Cortex XSIAM Reviews

Name: Cortex XSIAM
Brand: Palo Alto Networks
Rating: 4.5 (8 reviews)

4.5 out of 5

8 reviews
100% willing to recommend

What is Cortex XSIAM?

Cortex XSIAM acts as a critical element for SOC foundations, integrating SIEM and EDR capabilities, valued for threat detection and seamless security orchestration with Palo Alto Networks products.

Get the Security Information and Event Management (SIEM) Buyer's Guide and find out what your peers are saying about Cortex XSIAM, CrowdStrike Falcon, Splunk Enterprise Security and more!

Cortex XSIAM is the #10 ranked solution in top Identity Threat Detection and Response (ITDR) solutions and #29 ranked solution in top Security Information and Event Management (SIEM) solutions. PeerSpot users give Cortex XSIAM an average rating of 9.0 out of 10. Based on the analysis of the 8 most recent Cortex XSIAM reviews, the overall sentiment is positive, with a sentiment score of 7.6. Cortex XSIAM is most commonly compared to CrowdStrike Falcon: Cortex XSIAM vs CrowdStrike Falcon. Cortex XSIAM is popular among the large enterprise segment, accounting for 64% of users researching this solution on PeerSpot. The top industry researching this solution are professionals from a computer software company, accounting for 13% of all views.

Buyer's Guide

Security Information and Event Management (SIEM)

November 2024

Get the category report

Helped 816,660 peers since 2012

Featured reviews

Forrest Stevens

Senior Manager - Security Operations at First Advantage Corporation

Our primary focus with it has been to build and strengthen our security program. We have essentially developed a comprehensive security program around it. By using it as our SIEM solution, we've achieved the benefit of having a centralized, single interface for our security operations. Thanks to the capabilities of Security Orchestration, Automation, and Response (SOAR), our relatively smaller team has been able to efficiently manage our security operations. Another notable advantage is our ability to capture a lot of information that would have otherwise gone unnoticed. To illustrate this, consider that we've successfully integrated and correlated various log data from multiple sources. Viewing all this data from a unified perspective has allowed us to identify issues that might not have been detected individually but are indicative of more significant problems or threats.

Read full review

VishalPathak2

Subject Matter Expert at Softcell Technologies Limited

The customer would be okay with receiving either CrowdStrike, SentinelOne or even Cortex, as long as the price is right because they all do the same job more or less. So, it's mainly the pricing point that makes a difference in India. Since Palo Alto is trying to get as many new customers as possible, they're offering very competitive pricing. If a customer is already using the Palo Alto firewall and Prisma Access, and maybe even Prisma Cloud, then they're already familiar with Palo Alto's solutions and find it easier to manage internally. That's how they'll switch to Cortex for a unified suite.

Read full review

Mostafa-Ahmed

Cybersecurity incident response team lead at Information Technology Solutions- ITS

Before opting for it, it's essential to ensure that your organization is cloud-friendly because Cortex XSIAM is a fully cloud-based solution. You should also be comfortable with the idea of sharing and storing your logs in the cloud, as this might not align with every organization's preferences. I would suggest verifying that the desired controls are fully supported. The platform is still evolving in terms of integrations, as mentioned earlier. When it comes to taking action, it's beneficial to have an on-site developer or if that's not possible, consider purchasing specific services or features that meet the needs. It is crucial to develop a well-thought-out adoption strategy for such a comprehensive solution. Cortex XSIAM offers a wide range of capabilities, and realizing its full potential- might take multiple years and careful planning. I would rate it nine out of ten.

Read full review

Cortex XSIAM mindshare

Product category:

As of November 2024, the mindshare of Cortex XSIAM in the Security Information and Event Management (SIEM) category stands at 1.7%, up from 0.1% compared to the previous year, according to calculations based on PeerSpot user engagement data.

Security Information and Event Management (SIEM)

Key learnings from peers

Last updated Nov 18, 2024

Valuable Features

Cortex XSIAM's most valuable features include advanced security orchestration, automation, response capabilities, and exceptional security intelligence. It offers effective detection enrichment, leveraging machine learning for threat identification. Its unified structure enhances threat detection and anomaly identification. Users appreciate integration with third-party vendors and forensic investigation automation. The system secures centralized endpoints, optimizing rule setup. Palo Alto's competitive pricing and compatibility with existing systems attract customers in India, simplifying management and enhancing security strategy.

"One of the valued aspects of the product is its use of artificial intelligence to detect security vulnerabilities."
"One of the valued aspects of the product is its use of artificial intelligence to detect security vulnerabilities."
"The most valuable feature is the integration capability."

Room for Improvement

Cortex XSIAM requires enhancements in Attack Surface Management for more contextual depth and improved integration capabilities with other software. Performance optimization is needed as it slows down with multiple tabs. Pricing and technical support need betterment, and integration with more cybersecurity solutions should be expanded. While features meet current needs, faster support is desired. Detection and resolution of security vulnerabilities via AI should be optimized to respond effectively to potential threats.

"The first impression is that XSIAM would be more expensive than others we tried."
"Cortex could improve the detection and online resolution of security vulnerabilities."
"I am not sure if any improvements are needed right now."

ROI

Users experienced significant financial gains from Cortex XSIAM, realizing over $500,000 in returns. Automation of over 50% of detection and response tasks eliminated the need for additional SOC staff and resource allocation. Understaffed security teams managed incidents more effectively, leading to reduced operational challenges. Transmitted financial insights and benefits to the accounts team demonstrated that Cortex's value justified its cost.

Pricing

Enterprise users found Cortex XSIAM's pricing competitive and aligned with budget expectations, similar to Splunk and Microsoft Sentinel. While the standard licensing is favorable, additional costs arise from specific add-ons like Managed Threat Hunting. Opinions on overall cost vary, with some considering it expensive compared to competitors and others perceiving value for money. Costs driven by log ingestion are less of an issue compared to Splunk, yet initial impressions suggest Cortex XSIAM may be pricier than alternatives.

"The product cost could be considered value for money compared to other solutions in the market, though it is quite high."
"Since Palo Alto is trying to get as many new customers as possible, they're offering very competitive pricing."
"The solution is expensive compared to its competitors."

Popular Use Cases

Organizations utilize Cortex XSIAM primarily as a SIEM integrated with EDR to streamline security operations, manage data integration, automate tasks, and enhance threat detection. It centralizes third-party logs, enabling efficient incident response. Cortex XSIAM's automation reduces management effort and integrates well with Palo Alto Networks products. It can replace options like CrowdStrike or Trend Micro for those seeking cost-effective alternatives while offering powerful NextGen antivirus capabilities for malware detection.

Service and Support

Many users found technical support for Cortex XSIAM challenging, with some support staff learning the system on the job. Others praised the support team for effectively resolving issues, providing guidance, and offering a smooth process. Multiple support levels, such as premium and enterprise, exist, with premium being favored. Some experienced slow service requiring escalations, but many appreciated clear steps and timely solutions from the support team.

Deployment

Cortex XSIAM's setup is intuitive and uncomplicated, as users found it easy and quick, especially compared to Splunk and QRadar. Deployment usually takes about one to two weeks, sometimes extending due to integration and fine-tuning. The process requires deploying a broker and automates integration connections, but documentation needs improvement. Most deployment options are cloud-based. Users rated the initial setup between seven and eight out of ten, indicating a generally favorable experience.

Scalability

Cortex XSIAM demonstrates remarkable scalability, easily expanding through additional tenants and cloud-based deployment. Organizations of varying sizes, including enterprise-level clients, find it adaptable for tasks such as security operations and system administration. Cloud availability facilitates smooth scaling, making it suitable for extensive application stacks. No issues have been identified with scalability, though some prefer a more robust on-premises capability. Users in IT departments highly rate the scalability, indicating successful integration across assets and users.

Stability

Cortex XSIAM demonstrates strong stability, with users encountering minimal downtime over extended use. Any issues were swiftly resolved, underscoring its robust performance. It consistently earns high marks, often rated ten out of ten for stability. The cloud-based architecture enhances its reliability, requiring little maintenance. Although minor issues may arise following updates, they are quickly addressed. Users report ease of installation and consistent performance, reinforcing the perception of impressive stability.

These insights are based on the in-depth reviews provided by peers to help you make a better buying decision.

Download our Security Information and Event Management (SIEM) Buyer's Guide for additional reliable information.

Review data by company size

By reviewers

By visitors reading reviews

Top industries

By visitors reading reviews

Computer Software Company

13%

Manufacturing Company

10%

Financial Services Firm

Government

Comms Service Provider

Retailer

Healthcare Company

Insurance Company

Energy/Utilities Company

University

Media Company

Construction Company

Educational Organization

Outsourcing Company

Recreational Facilities/Services Company

Real Estate/Law Firm

Engineering Company

Hospitality Company

Transportation Company

Wholesaler/Distributor

Pharma/Biotech Company

Legal Firm

Performing Arts

Logistics Company

Non Profit

Recruiting/Hr Firm

Security Firm

Compare Cortex XSIAM with alternative products

Learn more about Cortex XSIAM

Organizations find Cortex XSIAM beneficial for SOC foundations due to its capability to integrate SIEM and EDR tools, facilitating data collection, detection, and response. It connects with third-party data sources while reducing management effort and offering cost-effective alternatives to competitors like CrowdStrike and Trend Micro. Featuring automation and integration with Palo Alto Networks products, Cortex XSIAM enhances threat detection. Unified architecture allows a comprehensive view of attacks, further supported by machine learning and integration with existing vendor solutions, ensuring that users gain insights without significant manual log analysis.

What are Cortex XSIAM's key features?

Security Orchestration: Streamlines processes across security operations.
Automation and Response: Efficient incident response management.
Detection Enrichment: Enhances identification of threats.
Centralized Endpoint Security: Comprehensive protection and monitoring of endpoints.
Forensic Investigation: Automated investigation to expedite threat analysis.

What benefits are evident in Cortex XSIAM reviews?

Cost-Effectiveness: Provides economical options compared to other market players.
Comprehensive Integration: Seamlessly integrates with multiple data sources and vendors.
Reduced Management Effort: Simplifies the administration of security operations.
Enhanced Threat Detection: Strengthens identification and remediation processes.

Industries implement Cortex XSIAM mainly in technology-driven sectors where centralized endpoint protection and automation of forensic investigation are paramount. By integrating several third-party systems for incident response, companies in competitive markets leverage its attributes for heightened operational security efficiency. However, users note areas for improvement, such as Attack Surface Management and integration enhancements, to better suit tech-heavy industries needing extensive connectivity with cybersecurity solutions.