment and protection for other devices in our environment. Overall, I rate Cortex XDR by Palo Alto Networks an 8 out of 10.

Cortex XDR by Palo Alto Networks is used on the enterprise level to prevent malware or attacks from hackers trying to compromise the server or endpoints. It's installed on every device connected to the network to ensure security and protects users from accidentally downloading malicious content that could lead to breaches. The centralized console simplifies setting things up for a company, eliminating concerns about user management since users lack the authority to alter configurations.

The most valuable feature of Cortex XDR by Palo Alto Networks is real-time protection. It runs immediately when the computer is turned on due to a feature called anti-tamper, preventing hackers or malicious actors from deleting the antivirus. Cortex XDR by Palo Alto Networks is centralized within one console, simplifying company-wide management.

It also has an auto-block feature, removing malicious content in real-time. This reduces resource needs, as issues can be managed directly from a single location, eliminating the need for a management team at each site. Communication with the local personnel can resolve issues efficiently. The product's ability to monitor multiple endpoints saves time and costs.

Cortex XDR by Palo Alto Networks could improve its user interface, which is more complicated compared to competitors such as SentinelOne. SentinelOne's minimalistic UI is easier to navigate, requiring less time to learn. Cortex XDR by Palo Alto Networks' technical terminology can be challenging for companies where IT personnel may not be specialized in cybersecurity.

Adding more features could complicate things further, which could detract from its effectiveness. Companies investing only in Cortex XDR by Palo Alto Networks without utilizing the broader Palo Alto ecosystem might consider alternatives.

I have been using Cortex XDR by Palo Alto Networks for almost two years, from my intern period until I received my contract with the company.

Cortex XDR by Palo Alto Networks performs well during daily operations. If there is a threat or significant activity at one location, it manages without issues. Even in terms of server reliability, I have not observed any downtime in my experience.

Cortex XDR by Palo Alto Networks is quite flexible in scalability. If a company hires a new employee or adds new devices, they simply request new licenses. Activating the newly purchased licenses is instantaneous, allowing installations without adjustments since it's cloud-based.

I typically communicate with the technical support and customer service of Cortex XDR by Palo Alto Networks during implementation, especially for troubleshooting related to server issues since that is critical.

In an instance where a server could not connect to the console, support was swift to respond. They escalated the issue for deeper investigation, resolving it within an hour.

In deploying Cortex XDR by Palo Alto Networks, we first gather extensive information about the company's system and devices, including the number of devices, servers, computers, laptops, and any mobile phones used for work. Once we ascertain compatibility, we proceed with installations, providing documentation and suggestions for upgrading if necessary.

Two methods are utilized: mature companies use endpoint management programs to push installations, while startups handle it manually. Verification of connectivity to the console follows installation, with troubleshooting completed for any issues.

I face several challenges when installing Cortex XDR by Palo Alto Networks. One challenge is installation on local computers in manufacturing environments. This is resolved by using VM broker servers for internal communication. However, resistance from some employees who question the necessity of installations remains a hurdle.

If a company purchases only Cortex XDR by Palo Alto Networks, I might advise them to think twice. However, if they already have components of the Palo Alto ecosystem, such as a firewall or threat intelligence, I recommend choosing Cortex XDR by Palo Alto Networks because it will be more powerful in that case.

I do not track my customers' preferences regarding the deployment of Cortex XDR by Palo Alto Networks, but most times, I advise them to use the cloud option. With on-premises deployments, they need both a passive and active server to ensure Cortex XDR by Palo Alto Networks' availability at all times. This can be costly due to resource and maintenance needs.

I recognize that Cortex XDR by Palo Alto Networks is one of the best products in its category regarding capabilities. This integration allows log data from the firewall to be ingested and communicated with Cortex XDR by Palo Alto Networks, creating a more cohesive security strategy. They've already made significant improvements, so I believe it's adequate for now. I rate this product a 9.5 out of 10.

Cortex XDR by Palo Alto Networks is used for detecting some legitimate traffic, especially when users concurrently try to log in from various locations through their VPN. When that occurs, users are informed and assisted in correcting the login issues. After resolving the situation, most of the VPN users are able to log in without issue. Cortex XDR by Palo Alto Networks also indicates potential unknown traffic to the SOC.

Currently, a cloud deployment model for Cortex XDR by Palo Alto Networks is used. This model was installed before joining the team.

What I like about Cortex XDR by Palo Alto Networks is that it can understand zero-day attacks, which is a critical feature. It is behavior-based rather than signature-based, making it a very interesting and significant aspect in my experience.

Cortex XDR by Palo Alto Networks has changed the way my security team detects, investigates, and responds to threats by providing very fast responses. Having experience with both Kaspersky and SentinelOne, I find that it immediately responds to unknown traffic and unknown behaviors, which is vital for any environment, especially in the financial sector.

Cortex XDR by Palo Alto Networks is particularly useful for blocking unknown attacks and can also disable USB and other peripheral devices, which is a significant advantage. This capability allows stopping unknown behaviors both at the user level and externally.

A major achievement with Cortex XDR by Palo Alto Networks is its ability to recognize zero-day attacks, enabling it to understand and detect new and unknown attacks easily. This feature is crucial for any security environment.

In terms of improvement, Cortex XDR by Palo Alto Networks could enhance user-level capabilities before installation, particularly in properly preventing unknown peripheral devices from being plugged in. It also needs to better address third-party VPN client usage, which can sometimes create monitoring issues.

Looking to the future, I would like Cortex XDR by Palo Alto Networks to improve its understanding of third-party VPNs and the ability to manage users logging in from multiple locations simultaneously. This is an area where enhancements could be beneficial.

I have been working with Cortex XDR by Palo Alto Networks since 2016, and I have two years of experience with the SOC in Sri Lankan Airlines through KBSL Sri Lanka.

So far, I have not experienced any stability or performance issues with Cortex XDR by Palo Alto Networks; it is functioning smoothly in the current environment.

Cortex XDR by Palo Alto Networks is scalable.

Normally, tickets for support are generated through the distributor, and I have not directly communicated with the Palo Alto support team. In my past vendor role, direct communication with the distributor who managed technical support internally was maintained.

The partner used for communication with Palo Alto Networks in Sri Lanka is Conex Private Limited, which is the exclusive distributor for Palo Alto.

I personally have no experience with the security challenges before implementing Cortex XDR by Palo Alto Networks, as it was already installed before joining. However, I have experience with SentinelOne, which requires more RAM space for a single end-user compared to Cortex XDR by Palo Alto Networks, making it more valuable for customers. Many end-users cannot change their endpoints due to additional costs, but Cortex XDR by Palo Alto Networks is important for low RAM and utilization compared to other XDR products.

When comparing Cortex XDR by Palo Alto Networks to other XDR products such as SentinelOne, the key differences include price and lower utilization from endpoints. Other products, such as Kaspersky and SentinelOne, tend to use more resources from end-user devices, which is a noteworthy distinction.

The initial setup for Cortex XDR by Palo Alto Networks is not challenging, as I have experienced many endpoint devices and found the installation process straightforward within the environment.

Cortex XDR by Palo Alto Networks was purchased from a local distributor, as it is often challenging to buy directly or through marketplaces without distributor support, which simplifies ticketing and other processes.

On the pricing aspect, Cortex XDR by Palo Alto Networks needs to have a more reasonable rate, particularly for customers in Sri Lanka and Asian countries. This is crucial, as customers often depend on costs; despite its technical advantages, pricing is a significant factor in decision-making.

What ultimately convinced me to choose Cortex XDR by Palo Alto Networks over other solutions is its low utilization, which is a major factor for my environment.

Based on my experience with Cortex XDR by Palo Alto Networks, I highly recommend it due to its quick response to zero-day attacks and low utilization from end-user devices. Some other products do not meet these efficiency standards.

From my knowledge, it is a very expensive solution, but it is good for a SOC. I would rate Cortex XDR by Palo Alto Networks a nine out of ten as a product and solution.