Cortex XSIAM Reviews

Name: Cortex XSIAM
Brand: Palo Alto Networks
Rating: 4.3 (11 reviews)

4.3 out of 5

11 reviews
100% willing to recommend

What is Cortex XSIAM?

Cortex XSIAM acts as a critical element for SOC foundations, integrating SIEM and EDR capabilities, valued for threat detection and seamless security orchestration with Palo Alto Networks products.

Get the Security Information and Event Management (SIEM) Buyer's Guide and find out what your peers are saying about Cortex XSIAM, CrowdStrike Falcon, Microsoft Sentinel and more!

Cortex XSIAM is the #7 ranked solution in top Identity Threat Detection and Response (ITDR) solutions, #8 ranked solution in top AI-Powered Cybersecurity Platforms solutions, and #18 ranked solution in top Security Information and Event Management (SIEM) solutions. PeerSpot users give Cortex XSIAM an average rating of 8.6 out of 10. Cortex XSIAM is most commonly compared to CrowdStrike Falcon: Cortex XSIAM vs CrowdStrike Falcon. Cortex XSIAM is popular among the large enterprise segment, accounting for 63% of users researching this solution on PeerSpot. The top industry researching this solution are professionals from a computer software company, accounting for 14% of all views.

Buyer's Guide

Security Information and Event Management (SIEM)

March 2025

Get the category report

Helped 842,466 peers since 2012

Featured Cortex XSIAM reviews

Forrest Stevens

Senior Manager - Security Operations at First Advantage Corporation

There is room for improvement in some areas, and I would highlight three key aspects. Firstly, the Attack Surface Management (ASM) module could benefit from more contextual depth. Currently, it tends to provide a broad overview without enriched context, and there's room for enhancement in this regard. Secondly, further integration capabilities with various other software products that can seamlessly tie into Cortex XSIAM would be advantageous. This would enhance its versatility and interoperability within a broader ecosystem. Regarding performance, there's potential for optimization. When multiple tabs are open in Cortex XSIAM, it can experience slowdowns, leading to longer load times for web pages. It's worth noting that this isn't a severe issue, and it doesn't entail waiting for extended periods, but there is room for improvement in terms of performance optimization.

Read full review

Jitendra_Singh

Senior Vice President at Chi Networks

Cortex XSIAM ( /products/cortex-xsiam-reviews ) enhances our ability to apply endpoint protection policies, implement restrictions, conduct scans, and engage in sandboxing. Its signature-less subscriptions and robust detection power stand out in improving threat detection. The integration with APIs allows us to automate processes effectively, and we appreciate the kind of support we receive.

Read full review

VishalPathak2

Subject Matter Expert at Softcell Technologies Limited

The customer would be okay with receiving either CrowdStrike, SentinelOne or even Cortex, as long as the price is right because they all do the same job more or less. So, it's mainly the pricing point that makes a difference in India. Since Palo Alto is trying to get as many new customers as possible, they're offering very competitive pricing. If a customer is already using the Palo Alto firewall and Prisma Access, and maybe even Prisma Cloud, then they're already familiar with Palo Alto's solutions and find it easier to manage internally. That's how they'll switch to Cortex for a unified suite.

Read full review

Cortex XSIAM mindshare

Product category:

As of March 2025, the mindshare of Cortex XSIAM in the Security Information and Event Management (SIEM) category stands at 2.6%, up from 0.5% compared to the previous year, according to calculations based on PeerSpot user engagement data.

Security Information and Event Management (SIEM)

Key learnings from peers

Last updated Mar 23, 2025

Valuable Features

Cortex XSIAM excels with its SOAR capabilities, security intelligence, and detection enrichment. Users highlight its holistic analysis, machine learning for threat identification, and efficiency. Integration with third-party vendors and automation is valued, while centralized security enhances protection. AI-driven vulnerability detection and ease of use are key. Endpoint protection, manual workflow flexibility, and API integration for automation are appreciated. Pricing and existing familiarity with Palo Alto encourage adoption.

"I would give Cortex XSIAM a rating of ten out of ten."
"Cortex XSIAM enhances our ability to apply endpoint protection policies, implement restrictions, conduct scans, and engage in sandboxing."
"The flexibility for creating manual workflows stands out."

Room for Improvement

Cortex XSIAM requires better integration with security tools and software for enhanced versatility. The platform needs improvements in developer-friendliness, performance optimization, and contextual depth in Attack Surface Management. The lengthy validation for integrations, limited standard integrations, and incident response automation also need work. Pricing, technical support, and the dashboard could be more user-friendly. Security vulnerability detection and resolution processes require enhancement. Cortex XSIAM's licensing is less convenient compared to competitors.

"Cortex XSIAM is pretty expensive, and the licensing process is not very comfortable compared to CrowdStrike."
"I would rate the overall stability a six or seven, as we have only used it for a few months and need a year of experience to provide a full assessment."
"The standard integrations are very limited, and the integrations available are not listed in the marketplace. Obtaining validation for integrations from Palo Alto takes around eight months, which is quite long."

ROI

Organizations experienced significant ROI exceeding five hundred thousand dollars due to Cortex XSIAM's automation of detection and response processes, eliminating the need for additional SOC analysts. The reduction in incidents allowed them to better manage security with existing staff. Some teams are still evaluating ROI, having only used Cortex XSIAM for a few months. In certain cases, feedback on revenue benefits goes to the accounts team rather than technical support.

Pricing

Cortex XSIAM offers competitive pricing aligned with enterprise budget expectations, comparable to Splunk and Microsoft Sentinel, though it can be quite high. Costs may increase with add-ons like Managed Threat Hunting. Some find the solution expensive compared to competitors, rating it a six or nine out of ten. The product cost is seen as value for money despite high expenses. Licensing can be uncomfortable, and additional integration support is required from partners.

"The product cost could be considered value for money compared to other solutions in the market, though it is quite high."
"Since Palo Alto is trying to get as many new customers as possible, they're offering very competitive pricing."
"The solution is expensive compared to its competitors."

Popular Use Cases

Organizations primarily use Cortex XSIAM as a Security Information and Event Management tool and for endpoint protection, integrating security automation, and managing third-party data. Functions include network data collection, threat detection, malware protection, and policy enforcement. Organizations benefit by reducing management efforts, unifying data, and enhancing comprehensive security strategies. It serves as an alternative to other security options, offering capabilities for security operations centers, store operations, and seamless integration with other Palo Alto Networks products.

Service and Support

Customer service and support for Cortex XSIAM show mixed experiences. Some users report challenges and ineffective response times, while others find the support team efficient and clear in guidance. There are multiple support levels, with premium support being highly favored. Generally, users appreciate the helpfulness and smooth process, though some mention slow resolution requiring escalation. Ratings varied, with some users rating it high while others give a lower rating.

Deployment

Cortex XSIAM's initial setup is often described as intuitive and straightforward. It operates as a SaaS with simple deployment, primarily requiring the deployment of a broker for integration. Setup can vary from a few days to three months, depending on user needs and configuration challenges. Documentation could improve, particularly for complex integrations. Users frequently mention it as easier compared to QRadar and Splunk, though configuration and manual playbook transfers can present difficulties.

Scalability

Cortex XSIAM is noted for its impressive scalability, particularly when deployed in the cloud. Users appreciate its seamless integration capabilities, which aid in scaling and adaptation for organizations of various sizes. While many rate its scalability highly, some mention that integration is critical for effective expansion. There exists a mix of ratings, reflecting variability in user experiences and deployment contexts without significant issues mentioned.

Stability

Users report Cortex XSIAM as highly stable, experiencing minimal downtime. Many rate its stability a perfect ten, citing dependable performance and quick resolution of occasional issues post-updates. Its cloud-based form contributes to its stable nature. Some users, however, note occasional stability issues, especially after content updates or new releases, rating it between seven and eight. Overall, the software is deemed robust and reliable, though some feel more time is needed for a complete assessment.

These insights are based on the in-depth reviews provided by peers to help you make a better buying decision.

Download our Security Information and Event Management (SIEM) Buyer's Guide for additional reliable information.

Review data by company size

By reviewers

By visitors reading reviews

Top industries

By visitors reading reviews

Computer Software Company

14%

Financial Services Firm

10%

Manufacturing Company

10%

Government

Comms Service Provider

Retailer

Healthcare Company

Insurance Company

Media Company

University

Energy/Utilities Company

Construction Company

Educational Organization

Outsourcing Company

Real Estate/Law Firm

Transportation Company

Recreational Facilities/Services Company

Wholesaler/Distributor

Engineering Company

Legal Firm

Hospitality Company

Non Profit

Performing Arts

Pharma/Biotech Company

Logistics Company

Consumer Goods Company

Security Firm

Leisure / Travel Company

Recruiting/Hr Firm

Compare Cortex XSIAM with alternative products

Learn more about Cortex XSIAM

Organizations find Cortex XSIAM beneficial for SOC foundations due to its capability to integrate SIEM and EDR tools, facilitating data collection, detection, and response. It connects with third-party data sources while reducing management effort and offering cost-effective alternatives to competitors like CrowdStrike and Trend Micro. Featuring automation and integration with Palo Alto Networks products, Cortex XSIAM enhances threat detection. Unified architecture allows a comprehensive view of attacks, further supported by machine learning and integration with existing vendor solutions, ensuring that users gain insights without significant manual log analysis.

What are Cortex XSIAM's key features?

Security Orchestration: Streamlines processes across security operations.
Automation and Response: Efficient incident response management.
Detection Enrichment: Enhances identification of threats.
Centralized Endpoint Security: Comprehensive protection and monitoring of endpoints.
Forensic Investigation: Automated investigation to expedite threat analysis.

What benefits are evident in Cortex XSIAM reviews?

Cost-Effectiveness: Provides economical options compared to other market players.
Comprehensive Integration: Seamlessly integrates with multiple data sources and vendors.
Reduced Management Effort: Simplifies the administration of security operations.
Enhanced Threat Detection: Strengthens identification and remediation processes.

Industries implement Cortex XSIAM mainly in technology-driven sectors where centralized endpoint protection and automation of forensic investigation are paramount. By integrating several third-party systems for incident response, companies in competitive markets leverage its attributes for heightened operational security efficiency. However, users note areas for improvement, such as Attack Surface Management and integration enhancements, to better suit tech-heavy industries needing extensive connectivity with cybersecurity solutions.