G2

Mouadh L.

Senior Software Engineer

Enterprise (> 1000 emp.)

7/27/2026

"Solid Platform for Threat Detection and Service Monitoring"

4.5/5

What do you like best about Cortex XDR?

As a software engineer at Vistaprint who works closely with our security operations team, I’ve had hands-on experience with Cortex XDR for endpoint detection and response over the past two years. The standout capability for me is how it brings together network activity, endpoint telemetry, and signals from other Palo Alto security products into a single, unified investigation view. Instead of jumping between multiple tools, our analysts can review alerts, drill into process trees, inspect endpoint behavior, and take action from the same console.

Its incident correlation and behavioral analytics have significantly reduced alert fatigue by grouping related activity into one incident rather than generating dozens of separate notifications. We also make frequent use of the Live Terminal feature to investigate impacted endpoints remotely without needing physical access, which has meaningfully accelerated our incident response.

While there was an initial learning curve, the interface becomes intuitive and fits well with our broader infrastructure, including services running on AWS Fargate. Overall, Cortex XDR has noticeably improved our visibility into endpoint threats and helped cut down investigation time. Review collected by and hosted on G2.com.

What do you dislike about Cortex XDR?

Planning is critical for both the initial rollout and ongoing policy tuning. For our team, it took roughly three weeks and several rounds of adjustments to preventive profiles, exceptions, and behavioral rules before we found a solid balance between security coverage and false positives.

Integrations were another pain point. Connecting Cortex XDR with ServiceNow required more manual configuration than we expected, and it took longer than anticipated to get everything working reliably together.

Onboarding also takes time because there are many policies and features that need to be configured correctly. New team members typically needed extra training before they felt fully comfortable in the platform, and the documentation could be more detailed in certain areas. Licensing costs are also something to budget for carefully, since they scaled up faster than we expected as we added more endpoints. Review collected by and hosted on G2.com.

What problems is Cortex XDR solving and how is that benefiting you?

Before implementing Cortex XDR, our team had to investigate alerts from several disconnected security tools one by one. That approach slowed down investigations and increased the risk of missing related malicious activity.

With Cortex XDR, security events from multiple sources are automatically correlated into a single incident, which makes investigations much more efficient. Its machine learning and behavioral analytics also help us prioritize high-confidence alerts, so we spend less time chasing false positives.

The platform’s centralized visibility across our managed endpoints, including those tied to our AWS Fargate-based services, has strengthened our incident response workflow and supports faster containment and root-cause analysis. Overall visibility into endpoint activity has improved substantially over the past two years, and our investigation time has decreased by roughly 30%. Review collected by and hosted on G2.com.