Cortex XSOAR
Palo Alto Networks' dedicated SOAR product, built from its 2019 acquisition of Demisto. It ships with a large catalog of integrations and playbooks and remains available separately from Cortex XSIAM.
Verified Source: 1
- Product type
- Software
- Deployment
- SaaSOn-prem
- Organization size
- Mid-marketEnterprise
- Pricing tier
- $$$
Capability checklist
SOARHow Cortex XSOAR measures up against the full Security Orchestration, Automation & Response taxonomy.
- Playbook / workflow automation — supported
- Runs automated multi-step response actions triggered by an alert.
- Case management — supported
- Tracks an incident from alert to closure with notes, evidence, and assignments.
- Integration & connector library — supported
- Connects to SIEM, EDR, ticketing, and other tools to take action across the stack.
- Alert triage & enrichment — supported
- Automatically gathers context on an alert before an analyst sees it.
- No-code / low-code playbook builder — supported
- Lets analysts build automation without writing custom scripts.
- Metrics & SLA reporting — supported
- Reports response times and automation impact against team SLAs.
Alternatives
Other Security Orchestration, Automation & Response tools with overlapping capabilities, sized for similar teams.
Appears in stacks
Real-world stacks that include Cortex XSOAR.