G2

Krutika B.

Business Analyst

Small-Business (50 or fewer emp.)

9/30/2026

"Strong Security Visibility and Faster Incident Response with Cortex XSIAM"

4.5/5

What do you like best about Palo Alto Cortex XSIAM?

We use Palo Alto Cortex XSIAM regularly for security monitoring, alert investigation, and endpoint visibility. One of the features I find most useful is the ability to investigate an alert and quickly move from the initial detection to related endpoint activity and other relevant security events without having to manually piece everything together from multiple tools.

Another useful aspect is the automation and correlation of security events. Instead of manually reviewing large numbers of individual alerts, XSIAM helps bring related activity together, which makes the investigation process more efficient. Review collected by and hosted on G2.com.

What do you dislike about Palo Alto Cortex XSIAM?

The main thing I dislike about Cortex XSIAM is the learning curve. I would also like to see some workflows made more intuitive, particularly for users who are new to the platform. More straightforward documentation and guided configuration would make onboarding easier. Review collected by and hosted on G2.com.

What problems is Palo Alto Cortex XSIAM solving and how is that benefiting you?

Cortex XSIAM is helping us address several challenges around security monitoring, alert fatigue, and incident response.

One of the biggest benefits for us is automated detection and investigation. XSIAM helps correlate related events and prioritize meaningful threats, reducing the volume of noise our security team needs to manually review. This allows us to focus more time on genuine incidents and threat hunting rather than repetitive alert investigation. Review collected by and hosted on G2.com.