My primary use for Palo Alto Networks Cortex XSOAR is to protect the workstation for the end-users.
IT Operations Deputy Manager at Ultramar Agencia Marítima
Helpful remote control capabilities, scalable, and simple deployment
Pros and Cons
- "The most valuable features of Palo Alto Networks Cortex XSOAR are the remote controller from the workstation that can execute commands and isolate the systems outside of the network. Only the system with an internet connection can execute the task because the main console is in the cloud."
- "Palo Alto Networks Cortex XSOAR could improve the look, feel, and management of the cloud console. Additionally, the user could be more easily integrated."
What is our primary use case?
What is most valuable?
The most valuable features of Palo Alto Networks Cortex XSOAR are the remote controller from the workstation that can execute commands and isolate the systems outside of the network. Only the system with an internet connection can execute the task because the main console is in the cloud.
What needs improvement?
Palo Alto Networks Cortex XSOAR could improve the look, feel, and management of the cloud console. Additionally, the user could be more easily integrated.
For how long have I used the solution?
I have been using Palo Alto Networks Cortex XSOAR for two years.
Buyer's Guide
Palo Alto Networks Cortex XSOAR
May 2025

Learn what your peers think about Palo Alto Networks Cortex XSOAR. Get advice and tips from experienced pros sharing their opinions. Updated: May 2025.
856,873 professionals have used our research since 2012.
What do I think about the scalability of the solution?
We have approximately 1,000 users using Palo Alto Networks Cortex XSOAR in our organization. The solution is scalable.
How was the initial setup?
We only require one or two staff to deploy the agent of Palo Alto Networks Cortex XSOAR because it is very simple. One for the server and the other for the workstation.
What's my experience with pricing, setup cost, and licensing?
The price of Palo Alto Networks Cortex XSOAR could be reduced. We are always looking for a discount. There is an annual license needed to use this solution.
What other advice do I have?
I rate Palo Alto Networks Cortex XSOAR a ten out of ten.
Which deployment model are you using for this solution?
Public Cloud
Disclosure: My company does not have a business relationship with this vendor other than being a customer.

Specialist - Information Security at LPI
Drastically reduces trivial tasks inside the SOC environment
Pros and Cons
- "Cortex XSOAR's most valuable features are the playbooks, custom integration, the machine-learning model, and the layout, classifier, and mapper."
- "Corex XSOAR could be improved by reducing the time it takes to process large amounts of data and increasing the number of integrations."
What is our primary use case?
I mainly use Cortex XSOAR to automate cybersecurity and the SOC environment.
To minimize manual tasks and increase level of automation.
How has it helped my organization?
Cortex XSOAR drastically reduces trivial tasks inside the SOC environment, which provides a huge benefit for L1 analysts.
What is most valuable?
Cortex XSOAR's most valuable features are the playbooks, custom integration, the machine-learning model, and the layout, classifier, and mapper.
What needs improvement?
Corex XSOAR could be improved by reducing the time it takes to process large amounts of data and increasing the number of integrations. In the next release, Palo Alto should include popup features - for example, if someone is working on an incident, it should pop up and display in front of me once it's clicked.
For how long have I used the solution?
4 years
What do I think about the stability of the solution?
Cortex XSOAR is very stable in our environment, and we haven't seen any platform issues with it.
What do I think about the scalability of the solution?
Cortex XSOAR is scalable.
How are customer service and support?
Palo Alto's support services require a lot of improvement.
Which solution did I use previously and why did I switch?
I used Qradar SOAR . Cortex xsoar support is very good and contain lot of OOTB playbooks but comparatively qradar soar lack in OOTB Playbooks.
How was the initial setup?
The initial setup is very easy. Also in latest version platform is managed by Palo alto cloud itself and rest of the configuration is done from UI itself.
So zero load in configuring platform.
What's my experience with pricing, setup cost, and licensing?
Cortex XSOAR's license price could be lower.
What other advice do I have?
Disclosure: My company has a business relationship with this vendor other than being a customer: Partner
Buyer's Guide
Palo Alto Networks Cortex XSOAR
May 2025

Learn what your peers think about Palo Alto Networks Cortex XSOAR. Get advice and tips from experienced pros sharing their opinions. Updated: May 2025.
856,873 professionals have used our research since 2012.
A great scalable tool that provides functionalities related to patching and URL blocking
Pros and Cons
- "The strengths of Palo Alto Networks Cortex XSOAR stem from the fact that it provides functionalities related to patching and URL blocking...It is a scalable solution."
- "With Palo Alto Networks Cortex XSOAR, managing its setup phase can be a complicated task."
What is most valuable?
The strengths of Palo Alto Networks Cortex XSOAR stem from the fact that it provides functionalities related to patching and URL blocking, and its strengths are the major reason why I recommend the product to others.
What needs improvement?
With Palo Alto Networks Cortex XSOAR, managing its setup phase can be a complicated task. The aforementioned aspects of the solution can be considered for improvement. In the future, I need the product to provide me with the ability to manage its base.
In the future, I want Palo Alto Networks Cortex XSOAR to provide me with an option that allows me to do an automatic setup process. I also want Palo Alto Networks Cortex XSOAR to plan a way to minimize the need for too many configuration processes in an architecture. I feel that currently, the setup process of the product is really hard.
For how long have I used the solution?
I have experience with Palo Alto Networks Cortex XSOAR. My company has a partnership with Palo Alto Networks.
What do I think about the stability of the solution?
We don't face any issues with Palo Alto Networks Cortex XSOAR in our company right now. Certain issues only crop up with the firewall devices from Palo Alto Networks.
What do I think about the scalability of the solution?
It is a scalable solution.
How are customer service and support?
I rate the technical support a nine out of ten.
How would you rate customer service and support?
Positive
Which solution did I use previously and why did I switch?
I only handle Palo Alto Networks.
How was the initial setup?
I did not manage the initial setup of the product, as it was taken care of by a product specialist.
Which other solutions did I evaluate?
I am more comfortable with Palo Alto Networks compared to its competitors.
What other advice do I have?
I can say that I am a bit satisfied with Palo Alto Networks Cortex XSOAR. I manage the product's setup phase, so I am getting familiarized with it.
I can only recommend Palo Alto Networks Cortex XSOAR after I personally complete the setup phase of the product in our environment. In general, after I complete the setup process of Palo Alto Networks Cortex XSOAR in my company, I will recommend it to others.
I rate the overall tool an eight out of ten.
Disclosure: My company has a business relationship with this vendor other than being a customer: Partner
Intern Cybersecurity at a computer software company with 10,001+ employees
The drag-and-drop interface enables analysts with no programming knowledge to create playbooks easily
Pros and Cons
- "The drag-and-drop interface enables analysts with no programming knowledge to create playbooks easily."
- "XSOAR could have more integration options."
What is our primary use case?
I'm currently evaluating XSOAR to see what the solution can do. I'm playing around with the various features.
What is most valuable?
The drag-and-drop interface enables analysts with no programming knowledge to create playbooks easily.
What needs improvement?
XSOAR could have more integration options.
For how long have I used the solution?
I have used XSOAR for two months.
What do I think about the stability of the solution?
XSOAR is stable.
How was the initial setup?
Setting up XSOAR is straightforward and takes about 30 minutes. It doesn't require any special technology to implement it in any architecture. You create a virtual machine, move the file to it, launch the installer, and let it run. It doesn't require any complex tasks.
What other advice do I have?
I rate Palo Alto Networks Cortex XSOAR nine out of 10.
Disclosure: My company does not have a business relationship with this vendor other than being a customer.
Business Development Manager at a tech services company with 51-200 employees
Has good stability and an easy initial setup process
Pros and Cons
- "The solution is easy to deploy."
- "The solution's technical support could be better."
What is our primary use case?
We use the solution to create playbooks for all the operational programs.
What needs improvement?
The solution's integration with non-security solutions will be helpful.
For how long have I used the solution?
We have been using the solution for almost two years now.
What do I think about the stability of the solution?
The solution is stable. I rate its stability an eight.
What do I think about the scalability of the solution?
I rate the solution's scalability as an eight. It is complex to scale.
How are customer service and support?
The solution's technical support team takes longer to reply to the queries.
How would you rate customer service and support?
Neutral
How was the initial setup?
The solution's initial setup process is straightforward.
What's my experience with pricing, setup cost, and licensing?
The solution's cost is reasonable. I rate its pricing as a five.
What other advice do I have?
I rate the solution an eight.
Which deployment model are you using for this solution?
On-premises
Disclosure: My company has a business relationship with this vendor other than being a customer: Partner
Manager at a financial services firm with 5,001-10,000 employees
Customizable playbooks are a big asset but integrations are a challenge
Pros and Cons
- "Many different playbooks are available and can be customized."
- "The solution requires DV but does not support open-source DV elastic searches."
What is our primary use case?
Our company uses the solution for security management and threat response.
What is most valuable?
Many different playbooks are available and can be customized.
What needs improvement?
Integrations with other applications are challenging and need to be improved.
Reports or issues are often duplicated.
The solution requires DV but does not support open-source DV elastic searches.
For how long have I used the solution?
I have been using the solution for seven months.
What do I think about the stability of the solution?
The solution has stability issues from the performance side and often duplicates reports or issues.
How are customer service and support?
The solution is not a Palo Alto product so technical support is inadequate.
There is not a big focus on support for the solution so it takes a lot of time to receive responses for issues.
How was the initial setup?
The setup might not be easy because it requires official customers.
What about the implementation team?
Our company received technical support during installation.
What's my experience with pricing, setup cost, and licensing?
The solution is based on an annual licensing model that is expensive.
What other advice do I have?
The solution is a good product that would be even better if technical support is improved and prices are discounted.
Support is very important because there is a lot of follow up after implementations to properly manage changes and issues.
I rate the solution a six out of ten.
Which deployment model are you using for this solution?
Private Cloud
If public cloud, private cloud, or hybrid cloud, which cloud provider do you use?
Other
Disclosure: My company does not have a business relationship with this vendor other than being a customer.
Associate Director at a financial services firm with 10,001+ employees
Difficult to set up, doesn't have integrations, and the solution has been decommissioned
Pros and Cons
- "It was useful as a ticketing tool."
- "It is been decommissioned by Palo Alto."
What is our primary use case?
It is a help desk ticketing tool. It's a sought platform, however, it is just a help desk ticketing tool.
What is most valuable?
It was useful as a ticketing tool. However, it's been discontinued.
What needs improvement?
It doesn't have any integrations. It lacks multiple integrations.
It is been decommissioned by Palo Alto. There's no more trying to support it. There will be no more additional items added.
The initial setup was complex.
For how long have I used the solution?
I've been using the solution for a year or more.
What do I think about the stability of the solution?
The stability is not there.
What do I think about the scalability of the solution?
I'm not sure how scalable the solution is.
How are customer service and support?
I can't speak to technical support's capabilities. I don't have much experience with them.
How was the initial setup?
The setup has a bit of complexity. I'd rate the complexity five out of five.
I'm not sure how long the deployment took.
What other advice do I have?
We were a reseller.
I'm not sure which version of the solution we're using. It might be behind a version or two. Demisto has been purchased by Palo Alto. There's a difference in versions between the organizations. The latest version is not defined by the organization.
Potential users should not purchase this product. They decommissioned the product, and it is now at end of life.
I'd rate the solution three out of ten. It was sold to another company and decommissioned.
Disclosure: My company has a business relationship with this vendor other than being a customer: Reseller
Consulente immobiliare at Libero
I have no complaints about the stability
Pros and Cons
- "I have no complaints about Cortex's stability."
What is our primary use case?
I'm using Cortex XSOAR to manage our network security.
For how long have I used the solution?
I've been using Cortex XSOAR for about one year.
What do I think about the stability of the solution?
I have no complaints about Cortex's stability.
What do I think about the scalability of the solution?
As far as I know, Cortex XSOAR's scalability is okay. I'm just a user, so I don't know.
How was the initial setup?
Setting up Cortex is straightforward. This use case is the easiest to implement. I had help from two or three technicians.
What other advice do I have?
I rate Palo Alto Networks Cortex XSOAR eight out of 10. I would recommend it to others.
Which deployment model are you using for this solution?
On-premises
Disclosure: My company does not have a business relationship with this vendor other than being a customer.

Buyer's Guide
Download our free Palo Alto Networks Cortex XSOAR Report and get advice and tips from experienced pros
sharing their opinions.
Updated: May 2025
Popular Comparisons
Microsoft Sentinel
IBM Security QRadar
AWS Security Hub
Arctic Wolf Managed Detection and Response
Sumo Logic Security
ThreatConnect Threat Intelligence Platform (TIP)
ServiceNow Security Operations
NetWitness NDR
Fortinet FortiSOAR
IBM Resilient
Buyer's Guide
Download our free Palo Alto Networks Cortex XSOAR Report and get advice and tips from experienced pros
sharing their opinions.
Quick Links
Learn More: Questions:
- Which Do You Recommend, Phantom or Demisto?
- Which solution do you prefer: Microsoft Sentinel or Palo Alto Networks Cortex XSOAR?
- Which SOAR product has the better value: Palo Alto Networks Cortex XSOAR or Swimlane? Why?
- What are the Top 5 cybersecurity trends in 2022?
- What is the difference between SIEM and SOAR platforms?
- What is an incident response playbook and how is it used in SOAR?
- What are the latest trends in Security Operations Center (SOC)?
- What tools and solutions do you use for automated incident response in an enterprise in 2022?
- How to evaluate SIEM detection rules?
- Why a Security Operations Center (SOC) is important?