Cortex XSIAM Reviews

I am trying to check the solution for a new organization I have moved to. Previously, I used the older version of the solution.

The flexibility for creating manual workflows stands out. Although it is time-consuming, it offers significant flexibility. 

Additionally, from a ticketing point of view, the platform works very well.

At our organization, we have implemented Cortex XSIAM as our primary Security Information and Event Management (SIEM) solution. We've also harnessed its capabilities for our store operations. Our approach has been to strategically design it as the foundation for our in-house Security Operations Center (SOC), with a strong emphasis on incorporating store automation seamlessly into our security infrastructure.

Our primary focus with it has been to build and strengthen our security program. We have essentially developed a comprehensive security program around it. By using it as our SIEM solution, we've achieved the benefit of having a centralized, single interface for our security operations. Thanks to the capabilities of Security Orchestration, Automation, and Response (SOAR), our relatively smaller team has been able to efficiently manage our security operations. Another notable advantage is our ability to capture a lot of information that would have otherwise gone unnoticed. To illustrate this, consider that we've successfully integrated and correlated various log data from multiple sources. Viewing all this data from a unified perspective has allowed us to identify issues that might not have been detected individually but are indicative of more significant problems or threats.

We are a partner, and we train people. However, we have not installed the product for a customer yet.

We started to work with Cortex due to the relationship between IBM and Palo Alto. One of the valued aspects of the product is its use of artificial intelligence to detect security vulnerabilities. The ease of use, simplicity in product setup, and the ability to optimize rules are crucial aspects.

It is just a replacement in front of CrowdStrike or Trend Micro. I'll pitch Cortex because it can do the same thing. So if there's competition with CrowdStrike or with Trend Micro, and the customer can't afford CrowdStrike pricing, then I'll suggest Cortex.

It is an effective solution in terms of performance and functionalities.

We use Cortex XSIAM as a NextGen antivirus to detect malware in endpoints and devices. We have integration with data sources and other third-party data sources, enabling us to ingest logs from a third-party website to the Cortex XSIAM console. This allows the management of detailed data. It aims to keep track of work ingested through Cortex.

Cortex XSIAM is user-friendly, allowing users to easily understand activities within Cortex. Customers can resolve issues by themselves with easy-to-follow documentation, which helps reduce reliance on technical support.

The primary use case for Cortex XSOAR is that it requires less management and integration effort. It automates many tasks and integrates seamlessly with other Palo Alto Networks products.

It does a better job of identifying anomalies that are more likely to be incidents of compromise without as many false positives or false negatives.