Cortex XSIAM Reviews

Name: Cortex XSIAM
Brand: Palo Alto Networks
Rating: 5 (7 reviews)

4.6 out of 5

7 reviews
100% willing to recommend

What is Cortex XSIAM?

Cortex XSIAM acts as a critical element for SOC foundations, integrating SIEM and EDR capabilities, valued for threat detection and seamless security orchestration with Palo Alto Networks products.

Get the Security Information and Event Management (SIEM) Buyer's Guide and find out what your peers are saying about Cortex XSIAM, CrowdStrike Falcon, Splunk Enterprise Security and more!

Cortex XSIAM is the #10 ranked solution in top Identity Threat Detection and Response (ITDR) solutions and #29 ranked solution in top Security Information and Event Management (SIEM) solutions. PeerSpot users give Cortex XSIAM an average rating of 9.2 out of 10. Based on the analysis of the 7 most recent Cortex XSIAM reviews, the overall sentiment is positive, with a sentiment score of 7.3. (Among the highest in the category). Cortex XSIAM is most commonly compared to CrowdStrike Falcon: Cortex XSIAM vs CrowdStrike Falcon. Cortex XSIAM is popular among the large enterprise segment, accounting for 64% of users researching this solution on PeerSpot. The top industry researching this solution are professionals from a computer software company, accounting for 14% of all views.

Buyer's Guide

Security Information and Event Management (SIEM)

October 2024

Get the category report

Helped 814,763 peers since 2012

Featured reviews

Forrest Stevens

Senior Manager - Security Operations at First Advantage Corporation

Our primary focus with it has been to build and strengthen our security program. We have essentially developed a comprehensive security program around it. By using it as our SIEM solution, we've achieved the benefit of having a centralized, single interface for our security operations. Thanks to the capabilities of Security Orchestration, Automation, and Response (SOAR), our relatively smaller team has been able to efficiently manage our security operations. Another notable advantage is our ability to capture a lot of information that would have otherwise gone unnoticed. To illustrate this, consider that we've successfully integrated and correlated various log data from multiple sources. Viewing all this data from a unified perspective has allowed us to identify issues that might not have been detected individually but are indicative of more significant problems or threats.

Read full review

VishalPathak2

Subject Matter Expert at Softcell Technologies Limited

The customer would be okay with receiving either CrowdStrike, SentinelOne or even Cortex, as long as the price is right because they all do the same job more or less. So, it's mainly the pricing point that makes a difference in India. Since Palo Alto is trying to get as many new customers as possible, they're offering very competitive pricing. If a customer is already using the Palo Alto firewall and Prisma Access, and maybe even Prisma Cloud, then they're already familiar with Palo Alto's solutions and find it easier to manage internally. That's how they'll switch to Cortex for a unified suite.

Read full review

Mostafa-Ahmed

Cybersecurity incident response team lead at Information Technology Solutions- ITS

Before opting for it, it's essential to ensure that your organization is cloud-friendly because Cortex XSIAM is a fully cloud-based solution. You should also be comfortable with the idea of sharing and storing your logs in the cloud, as this might not align with every organization's preferences. I would suggest verifying that the desired controls are fully supported. The platform is still evolving in terms of integrations, as mentioned earlier. When it comes to taking action, it's beneficial to have an on-site developer or if that's not possible, consider purchasing specific services or features that meet the needs. It is crucial to develop a well-thought-out adoption strategy for such a comprehensive solution. Cortex XSIAM offers a wide range of capabilities, and realizing its full potential- might take multiple years and careful planning. I would rate it nine out of ten.

Read full review

Cortex XSIAM mindshare

Product category:

As of November 2024, the mindshare of Cortex XSIAM in the Security Information and Event Management (SIEM) category stands at 1.7%, up from 0.1% compared to the previous year, according to calculations based on PeerSpot user engagement data.

Security Information and Event Management (SIEM)

Key learnings from peers

Last updated Oct 16, 2024

Valuable Features

Cortex XSIAM excels in SOAR capabilities, security intelligence, and detection enrichment, providing comprehensive threat and anomaly detection. It features robust machine learning for threat identification and efficient integration capabilities, enabling seamless third-party collaboration. Its unified architecture enhances holistic security analysis, while extensive database operations ensure effective threat management across networks and endpoints. Users benefit from forensic automation, playbooks, and centralized endpoint security. Competitive pricing and Palo Alto integration are additional advantages.

"The most valuable feature is the integration capability."
"The automation capabilities significantly improve response times by allowing us to respond to incidents from a single dashboard rather than navigating multiple dashboards."
"It does a better job of identifying anomalies that are more likely to be incidents of compromise without as many false positives or false negatives."

Room for Improvement

Cortex XSIAM needs enhancement in the Attack Surface Management module for deeper context, better integration with various products, and performance optimization to handle multiple tabs without slowdowns. Its developer-friendliness and flexibility require improvements. Pricing and technical support speed are other areas needing attention, with further expansion in integration capabilities with diverse cybersecurity solutions. Although some find its current features satisfactory, ongoing improvements based on customer feedback are expected.

"I am not sure if any improvements are needed right now."
"There is room for improvement in expanding integrations to include more cybersecurity solutions."
"It could provide more integration with a large variety of products."

Pricing

Cortex XSIAM offers competitive pricing comparable to Splunk and Microsoft Sentinel, but it is considered expensive. Costs can increase with additional add-ons like Managed Threat Hunting and Identity Threat Analytics from Palo Alto Networks. Organizations find standard licensing favorable, as pricing isn't impacted by the volume of logs, unlike Splunk. Opinions on cost vary, with some rating it a six and others a nine, considering value for money despite high pricing.

"The product cost could be considered value for money compared to other solutions in the market, though it is quite high."
"Since Palo Alto is trying to get as many new customers as possible, they're offering very competitive pricing."
"The solution is expensive compared to its competitors."

Popular Use Cases

Organizations primarily use Cortex XSIAM as a Security Information and Event Management tool, integrating it with Security Operations Center infrastructure. It combines SIM and EDR functionalities, automating tasks and integrating with Palo Alto Networks products. They utilize it for threat detection, network traffic data collection, and management of third-party data. Cortex XSIAM supports store operations, micro-automation for incident response, and serves as a NextGen antivirus detecting malware in endpoints and devices.

Service and Support

Cortex XSIAM customer service presents mixed experiences. Some report challenges due to staff learning on the job, occasionally leading to slower responses. However, others found the team helpful and efficient, especially when addressing notifications. Cortex XSIAM offers premium, enterprise, and other support variants, with premium support regarded highest by users. Despite occasional delays needing escalations, support is generally considered robust, particularly when clear guidance is needed. Service adjustments sometimes involve coordination with the engineering team.

Deployment

Cortex XSIAM's initial setup is intuitive and uncomplicated, operating as a SaaS with straightforward deployment. Users find it easy, typically taking one to two weeks for implementation, including broker deployment and integration. Some rate the setup highly, noting its ease compared to other solutions like Splunk. While documentation needs improvement and deployment options are mostly cloud-based, integrating the XDR Cortex platform and creating analytics rules are key tasks in the process.

Scalability

Cortex XSIAM exhibits remarkable scalability, effortlessly accommodating various organizational sizes by allowing additional tenants. Its cloud-based nature enables seamless scaling, with easy integration of features. Numerous companies utilize it for diverse tasks, handling an extensive number of assets without any scalability issues. Users note its suitability for enterprise clients, with the capability to grow as application stacks expand. Though some suggest improvements for on-premises functionality, it consistently receives high ratings for scalability.

Stability

Users report that Cortex XSIAM demonstrates strong stability, with most giving it a perfect rating. There was a single brief downtime instance, resolved in ten minutes. Its cloud-based nature contributes to its minimal maintenance and consistent reliability. Some encounter stability issues after content updates or new version releases, but these are usually addressed quickly. Overall, the experiences with Cortex XSIAM's stability are largely positive and robust.

These insights are based on the in-depth reviews provided by peers to help you make a better buying decision.

Download our Security Information and Event Management (SIEM) Buyer's Guide for additional reliable information.

Review data by company size

By reviewers

By visitors reading reviews

Top industries

By visitors reading reviews

Computer Software Company

14%

Manufacturing Company

11%

Financial Services Firm

Government

Comms Service Provider

Retailer

Healthcare Company

Insurance Company

Energy/Utilities Company

University

Media Company

Construction Company

Educational Organization

Outsourcing Company

Recreational Facilities/Services Company

Real Estate/Law Firm

Engineering Company

Hospitality Company

Transportation Company

Wholesaler/Distributor

Legal Firm

Pharma/Biotech Company

Performing Arts

Logistics Company

Non Profit

Recruiting/Hr Firm

Security Firm

Compare Cortex XSIAM with alternative products

Learn more about Cortex XSIAM

Organizations find Cortex XSIAM beneficial for SOC foundations due to its capability to integrate SIEM and EDR tools, facilitating data collection, detection, and response. It connects with third-party data sources while reducing management effort and offering cost-effective alternatives to competitors like CrowdStrike and Trend Micro. Featuring automation and integration with Palo Alto Networks products, Cortex XSIAM enhances threat detection. Unified architecture allows a comprehensive view of attacks, further supported by machine learning and integration with existing vendor solutions, ensuring that users gain insights without significant manual log analysis.

What are Cortex XSIAM's key features?

Security Orchestration: Streamlines processes across security operations.
Automation and Response: Efficient incident response management.
Detection Enrichment: Enhances identification of threats.
Centralized Endpoint Security: Comprehensive protection and monitoring of endpoints.
Forensic Investigation: Automated investigation to expedite threat analysis.

What benefits are evident in Cortex XSIAM reviews?

Cost-Effectiveness: Provides economical options compared to other market players.
Comprehensive Integration: Seamlessly integrates with multiple data sources and vendors.
Reduced Management Effort: Simplifies the administration of security operations.
Enhanced Threat Detection: Strengthens identification and remediation processes.

Industries implement Cortex XSIAM mainly in technology-driven sectors where centralized endpoint protection and automation of forensic investigation are paramount. By integrating several third-party systems for incident response, companies in competitive markets leverage its attributes for heightened operational security efficiency. However, users note areas for improvement, such as Attack Surface Management and integration enhancements, to better suit tech-heavy industries needing extensive connectivity with cybersecurity solutions.