G2

Dharmender S.

Information Technology Consultant

Enterprise (> 1000 emp.)

9/1/2026

"Cortex XSIAM Slashes Alert Fatigue with AI-Driven, High-Context Incidents"

4/5

What do you like best about Palo Alto Cortex XSIAM?

I’ve been testing Cortex XSIAM and am highly impressed by how effectively it cuts through alert fatigue. The platform's ability to automatically stitch raw logs from endpoints, network, and cloud into unified, high-context incidents has dramatically reduced our manual triage workload. Consolidating SIEM, XDR, and SOAR into a single, AI-driven data lake has noticeably accelerated our detection and remediation speeds. For teams already operating within the Palo Alto ecosystem, the seamless data integration is a massive timesaver. It genuinely shifts the SOC from a reactive footing to a highly automated one, allowing our analysts to focus on real threats rather than chasing endless false positives. Review collected by and hosted on G2.com.

What do you dislike about Palo Alto Cortex XSIAM?

While the automation in Cortex XSIAM is powerful, the platform has some noticeable drawbacks. The ingestion-based pricing model is incredibly expensive, making it hard to justify for our budget. We’ve also run into significant vendor lock-in; the tool works seamlessly with Palo Alto products, but configuring third-party, non-Palo Alto data sources and custom parsers has been frustratingly limited and slow. Additionally, the learning curve is exceptionally steep. Review collected by and hosted on G2.com.

What problems is Palo Alto Cortex XSIAM solving and how is that benefiting you?

Cortex XSIAM is solving our biggest operational headache by drastically cutting through daily alert fatigue. Before implementing it, our analysts were overwhelmed by thousands of disconnected alerts across our endpoints, firewalls, and cloud environments. XSIAM solves this by automatically stitching those raw logs into singular, high-context 'incidents.' The primary benefit to us has been a radical acceleration in our response times; our mean time to remediate (MTTR) has plummeted because the platform combines SIEM, XDR, and SOAR into one automated workflows engine. It has effectively shifted our security team from a reactive, stressed footing to a proactive one, allowing us to focus our engineering time on genuine threats rather than chasing endless false positives. Review collected by and hosted on G2.com.