--- title: Palo Alto Networks Cortex XSOAR Reviews meta\_title: 'Palo Alto Networks Cortex XSOAR Reviews 2026: Details, Pricing, & Features | G2' meta\_description: Filter 28 reviews by the users' company size, role or industry to find out how Palo Alto Networks Cortex XSOAR works for a business like yours. aggregate\_rating: rating\_value: 4.6 review\_count: 28 scale: '5' date\_modified: '2026-08-09' parent\_category: name: System Security url: https://www.g2.com/categories/system-security --- # Palo Alto Networks Cortex XSOAR Reviews & Product Details Palo Alto Networks' Cortex XSOAR is a comprehensive Security Orchestration, Automation, and Response (SOAR) platform designed to streamline and enhance security operations. By integrating automation, case management, real-time collaboration, and threat intelligence management, Cortex XSOAR empowers security teams to respond to incidents more efficiently and effectively. Key Features and Functionality: - Process Standardization and Automation: Cortex XSOAR offers over 270 out-of-the-box playbooks, enabling the automation of numerous security use cases. These playbooks orchestrate response actions across more than 350 third-party products, facilitating seamless integration and operational consistency. - Security-Focused Case Management: The platform unifies alerts, incidents, and indicators from various sources into a single case management framework. This consolidation accelerates incident response by providing a comprehensive view of security events. - Real-Time Collaboration: Cortex XSOAR includes a Virtual War Room equipped with built-in ChatOps and a command-line interface. This feature allows security teams to collaborate in real time, execute commands across the entire product stack, and manage incidents more effectively. - Threat Intelligence Management: The platform aggregates disparate threat intelligence sources, customizes and scores feeds, and matches indicators against the organization's specific environment. This capability enables security teams to take informed actions swiftly. Primary Value and Problem Solving: Cortex XSOAR addresses the challenges faced by security teams, such as the overwhelming volume of alerts and the need for rapid incident response. By automating repetitive tasks and standardizing processes, the platform reduces the time spent on incidents by up to 90%, allowing analysts to focus on critical threats. The integration of threat intelligence management with SOAR capabilities ensures that organizations can operationalize threat feeds effectively, enhancing their overall security posture. Additionally, the platform's extensive integration ecosystem, with over 360 third-party integrations, enables organizations to orchestrate complex workflows across their existing security infrastructure without extensive custom development. * * * Seller [Palo Alto Networks](https://www.g2.com/sellers/palo-alto-networks) Discussions [Palo Alto Networks Cortex XSOAR Community](https://www.g2.com/products/palo-alto-networks-cortex-xsoar/discuss) Solution Type Best-of-Breed Show More ## Value at a Glance Averages based on real user reviews. ### Time to Implement 2 months ### Return on Investment 13 months [ View More Pricing Information ](https://www.g2.com/products/palo-alto-networks-cortex-xsoar/pricing) ## Top-Rated Alternatives [ ![Microsoft Sentinel](/assets/transparent-ad5be28fbcd25b7b08d2cebe1d957125437fb5407d75ee717965ad22c8808791.gif "Microsoft Sentinel") Microsoft Sentinel 4.4/5(297) ](https://www.g2.com/products/microsoft-sentinel/reviews) [ ![Tines](/assets/transparent-ad5be28fbcd25b7b08d2cebe1d957125437fb5407d75ee717965ad22c8808791.gif "Tines") Tines 4.7/5(406) ](https://www.g2.com/products/tines/reviews) [ ![Splunk SOAR (Security Orchestration, Automation and Response)](/assets/transparent-ad5be28fbcd25b7b08d2cebe1d957125437fb5407d75ee717965ad22c8808791.gif "Splunk SOAR (Security Orchestration, Automation and Response)") Splunk SOAR (Security Orchestration, Automation and Response) 4.4/5(41) ](https://www.g2.com/products/splunk-soar-security-orchestration-automation-and-response/reviews) [ View All Alternatives ](https://www.g2.com/products/palo-alto-networks-cortex-xsoar/competitors/alternatives) ## User Insights Average based on 28 real user reviews. Implementation Time 2 months Perceived Cost $$$$$ [Log in to unlock pricing and user insights](/login) ## Palo Alto Networks Cortex XSOAR Integrations (1) What do users say about integrations? Integration information sourced from real user reviews. [ ![Product Avatar Image](/assets/transparent-ad5be28fbcd25b7b08d2cebe1d957125437fb5407d75ee717965ad22c8808791.gif "Product Avatar Image") Microsoft Sentinel ](https://www.g2.com/products/microsoft-sentinel/reviews) Show More ![Jai P.](/assets/transparent-ad5be28fbcd25b7b08d2cebe1d957125437fb5407d75ee717965ad22c8808791.gif "Jai P.") JP Jai P. Cyber Security Engineer Security and Investigations Mid-Market (51-1000 emp.) 11/6/2024 "Unlocking Security Operations automation with Cortex XSOAR" 5/5 What do you like best about Palo Alto Networks Cortex XSOAR? PAlo alto cortex xsoar comes for both On-Premises and Cloud which makes its implementation easy and best as per needs. It provide the easy and scalable deployment. It have its own threat intelligence Unit 42 through which it correlate the logs and find the threats before attack take place. It comes with marketplace with more than 1000 integrations, only you have to go to marketplace and download the integration which u want and can easily integrate just with one click add instances. When we talk about the customere support , plao alto team provide the support within 30 min for critical issues which is so fast to solve the challenges. XSOAR is used in organization frequently to reduce the chance of attack and take action faster before attack take place. It have predefined reports and playbooks which comes with the content pack in marketplace. Review collected by and hosted on G2.com. What do you dislike about Palo Alto Networks Cortex XSOAR? Palo Alto cortex xsoar is fully advanced SOAR solutions with multiple features than others. As the product dont have anything which is dislikes rather than the cost which is little expensive but beacuse of features the cost less as per my views. As i face little challenges in integrating on-premises solution with cortex xsoar cloud. Rather than this this product can make life easier for security analyst to investigate and respond to threat, they not have to switch tab by tab for investigating threats. Review collected by and hosted on G2.com. What problems is Palo Alto Networks Cortex XSOAR solving and how is that benefiting you? With the help of palo alto cortex xsoar we are able to take automated response on the sophsticated attacks and threats. Lets take and example of Phising attacks. An employee of my company get the phising mail that alert was generated by Cortex xdr with the help of sendedr email of link in the mail. Th xdr push the alert to cortex xsoar where we will identify whether the mail is really a phising mail of not. To do this we will investigate the alert for that we will go in incident and find the incident of phshing, after clicking on incident we will get thye basic information from the xdr investogation of incident and after going in wok plan we will select a playbook whether it is predefined or we had created before for phising attack that when we will get phising attack what action whould be taken. We will associate that playbook and run the playbook with the help of playbook the incident will b einvestigated and if found phsing than it will get blocked in the organizations. With the help of Cortex xsoar we are able to take response on the incident, threat or attacks which damage the organization before the attack happen. It helps in improving the security posture of my organization and also helps in compliance beacuse it have predefined reports. It also helps in preventing the organization from malicious activities or threats which can damage or occur data breach. Review collected by and hosted on G2.com. Show More 5/20/2026 Current UserValidated ReviewerSource: Organic ![Pablo V.](/assets/transparent-ad5be28fbcd25b7b08d2cebe1d957125437fb5407d75ee717965ad22c8808791.gif "Pablo V.") PV Pablo V. Senior SOC Analyst Enterprise (\> 1000 emp.) 11/17/2025 "Powerful Tool with Clean Data and Seamless Integrations" 5/5 What do you like best about Palo Alto Networks Cortex XSOAR? very strong and powerfull tool, it provides nice and clean data information, entities, links, and we can intragrate a lot of tools into it to work safe and faster Review collected by and hosted on G2.com. What do you dislike about Palo Alto Networks Cortex XSOAR? sometimes the results from data logs are not easy to read faster due to window size. We need to open them in a new tab Review collected by and hosted on G2.com. What problems is Palo Alto Networks Cortex XSOAR solving and how is that benefiting you? several tooling into a single merged with user friendly interface Review collected by and hosted on G2.com. Show More Current UserValidated ReviewerSource: Organic ![Verified User in Manufacturing](/assets/icons/anonymous-avatar-purple-4ae1032bdb50ee5682003170c8184aee790d25958bd397abbd384ba52c596a7b.svg "Verified User in Manufacturing") AM Verified User in Manufacturing Enterprise (\> 1000 emp.) 2/5/2025 "One of the best SOAR platform easy to integrate with Sekoia and Recorded Future" 5/5 What do you like best about Palo Alto Networks Cortex XSOAR? Pretty good perfomance on a very large environment like ours with 65,000+ Cortex XDR agents. We have it integrated with IOCs from Recorded Future and Sekoia CTI feeds, which works pretty well for us. We have playbooks to adjust incidents score and severity based on IOC risk score obtained through the integration. Review collected by and hosted on G2.com. What do you dislike about Palo Alto Networks Cortex XSOAR? Reporting can be improved and wish for more customization options Review collected by and hosted on G2.com. What problems is Palo Alto Networks Cortex XSOAR solving and how is that benefiting you? Saves a lot of manual work on incident management. Our playbooks make it easier for the GSOC analysts to prioritize incidents based on incident score, which the playbooks update based on feeds from third-party CTI sources. We developed a playbook to automatically email weekly reports which include Excel attachments containig all Cortex XDR agents deployed at each site. This allows the local IT admins to take actions to fix or reinstall the agent when it may get corrupt or stop communicating. The Cortex XSOAR also helps automatically closing False Positive incidents, runs Cortex malware scans and our cyber security analysts can focus on more critical incidents. Review collected by and hosted on G2.com. Show More Current UserValidated ReviewerIncentivizedSource: G2 invite ![MATHEW SHIJOY R.](/assets/transparent-ad5be28fbcd25b7b08d2cebe1d957125437fb5407d75ee717965ad22c8808791.gif "MATHEW SHIJOY R.") MR MATHEW SHIJOY R. IT-HOD Manufacturing Mid-Market (51-1000 emp.) 5/16/2025 "Simplifying Threat Intelligence with Palo Alto Networks AutoFocus" 5/5 What do you like best about Palo Alto Networks Cortex XSOAR? It helps security teams cut through the noise of numerous alerts by distinguishing between high-impact threats and more common attacks. The tagging system, including Unit 42 tags, is particularly useful for this. Review collected by and hosted on G2.com. What do you dislike about Palo Alto Networks Cortex XSOAR? While the interface is generally considered intuitive, some aspects like configuration might be complex, potentially leading to a steeper learning curve for new users. Review collected by and hosted on G2.com. What problems is Palo Alto Networks Cortex XSOAR solving and how is that benefiting you? egularly reviewing and fine-tuning the configuration of security tools is crucial to reduce false positives and irrelevant alerts. This involves adjusting detection rules, setting appropriate thresholds, and creating baselines of normal network and system behavior to highlight anomalies more effectively. Review collected by and hosted on G2.com. Show More Validated ReviewerSource: Organic ![Mohammed S.](/assets/transparent-ad5be28fbcd25b7b08d2cebe1d957125437fb5407d75ee717965ad22c8808791.gif "Mohammed S.") MS Mohammed S. Network Security Engineer Telecommunications Small-Business (50 or fewer emp.) 3/23/2025 "I'm a network security engineer" 5/5 What do you like best about Palo Alto Networks Cortex XSOAR? Help my organization to detect any suspicious activity and take the action against. Review collected by and hosted on G2.com. What do you dislike about Palo Alto Networks Cortex XSOAR? Complex in working and I toke a lot of time until could deal with. Review collected by and hosted on G2.com. What problems is Palo Alto Networks Cortex XSOAR solving and how is that benefiting you? Nothing Review collected by and hosted on G2.com. Show More Validated ReviewerSource: Thank You page ![Verified User in Retail](/assets/icons/anonymous-avatar-purple-4ae1032bdb50ee5682003170c8184aee790d25958bd397abbd384ba52c596a7b.svg "Verified User in Retail") AR Verified User in Retail Enterprise (\> 1000 emp.) 3/26/2025 "Great XSOAR, Easily customizible" 5/5 What do you like best about Palo Alto Networks Cortex XSOAR? Very customizable, great UI, very powerful when it comes to automating tasks for incident response. Good direct customer support. Review collected by and hosted on G2.com. What do you dislike about Palo Alto Networks Cortex XSOAR? customer service, on-prem maintenance, does take time to learn the ropes Review collected by and hosted on G2.com. What problems is Palo Alto Networks Cortex XSOAR solving and how is that benefiting you? Time to work incidents and time management when it comes to enrichment of palybooks Review collected by and hosted on G2.com. Show More Validated ReviewerSource: Organic ![Perinban M.](/assets/transparent-ad5be28fbcd25b7b08d2cebe1d957125437fb5407d75ee717965ad22c8808791.gif "Perinban M.") PM Perinban M. Network Security Engineer Mid-Market (51-1000 emp.) 4/10/2024 "Purchase Worthy and Effective Product" 4.5/5 What do you like best about Palo Alto Networks Cortex XSOAR? Event labelling and prioritisation. Personalised notifications for particular events and indications. Personalised notifications for particular events and indications. Unit 42 direct integration on the dashboard with minemeld integration via the indicationsIn comparison to your company's DNSC perspective, sectoral and views are excellent I receive more information about the autofocus . Review collected by and hosted on G2.com. What do you dislike about Palo Alto Networks Cortex XSOAR? I am only able to directly integrate other suppliers into the PaloAlto system. There aren't many application connectors; for automation, you need have your personal SOAR. Privacy concerns: certain information or variables cannot be hashed on the cloud. The cloud data sharing feature offers limit settings. I don't see data going in, being analysed, or being integrated for the Prisma cloud side; it's intended for strata. Review collected by and hosted on G2.com. What problems is Palo Alto Networks Cortex XSOAR solving and how is that benefiting you? Specifically, AutoFocus helps you in monitoring threat trends associated with targeted cyberattacks, allowing you to take proactive measures to safeguard the network. Review collected by and hosted on G2.com. Show More Validated ReviewerIncentivizedSource: G2 invite ![Vishal V.](/assets/transparent-ad5be28fbcd25b7b08d2cebe1d957125437fb5407d75ee717965ad22c8808791.gif "Vishal V.") VV Vishal V. Network Security Engineer Mid-Market (51-1000 emp.) 1/10/2023 "A short note on Palo Alto AutoFocus" 4.5/5 What do you like best about Palo Alto Networks Cortex XSOAR? This feature is supported in PanOs 7.1 and later gives a complete intelligence summary of Firewall logs. It is a kind of repository of Palo Alto Networks which contains information regarding the available threat. Review collected by and hosted on G2.com. What do you dislike about Palo Alto Networks Cortex XSOAR? 1. It is solely related to Palo Alto Networks, we can't integrate with other vendors. 2.UI should be improved for better response 3.This feature is mainly focused on strata only Review collected by and hosted on G2.com. What problems is Palo Alto Networks Cortex XSOAR solving and how is that benefiting you? It provides the complete threat intelligence report of threat logs. It helps security teams to easily track and analyze critical attacks without any additional IT Security resources, as the Palo Alto Autofocus feature enables automation which helps in the detection and cause of attacks. Review collected by and hosted on G2.com. Show More 4/21/2023 Validated ReviewerIncentivizedSource: G2 invite ![Jatin .](/assets/transparent-ad5be28fbcd25b7b08d2cebe1d957125437fb5407d75ee717965ad22c8808791.gif "Jatin .") J Jatin . Security Analyst Enterprise (\> 1000 emp.) 11/15/2022 "XSOAR - Solution for all the automation" 4/5 What do you like best about Palo Alto Networks Cortex XSOAR? Easy-to-use GUI, out-of-the-box scripts for most of the automation tasks, and supported integration packs for almost all the tools (at least from security perspective) help automate complicated and repetitive tasks quickly yet efficiently. Review collected by and hosted on G2.com. What do you dislike about Palo Alto Networks Cortex XSOAR? This solution requires a dedicated team to create and modify the playbooks and other underlying configurations (mapper, classifier etc.). The pre-built playbooks are too generic to be used directly and require quite a few changes, instead of which one can work on creating a new one. Review collected by and hosted on G2.com. What problems is Palo Alto Networks Cortex XSOAR solving and how is that benefiting you? It helps automate complicated and repetitive tasks, which saves a lot of upfront time while working on security investigations. We also leverage the platform as a ticketing solution to gather alerts from different security tools also for alerts; most of the details collect via automation which helps determine the next course of action quickly. Review collected by and hosted on G2.com. Show More Current UserValidated ReviewerIncentivizedSource: G2 invite ![Verified User in Computer & Network Security](/assets/icons/anonymous-avatar-purple-4ae1032bdb50ee5682003170c8184aee790d25958bd397abbd384ba52c596a7b.svg "Verified User in Computer & Network Security") UC Verified User in Computer & Network Security Enterprise (\> 1000 emp.) 5/12/2023 "Simple and effective" 4/5 What do you like best about Palo Alto Networks Cortex XSOAR? Simple GUI, easy-to-create playbook tending to your needs. The customer support is fantastic as well. Very knowledgable. The XSOAR teams has a quick response time. Review collected by and hosted on G2.com. What do you dislike about Palo Alto Networks Cortex XSOAR? If they advertised the features more, it is leaning more toward a DYI tool. Compared to other competitors more research is required when navigating the dashboard. Review collected by and hosted on G2.com. What problems is Palo Alto Networks Cortex XSOAR solving and how is that benefiting you? I am no longer using xsoar since my company switched to a new tool however XSOAR was fantastic for running automated phishing playbooks. Business performance was great. Review collected by and hosted on G2.com. Show More Current UserValidated ReviewerIncentivizedSource: G2 invite ## Questions about Palo Alto Networks Cortex XSOAR? Ask real users or explore answers from the community Get practical answers, real workflows, and honest pros and cons from the G2 community or share your insights. [ Ask about Palo Alto Networks Cortex XSOAR ](https://www.g2.com/products/palo-alto-networks-cortex-xsoar/discussions/new) GU Guest User What is Palo Alto Networks Cortex XSOAR used for? 0 Upvotes 0 [ Join the conversation ](https://www.g2.com/discussions/what-is-palo-alto-networks-cortex-xsoar-used-for) [ View all Discussions ](https://www.g2.com/products/palo-alto-networks-cortex-xsoar/discuss) ## Pricing Insights Averages based on real user reviews. ### Time to Implement 2 months ### Return on Investment 13 months ### Average Discount 11% [ View More Pricing Information ](https://www.g2.com/products/palo-alto-networks-cortex-xsoar/pricing) Palo Alto Networks Cortex XSOAR Comparisons ![Product Avatar Image](https://images.g2crowd.com/uploads/product/image/small_square/small_square_91bcb2c063fcfb0a82dfedcf1a6463d1/splunk-soar-security-orchestration-automation-and-response.jpg "Product Avatar Image") Splunk SOAR (Security... 4.4/5(41) [ Compare Now ](https://www.g2.com/compare/palo-alto-networks-cortex-xsoar-vs-splunk-soar-security-orchestration-automation-and-response) ![Product Avatar Image](https://images.g2crowd.com/uploads/product/image/small_square/small_square_4e2b08dd17397bdc99a5658447cbc589/microsoft-sentinel.jpg "Product Avatar Image") Microsoft Sentinel 4.4/5(297) [ Compare Now ](https://www.g2.com/compare/microsoft-sentinel-vs-palo-alto-networks-cortex-xsoar) ![Product Avatar Image](https://images.g2crowd.com/uploads/product/image/small_square/small_square_aeae116c52945fdecd7ed16d621cb315/google-security-operations.png "Product Avatar Image") Google Security Operations 4.4/5(85) [ Compare Now ](https://www.g2.com/compare/google-security-operations-vs-palo-alto-networks-cortex-xsoar) ##### ##### Palo Alto Networks Cortex XSOAR Features Orchestration Security Orchestration Data Collection Threat Intelligence Automation Workflow Mapping Workflow Automation Automated Remediation Response Alerting Performance Baselin High Availability/Disaster Recovery [ View More Features ](https://www.g2.com/products/palo-alto-networks-cortex-xsoar/features) ## Work at Palo Alto Networks? Claim this profile to respond to reviews, update product info, and reach in-market buyers. [ Claim this profile ](https://www.g2.com/products/palo-alto-networks-cortex-xsoar/claim_requests/new?utm_medium=profile-footer-claim-cta&utm_source=g2) ##### Categories on G2 [Threat Intelligence](https://www.g2.com/categories/threat-intelligence)[Security Orchestration, Automation, and Response (SOAR)](https://www.g2.com/categories/security-orchestration-automation-and-response-soar) ##### Explore More [What application release orchestration platforms work best for a platform engineering team standardizing deployment pipelines across 50 or more microservices at once?](https://www.g2.com/discussions/what-application-release-orchestration-platforms-work-best-for-a-platform-engineering-team-standardizing-deployment-pipelines-across-50-or-more-microservices-at-once)[What is the top-rated video communication platform for enterprises?](https://www.g2.com/discussions/what-is-the-top-rated-video-communication-platform-for-enterprises)[Top tools for managing reserved instance usage](https://www.g2.com/discussions/what-are-the-top-tools-for-managing-reserved-instance-usage) [Which SEO software is top-rated for increasing website traffic](https://www.g2.com/discussions/which-seo-software-is-top-rated-for-increasing-website-traffic)[What's the best digital signage provider](https://www.g2.com/discussions/what-are-the-best-digital-signage-providers)[Pros and Cons Details](https://www.g2.com/products/palo-alto-networks-cortex-xsoar/reviews?qs=pros-and-cons) [Show MoreShow Less](javascript:void(0);)