G2

Ayoub S.

Information Technology Support Analyst

Small-Business (50 or fewer emp.)

9/12/2026

Business partner of the seller or seller's competitor, not included in G2 scores.

"Unified SOC Workflows with Smart Alert Correlation and Automation"

5/5

What do you like best about Palo Alto Cortex XSIAM?

What I like best about Cortex XSIAM is how it unifies SOC workflows into a single platform instead of forcing analysts to jump between separate SIEM, EDR, SOAR, and threat intel tools. The automated alert correlation and stitching of related events into a single incident dramatically cuts down on alert fatigue and manual triage time. The built-in automation/playbooks also let simple, repetitive response actions happen without analyst intervention, which frees the team to focus on genuinely complex investigations. On top of that, the AI-driven analytics do a solid job of surfacing real threats from noise, and the integration with Cortex XDR gives strong endpoint visibility right out of the box. Review collected by and hosted on G2.com.

What do you dislike about Palo Alto Cortex XSIAM?

One thing I dislike about Cortex XSIAM is the steep learning curve — the platform is extremely feature-rich, which also means onboarding new analysts and fully mastering the data modeling, correlation rules, and playbook customization takes considerable time. Pricing and licensing can also be complex and expensive compared to some competitors, making cost forecasting difficult for growing SOC teams. Additionally, some integrations with third-party tools outside the Palo Alto ecosystem feel less mature than the native ones, occasionally requiring workarounds or custom scripting. Documentation, while extensive, can sometimes lag behind new feature releases, making troubleshooting newer capabilities a bit harder. Review collected by and hosted on G2.com.

What problems is Palo Alto Cortex XSIAM solving and how is that benefiting you?

Cortex XSIAM is primarily solving the problem of alert overload and fragmented visibility that most traditional SOCs struggle with. Before consolidating onto a unified platform, correlating data across endpoints, network, cloud, and identity sources meant juggling multiple disconnected tools, which slowed down detection and response times significantly. By centralizing data ingestion and using AI-driven correlation, XSIAM reduces thousands of raw alerts down to a manageable number of prioritized incidents, so analysts spend less time chasing false positives and more time on real threats. The automation and playbooks also handle repetitive triage and containment steps automatically, which has cut down our mean time to detect (MTTD) and mean time to respond (MTTR) considerably. Overall, this has translated into a leaner SOC operation, better analyst productivity, and stronger overall security posture without needing to scale headcount at the same rate as alert volume. Review collected by and hosted on G2.com.