Palo Alto Networks Cortex XSOAR Reviews

I am familiar with Palo Alto Networks Cortex XSOAR products, particularly with Cortex. Palo Alto Networks Cortex XSOAR is primarily used for IOC enrichment, IOC harvesting, and correlation, followed by automation.

The integration has positively impacted my organization's mean time to resolution, as both mean time to detect and respond have improved, enabling earlier detection and response.

The playbook automation helped streamline my incident response time by removing delays from the human side and reducing the mean time to respond.

Some advantages I would like to mention include automation which was really helpful for IOC harvesting. It actually reduced the response time by approximately 60 percent.

I did notice some drawbacks, as it is a bit complex. The deployment and implementation are complex in nature.

Integration with third-party tools had some issues, particularly with open source platforms, but enterprise tools integrated just fine. The exact platform we integrated required custom solutions, especially with open-source tools.

I have been using this solution for over two years.

I have come across technical support and found their response to be fast and helpful.

The deployment requires a huge amount of time, approximately five to six months since it was a national project.

I was also involved in the deployment of Palo Alto Networks Cortex XSOAR project.

We had two people from our side who took part in it, including a PM and another technical person while I was the technical architect and solutions architect.

For the capability, I think the pricing and licensing cost for Palo Alto Networks Cortex XSOAR is reasonable.

Overall, I am satisfied with how Palo Alto Networks Cortex XSOAR works for me, as it had a positive impact on my organization's performance.

Most of the tools we integrated into the solution also had AI, and the efficiency started from a couple of places, not just starting from Cortex.

The analytical features of Palo Alto Networks Cortex XSOAR streamline my ability to gain insights and visibility into security threats, especially due to integrations with threat intelligence sources.

I have utilized Palo Alto Networks Cortex XSOAR's playbook automation, which was part of the automation we implemented. I give this solution a rating of 9 out of 10.

My main use case for Palo Alto Networks Cortex XSOAR involves working in a security team with a very complicated, large on-premises infrastructure where we needed some automated triage and response to cybersecurity threats, which is why we decided to onboard Palo Alto Networks Cortex XSOAR.

A specific example of how I used Palo Alto Networks Cortex XSOAR for automation or response is when we had a public-facing endpoint for payment authentications, which was under constant brute force attacks. We identified certain patterns using Palo Alto firewall and used Palo Alto Networks Cortex XSOAR to automatically detect and block these brute force attempts toward that endpoint.

Palo Alto Networks Cortex XSOAR offers features that are simple and easy to use with many integrations, making it quite a complete stack in the security field right now.

The integrations that I found most valuable included those with the Linux operating system, different types of servers, databases, and other network devices such as switches and routers. We were also able to create custom integrations and understand logs while processing a lot of custom data.

Palo Alto Networks Cortex XSOAR has positively impacted our organization by making us faster in the incident response process and allowing us to focus on more innovative things instead of just doing the same things repeatedly because of its amazing automation.

As a result of using Palo Alto Networks Cortex XSOAR, I believe we saved around two hours of man labor just by using the automations it offered, and this time saving increased exponentially over time as the tool matured in our environment.

An improvement for Palo Alto Networks Cortex XSOAR could be adding management of custom resources through Terraform or infrastructure as code, making it more scalable from an end-user perspective.

I have used Palo Alto Networks Cortex XSOAR for around eight to ten months.

Palo Alto Networks Cortex XSOAR is stable.

Palo Alto Networks Cortex XSOAR's scalability is pretty good and it is easy to scale up according to the infrastructure requirements.

The customer support for Palo Alto Networks Cortex XSOAR is good.

We were not using any enterprise solution before opting for Palo Alto Networks Cortex XSOAR.

Before choosing Palo Alto Networks Cortex XSOAR, we evaluated Rapid7, but we decided to move on with Palo Alto.

I would say that time saved is the first metric to evaluate our return on investment, with the comfort level we now have because of this good tool being the real benefit we have.

My experience with pricing, setup cost, and licensing indicates that I believe it is a little bit expensive; however, being among the market leaders, it is worth the money, though still a bit pricey.

My advice for others looking into using Palo Alto Networks Cortex XSOAR is to be aware of what you need and focus on your goals first when deploying it, as it is a very vast tool with unlimited features that can take time to explore.

Regarding Palo Alto Networks Cortex XSOAR's AI capabilities, I have not touched that part, but I know that Palo Alto is a very secure and compliant company, which makes me comfortable using this tool even in a regulated environment, so I trust Palo Alto on that governance part.

I have not used Palo Alto Networks Cortex XSOAR's AI capabilities much in my career, but other than that, the analysis, hypothesis building, triage of alerts, and integrations were pretty nice. I would rate this product an eight out of ten.

I only use Palo Alto Networks Cortex XSOAR product, which means I'm not familiar with the XSOAR component. I am familiar with Palo Alto Networks Cortex, which includes the XSIAM portion. I have been using Palo Alto Cortex for approximately a year.

I confirm that I'm using the cloud version of Palo Alto Networks Cortex XSOAR. I am the Information Security Senior Advisor at Eskom Limited, confirming my current position.

I believe ease of use would be an improvement for Palo Alto Networks Cortex XSOAR, as I see this as a valuable feature for future iterations. For queries, I believe improvement in that area could enhance Palo Alto Networks Cortex XSOAR further.

I have been using Palo Alto Cortex for approximately a year.

I have not faced any challenges with the deployment of Palo Alto Networks Cortex XSOAR at this stage.

We no longer use our previous solution as I have been familiar with the current product for more than a year, and it was replaced by another product. It has been out of our environment for more than a year. We do not use any Trellix products at this stage, which confirms we are currently not utilizing any of their offerings.

Service providers looked after the implementation, so I spent limited time on deployment. It was taken care of by a service provider, confirming it was managed by a third party.

We are currently using Palo Alto Networks Cortex XSOAR solution.

My main use of Palo Alto Networks Cortex XSOAR is as a SOAR to resolve incidents automatically. I close the incident by clicking approve, and everything is approved. I do not put the automation into production since I am a student.

In my opinion, the best features offered by Palo Alto Networks Cortex XSOAR are the automation, the graphical incident interface, the assignment functionality, and automatically closing the incident with closure reasons.

Regarding the graphical part, I appreciate that you can see who closes incidents most often and the number of incidents that remain to be handled.

Palo Alto Networks Cortex XSOAR has not had a positive impact on my organization or my work personally because we are currently in the process of putting Palo Alto Networks Cortex XSOAR into production to improve it, so I do not yet know the full impact.

The tool has simplified some tasks. Everything that we put into a playbook, even if it is not all in production, still allows us to follow our guide to close an incident.

In my opinion, what is missing to improve Palo Alto Networks Cortex XSOAR is a closure note each time we close an incident. Even though there is a form and closure note available, I have not seen this feature implemented in Palo Alto Networks Cortex XSOAR.

I have been using this solution for a few months, six months in total.

My advice to someone who is considering using Palo Alto Networks Cortex XSOAR is that it is a good automation tool for building playbooks.

The specific skills or training I would recommend to use this tool effectively is the Palo Alto Networks Cortex XSOAR training that was offered in October or November.

In my opinion, the main challenge encountered when setting up or configuring Palo Alto Networks Cortex XSOAR is building the playbook. I would try to understand how to properly configure the playbooks without adding unnecessary and repetitive things. It is easy if you clearly understand how it works, but for another beginner user, they can get lost quite easily in understanding how it works.

I give this product a rating of five out of five.

We are more of a SI and reseller, not really acting as a customer ourselves. We are reselling Palo Alto Networks Cortex XSOAR and SentinelOne. We are dealing with all Palo Alto products, related to firewalls, including Fortinet, Palo Alto, Check Point, and Cisco.

When these services go live, we will see their full potential. I am dealing with Palo Alto products such as firewalls and SASE, which we have proposed to multiple customers, and we have positioned Palo Alto Networks Cortex XSOAR for a few customers.

The customer was already using Micro Focus, which provided a bundle with their SIEM and SOAR product, requiring a lot of manual work and configuration. To replace that, we are positioning Palo Alto Networks Cortex XSOAR, which can be used in the SOC and do a lot of automation for the customer, but it was expensive, making it essential for the customer to evaluate whether ROI is coming from the business model, as they are also acting as a SOC provider.

Palo Alto Networks Cortex XSOAR is a good product with enhanced and efficient playbooks, as demonstrated during our use case simulations. We have implemented automation features, such as automated responses to email threats and automatic configuration of target devices for blocking specific IPs.

The analytics feature in Palo Alto Networks Cortex XSOAR is impressive. The solution is quite exhaustive regarding integrations, with many pre-integrations available, especially for market-leading products. There might be challenges with make-in-India products, as they tend not to build the necessary connectors. This depends on whether you are selling to enterprises or other customers. For government customers, you might encounter many Indian products, such as firewalls, which could pose integration challenges unless you have open APIs. However, for market-leading products, there are ready-made integrations available.

To improve the solution, it needs to have complete features that are low-code, no-code, and should be plug-and-play. We need to see improvements in that area to facilitate cyber analysts.

Currently, we are not using it in-house; however, we have explored whether we should create our next-generation SOC using IBM QRadar, Elastic, or maybe some other product such as Fortinet.

The technical support provided by Palo Alto Networks Cortex XSOAR is good. I would rate their support around nine out of ten.

Positive

Comparing pricing to Micro Focus, they were offering bundles, making it free with their SIEM. For customers, it is zero versus $20 million, which is why they have to make a decision.

The customer was already using Micro Focus, which provided a bundle with their SIEM and SOAR product, requiring a lot of manual work and configuration. To replace that, we are positioning Palo Alto Networks Cortex XSOAR, which can be used in the SOC and do a lot of automation for the customer, but it was expensive, making it essential for the customer to evaluate whether ROI is coming from the business model, as they are also acting as a SOC provider.

Comparing pricing to Micro Focus, they were offering bundles, making it free with their SIEM. For customers, it is zero versus $20 million, which is why they have to make a decision.

We are considering Splunk, which has a good market presence in the niche. Second is QRadar, which also has a good market presence, but the future with IBM is uncertain. Third is Elastic, which is doing great now as they have formed some partnerships; it will be a good product providing these kinds of services in the future.

We act as a SI with tie-ups with different EDR vendors. We are providing Palo Alto Networks Cortex XSOAR and SentinelOne as our main products.

We have given certain POCs, but we are not using it in-house. We are evaluating different products for our next-generation SOC, considering market conditions and pricing as key factors.

I found it easy to use and configure at the time of evaluation. I have not seen how the machine learning models help prioritize alerts, but this will be evaluated when shown to customers.

I would recommend Palo Alto Networks Cortex XSOAR for big companies only because it may be costly, so small companies will not adopt it unless they have a clear mindset to proceed with this product for specific reasons. It is easy to integrate within existing systems, especially with third-party solutions.

Based on my experience, I would rate Palo Alto Networks Cortex XSOAR a six out of ten.

The primary use case for Cortex XSOAR is as an orchestration automation platform. I use it to execute automatic tasks for collecting, enriching, and correlating security events from hundreds of different technologies. It involves incident orchestration and automation in the selection of security analysts to be involved in event handling.

The solution is an orchestration automation platform. Three main features can help me: execution of automatic tasks for collecting, enriching, and correlating security events from hundreds of different technologies that I can integrate into the platform. Each incident collected is orchestrated with automation that selects the security analyst to be involved, or provides complex execution plans for managing security incidents.

The complexity of Cortex XSOAR has a trade-off with its versatility. The product can be tailored for each deployment to respond to specific customer needs, and this complexity may be seen as a downside. The deployment requires integration and the development of integration modules. Deployment is not easy, requiring significant tuning and building of integrations over weeks.

I have been working with Cortex XSOAR for about three years.

I would rate the stability of Cortex XSOAR as nine out of ten.

I would rate the scalability of Cortex XSOAR as nine out of ten.

Customers who purchase Cortex XSOAR usually receive kickstart services provided directly by the vendor, ensuring initial setup and tuning is well-supported. In daily operations, the support service follows Palo Alto's standards, which I rate as eight out of ten.

Positive

The initial setup is assisted by kickstart services provided by the vendor to ensure a smooth start, including the initial setup and tuning of Cortex XSOAR.

My deployment experience is key. A strong interaction with the customer’s engineers for integration is critical for successful deployment. Maintenance is usually provided either by the vendor or third-party resellers.

Even though customers often comment on the price, the potential savings come from managing a large number of security events with a limited number of analysts. This leads to economic advantages despite the product's cost not being low.

I would recommend Cortex XSOAR to customers with an internal SOC team or who deliver SOC services for third parties. 

I would rate the overall solution an eight out of ten.

I have worked on multiple use cases related to network security and cybersecurity. In network security, I've created multiple playbooks to fetch data from multiple firewalls. 

We can also upgrade them in parallel to Axon. Apart from that, we can block URLs and IPs in real time. It takes less than five minutes to block something. You don't have to push a policy or create a rule on the firewall directly. You just upload the IOC (Indicator of Compromise), URL, or IP into a SharePoint sheet, and it gets blocked within five minutes.

Those are the kinds of use cases I've created. In addition, we've automated several tasks, including Nikto vulnerability scans and SOCL (Security Orchestration, Automation, and Response) tasks. 

We've also created multiple threat intelligence playbooks, fetching data through the MITRE framework and following compliances like HIPAA. It's a very good tool.

XSOAR support the company's compliance and regulatory requirements. For example, I'm working with multiple clients from different industries—one from manufacturing, another from healthcare, and one from banking. Each of these clients has its own compliance policies. XSOAR is a product that allows you to meet all regulatory requirements effectively. The flexibility in XSOAR is much greater compared to other tools.

Security-wise, the integration of IAM and SSO in XSOAR is straightforward. For example, I'm currently working with an Indian client that must adhere to RBI regulations. These regulations require that data remain within the Indian subcontinent and not be sent overseas when using cloud services.

For instance, FortiSOAR has data centres in Dallas and Australia. Google Chronicle has data centres in Europe, Japan, and the US. However, XSOAR also has a data centre in India, which is essential for meeting local regulatory requirements. This makes XSOAR a very suitable option for such needs.

The best feature is the CLI part. If you want to execute any command or something like that, it is very easy. You can get a tab, and you just type the command there, and it will run. The playground feature is very good. You don't need a separate development environment; you can use it directly within XSOAR. These are the things that make XSOAR stand out compared to other products.

For orchestration, the processes are very user-friendly. Even if I'm not an XSOAR admin, I can quickly become proficient with it. You just have to navigate through the various options in Palo Alto Networks Cortex XSOAR, and it becomes easy to manage. For instance, if you are a SOC analyst and want to start using XSOAR, it's very easy to access and retrieve the details you need.

To put it in simpler terms, using XSOAR is like using a Fire Stick, where you have all your OTT platforms available. Similarly, in XSOAR, you get all the related alerts, whether from SIEM, EDR, or XDR, all consolidated in one place. You can analyze the data, make decisions, and even automate certain processes based on the data you receive. XSOAR assists in automating workflows, making decision-making processes easier.

The orchestration in XSOAR is significantly easier compared to other SOAR tools I've used, like Siemplify, Splunk Phantom, and FortiSOAR. The processes are much more streamlined in XSOAR, which is what I appreciate most about it.

So, when it comes to automation and playbooks, it is very easy. XSOAR is the only platform that supports three scripting languages: Python, JavaScript, and PowerShell. So you don't have to worry much about compatibility. If someone knows Python, they can easily create a playbook for automation. They can write the automation scripts and handle everything. Even if you're like me, coming from a Windows background and only familiar with PowerShell scripting, you can still create automation within XSOAR. This flexibility is something that XSOAR provides, unlike other tools that only support Python.

XSOAR uses machine learning and generative AI, particularly in threat intelligence. In security, threat intelligence is the only area where AI and machine learning are truly effective. Aside from that, whatever vendors are claiming about AI is often just marketing hype. They might suggest that AI can be used everywhere, but security compliance is a crucial factor. 

For example, if I request AD admin access, it's unlikely anyone would grant it due to security concerns. This demonstrates the limits of AI in certain aspects of security. They may have chatbots and other features, but their necessity is questionable. For instance, if I need details about a particular IP or URL, I can retrieve it myself by running a command. Human intervention is still necessary in these cases.

We can definitely use AI in incident response, but the major thing is in managing case notes. We recently initiated a project focused on ensuring that case notes added by analysts follow a proper format. We can then utilize generative AI to improve this process. For example, if an alert is related to a DNS query, we can create different templates. Based on the best keyword match, AI can make decisions, which is part of our plan.

Recently, they started implementing microservices in XSOAR, which has improved quality and addressed previous issues. However, they should focus more on licensing costs. The user licensing fees are quite high. 

For example, I received a quote for XSOAR, and it was $12,000 per user per year. If you have a SOC team of 30 members/analysts, you're looking at a substantial expense. They should consider reducing these costs since this high pricing seems to be more about profit.

So, there is room for improvement in the pricing. 

Moreover, the reporting and dashboard features are decent but could be improved. The user interface (UI) is quite heavy and takes time to load, which is a major drawback.

I have been working with the XSOAR product for almost four four and a half years.

I've mostly worked on the SaaS side and haven't encountered any major issues.

So, it's highly scalable. But in practice, scalability is often underutilized. It's only leveraged when fully necessary, such as when the system becomes protected and fully operational.

If you use the case management module of XSOAR, then you need to cover all the SOC personnel. If you just want to automate tasks and send details via email, then three or four licenses are more than enough.

Technical support varies. If you have premium support, they treat you well. If not, it might be frustrating. But it depends on the person handling it.

Positive

I have used Fortinet, Splunk, and other vendors. 

The implementation strategy varies. You start by ingesting alerts from various sources and then begin creating playbooks. The process depends on what the client needs first. 

Typically, I start by setting up Single Sign-On (SSO) and the user base. After that, I proceed with the deployment, which is the most efficient approach. Meanwhile, I also allow SOC analysts some time to familiarize themselves with the system.

Typically, a single resource can manage the entire deployment process. You don't need a large team.

The time frame depends on the client. If the client is proactive and has all the data and processes in place, it can take one to two months. Otherwise, it can be a more tedious process.

Both versions are available—SaaS and on-premises. I’ve worked on both, but mostly with the SaaS-based version. However, both versions are almost identical in functionality.

Maintenance is very easy. If you want to upgrade XSOAR, you just have to open a ticket with support. They will give you a specific window, and it takes less than five minutes to get updated, and everything works fine.

I currently manage XSOAR end-to-end, from giving demos to customers to implementing it in their environments. I handle everything, including the automation part.

XSOAR can automate nearly anything. Compared to any other SOAR tool, it's more powerful and provides more control to automate tasks across various areas, whether it's network security, IAM, server management, or other infrastructure levels. XSOAR offers seamless integrations with around 80+ integrations available in the marketplace. The layouts are customizable, and you can create multiple layouts or custom incident schemas. These features make XSOAR the market leader in its category.

ROI becomes evident when your SOC is mature. The problem many businesses face is that they receive a budget and immediately purchase products without focusing on processes. The process is more important than the tools. 

Many companies spend heavily on CapEx but neglect operational optimization. If you focus on improving operational processes, you will see better results. For example, many organizations pay for a high EPS (events per second) rate on their SIEM, but 99% of the events are false positives. This is wasteful. 

Once your SOC processes are mature and you have a high number of true positive alerts, that's when XSOAR can be truly effective. Automation is the last step in the process; you have to take it step by step. XSOAR comes into play when you're ready to automate efficiently.

Before you proceed, it's important to trim down the false positives and establish a robust process. You need to orchestrate multiple things. These are the elements currently missing with the client. Once your SOC (Security Operations Center) is matured, and you start receiving accurate, true positive alerts, XSOAR will provide a significant ROI. 

You can automate almost 90% of the playbooks that SOC analysts manage. The remaining 10% would involve decision-making tasks, which can be handled by L3 or L2 analysts. L1 tasks have already been automated, allowing L1 analysts to focus on L2 responsibilities.

Overall, I would rate it a nine out of ten. The main drawbacks are the dashboard and reporting features—they could be better. Also, the user licensing fee is quite high. Apart from that, I don't think there are any major issues. 

If we’re paying for premium support, they should consider providing some complimentary private keys or licenses. It's like buying an Amazon Fire Stick and expecting free Amazon Prime and Netflix for a few days. But they’re not giving anything for free.

I would recommend this product to other users, if they have a decent budget to spend. Further, I would advise to ensure your processes are robust. Once your process is stable, you can buy XSOAR, and it can do wonders. It's just a tool, after all.

It is a security orchestration and automation tool.

It basically lets us automate and orchestrate tasks across all your security tools. Imagine integrating our vulnerability management tool with XSOAR. For example, we get a ServiceNow ticket requesting a scan for a specific server before it goes live. XSOAR can trigger that scan automatically, streamlining the entire process. That's the power of XSOAR—automating repetitive tasks and freeing up your security team for more strategic work.

The most valuable feature is its capability to automate responses and collect information for any security event before you even delve into the details.

It's a vast product with an active roadmap, so I'm satisfied with it for now. It's very efficient at data collection and correlation. 

There is room for improvement in support. The response time could be faster.

We have been using it for two years now. It's cloud-based and hosted by Palo Alto.

It's stable. The features and functionalities work as intended mostly. It's a good, reliable product.

We have six users actively using XSOAR. XSOAR is specifically for security teams, it is not for everyone to use.

The customer service and support are okay, not the best, not the worst. Their initial response time is quite long, and even after you get back to them, it takes them a while to provide troubleshooting steps and follow through.

Negative

We actually did run a couple of POCs for other products. My company switched to XSOAR because it's a very stable product, and its integration capabilities with most security tools are fantastic. 

If it wasn't available, we'd have to manually develop integrations for each tool, which would be incredibly time-consuming. So, that's the main reason we went with XSOAR.

For cloud deployments, it's a breeze. No installation is needed; just access the provided link and start working. 

But for on-prem, it's a different story. You need to install multiple components and provision servers and integrate them with Palo Alto's platform according to documentation. It's a lengthy process, not overly complex, but due to the tool's architecture, it's unavoidable for on-prem installations. Cloud-based is definitely the easier option.

On-premise installation is complex and time-consuming, with multiple servers and integrations to manage. So, on-premise installation is a hassle.

It's expensive, but the value it offers makes it worthwhile.

It's a very stable product, definitely worth the investment. You won't regret your spending.

Overall, I would rate the solution a nine out of ten. The only reason it loses a point is the support team. Their performance hasn't reached the same level as other Palo Alto offerings.

The solution is user-friendly and easy to configure.

Palo Alto needs to develop more AI-centric products. Also, the price could be cheaper. It doesn’t have infinite connectors.

I have been using Palo Alto Networks Cortex XSOAR for a couple of years.

The product is very stable.

5,000-7,000 users are using this solution.

Technical support is knowledgeable.

We used to work on the IBM XSOAR product, which was well-developed and competitive. The IBM component was strong, but Palo Alto Networks Cortex XSOAR performed well. The main difference lies in the level of suggestions provided by the playbooks when analyzing logs. IBM's suggestions to be better.

The initial setup is simple. Your level of understanding significantly impacts the effectiveness of implementation. People may learn the hard way, especially post-implementation, highlighting the importance of a comprehensive experience.

I recommended Palo Alto Networks Cortex XSOAR to a friend, and they have been using it to access and respond to issues in their data center. So far, there have been no complaints, not even worth mentioning. They also requested repairs through the platform.

The playbook is very good and user-friendly compared to IBM.

There are always things missing in some of the boxes. In some instances, there appears to be a leak. There are inconsistencies. Solutions like Palo Alto Networks Cortex XSOAR or similar products are necessary.

Overall, I rate the solution an eight out of ten.

The SOC team needs the tool to understand the network and determine why an incident happens. The tool helps understand user behavior and helps with threat hunting.

The solution has a lot of information, like playbooks and incidents. It goes really deep. The vendor provides training, knowledge bases, workshops, and webinars. The product can automate security tasks. Playbooks are the most beneficial feature. We can create a playbook. We can get visibility on incidents.

We can also analyze user behavior and understand whether it is a true positive or a false positive. We have so many false positives these days in security, so it's nice when we can put things in the block list. We can perform investigations. The product can be integrated with third-party tools.

The solution is complicated to learn. Customers find it difficult to learn how the solution works. We need professionals to learn and understand how the tool works to expand it further. Our customers want to see more use cases. They want to have more facilitations and more visibility on how it works. We need more skilled people inside and outside the team to understand how it works. It’s difficult to find skilled people to understand how the tool works.

The solution is suitable for enterprise businesses.

We can send an email to the online support portal. We can contact Palo Alto engineers immediately and open a ticket. The engineers will take care of the issue depending on the severity level of the ticket.

Positive

The initial setup is really easy. We just have to order it. When we have the tool, someone from Palo Alto will provide us with the account information. After that, we must set up the users, customers, and resellers. We can do onboarding immediately. The deployment takes one or two days.

Whether the product is cheap or expensive depends on the company and how much they are willing to spend on security. Nowadays, security is important. The solution is not suitable for small businesses. It is better suited for medium and enterprise businesses because it starts with 200 endpoints.

SentinelOne is an endpoint protection tool. However, Palo Alto gives us more security features.

I work with a distributor. I recommend the product to my customers. I'm really satisfied with the tool. It's a very nice tool. It can work and give us what we need. We just need to be patient and learn how it works. The incidents can be handled very easily. Overall, I rate the product a nine out of ten.