Cortex XSIAM Reviews

Name: Cortex XSIAM
Brand: Palo Alto Networks
Rating: 4.2 (12 reviews)

4.2 out of 5

12 reviews
100% willing to recommend

What is Cortex XSIAM?

Cortex XSIAM acts as a critical element for SOC foundations, integrating SIEM and EDR capabilities, valued for threat detection and seamless security orchestration with Palo Alto Networks products.

Get the Security Information and Event Management (SIEM) Buyer's Guide and find out what your peers are saying about Cortex XSIAM, CrowdStrike Falcon, Microsoft Sentinel and more!

Cortex XSIAM is the #6 ranked solution in top Identity Threat Detection and Response (ITDR) solutions, #7 ranked solution in top AI-Powered Cybersecurity Platforms solutions, and #17 ranked solution in top Security Information and Event Management (SIEM) solutions. PeerSpot users give Cortex XSIAM an average rating of 8.4 out of 10. Cortex XSIAM is most commonly compared to CrowdStrike Falcon: Cortex XSIAM vs CrowdStrike Falcon. Cortex XSIAM is popular among the large enterprise segment, accounting for 64% of users researching this solution on PeerSpot. The top industry researching this solution are professionals from a computer software company, accounting for 13% of all views.

Buyer's Guide

Security Information and Event Management (SIEM)

April 2025

Get the category report

Helped 848,253 peers since 2012

Featured Cortex XSIAM reviews

Forrest Stevens

Senior Manager - Security Operations at First Advantage Corporation

There is room for improvement in some areas, and I would highlight three key aspects. Firstly, the Attack Surface Management (ASM) module could benefit from more contextual depth. Currently, it tends to provide a broad overview without enriched context, and there's room for enhancement in this regard. Secondly, further integration capabilities with various other software products that can seamlessly tie into Cortex XSIAM would be advantageous. This would enhance its versatility and interoperability within a broader ecosystem. Regarding performance, there's potential for optimization. When multiple tabs are open in Cortex XSIAM, it can experience slowdowns, leading to longer load times for web pages. It's worth noting that this isn't a severe issue, and it doesn't entail waiting for extended periods, but there is room for improvement in terms of performance optimization.

Read full review

Jitendra_Singh

Senior Vice President at Chi Networks

Cortex XSIAM ( /products/cortex-xsiam-reviews ) enhances our ability to apply endpoint protection policies, implement restrictions, conduct scans, and engage in sandboxing. Its signature-less subscriptions and robust detection power stand out in improving threat detection. The integration with APIs allows us to automate processes effectively, and we appreciate the kind of support we receive.

Read full review

VishalPathak2

Subject Matter Expert at Softcell Technologies Limited

The customer would be okay with receiving either CrowdStrike, SentinelOne or even Cortex, as long as the price is right because they all do the same job more or less. So, it's mainly the pricing point that makes a difference in India. Since Palo Alto is trying to get as many new customers as possible, they're offering very competitive pricing. If a customer is already using the Palo Alto firewall and Prisma Access, and maybe even Prisma Cloud, then they're already familiar with Palo Alto's solutions and find it easier to manage internally. That's how they'll switch to Cortex for a unified suite.

Read full review

Cortex XSIAM mindshare

Product category:

As of April 2025, the mindshare of Cortex XSIAM in the Security Information and Event Management (SIEM) category stands at 2.8%, up from 0.6% compared to the previous year, according to calculations based on PeerSpot user engagement data.

Security Information and Event Management (SIEM)

Key learnings from peers

Last updated Apr 6, 2025

Valuable Features

Cortex XSIAM excels in SOAR capabilities, offering robust security intelligence and detection enrichment. Its unified architecture and machine learning enhance threat identification without extensive log analysis. Valued features include third-party integration, artificial intelligence, user-friendly interfaces, automation through APIs, and comprehensive endpoint policies. It supports versatile manual workflows and abnormal behavior detection. Competitive pricing and ease of integration with existing systems make it appealing, particularly for those familiar with Palo Alto's ecosystem.

"Since implementing Cortex XSIAM, incident response times have been significantly reduced by approximately twenty percent."
"I would give Cortex XSIAM a rating of ten out of ten."
"Cortex XSIAM enhances our ability to apply endpoint protection policies, implement restrictions, conduct scans, and engage in sandboxing."

Room for Improvement

Cortex XSIAM's integration capabilities could improve, as its integrations are limited and challenging to validate. Users note the need for enhanced contextual depth in the Attack Surface Management module and performance optimization when multiple tabs are open. Additionally, there are mentions of improving pricing, technical support speed, and developer-friendliness. The dashboard and GUI could be more user-friendly. Data onboarding, parsers, and AI analytics also require refinement. Licensing could offer more flexible options.

"Cortex XSIAM needs improvements in terms of data onboarding, parsers, and third-party integration supports."
"Cortex XSIAM is pretty expensive, and the licensing process is not very comfortable compared to CrowdStrike."
"I would rate the overall stability a six or seven, as we have only used it for a few months and need a year of experience to provide a full assessment."

ROI

Several users found Cortex XSIAM beneficial by saving over $500,000, automating at least fifty percent of detection and response processes, and reducing reliance on additional SOC analysts. Though some are still measuring financial outcomes over the long term, others are understaffed but manage incidents better now. Some share financial benefits with their accounts team, while feedback regarding revenue is limited. There have been mixed mentions regarding financial returns.

Pricing

Enterprise users find Cortex XSIAM's pricing to be competitive but expensive compared to alternatives. Licensing costs are on par with Splunk, while additional costs arise for specific add-ons and partner-provided integrations. Some view it as a value-for-money solution, though perceived as high, with mixed impressions of the licensing process. Pricing rates vary, with opinions rating it from six to nine out of ten, suggesting a significant investment but potentially worthwhile for features offered.

"The product cost could be considered value for money compared to other solutions in the market, though it is quite high."
"Since Palo Alto is trying to get as many new customers as possible, they're offering very competitive pricing."
"The solution is expensive compared to its competitors."

Popular Use Cases

Cortex XSIAM is utilized as a Security Information and Event Management (SIEM) platform integrating Endpoint Detection and Response, automating tasks, and streamlining operations into a unified system. It facilitates malware detection, SOC monitoring, and automates store operations. Organizations implement it to integrate third-party data, protect endpoints, and enhance threat detection through comprehensive data collection and response. Users prioritize it for its seamless integration and ability to manage detailed data logs.

Service and Support

Customer service and support of Cortex XSIAM are mixed. Some users find support challenging due to slow response times and agents learning on the job, while others describe it as helpful, smooth, and efficient. Support types include premium and enterprise, with premium being most praised. Feedback ranges from high praise, rating it ten out of ten, to criticism for slow and ineffective responses, rated four out of ten.

Deployment

Cortex XSIAM's initial setup is mostly intuitive and uncomplicated as a SaaS offering. It requires minimal steps, taking about a week for a thousand users. Compared to Splunk, it's more straightforward. Users appreciate its ease compared to QRadar, although some find configuration challenging, especially with manual playbook transfers. Documentation and deployment options are noted as areas needing improvement, and fine-tuning can extend setup time beyond the typical one to two weeks.

Scalability

Cortex XSIAM demonstrates significant scalability, especially in cloud environments. Many organizations find it easy to scale and integrate, supporting thousands of users and assets. Enterprises leverage its adaptability for diverse tasks. While some users point out integration as a critical factor, others highlight its potential for scalability success. Its cloud-based nature appeals to enterprise-level clients, though some seek enhanced on-premises capabilities. The solution garners high praise for its flexibility and scalability.

Stability

Cortex XSIAM demonstrates high stability, with users rating it up to ten out of ten. While downtime incidents are rare and quickly resolved, some experience minor issues following updates or version releases. Users praise its cloud-based reliability and ease of installation, and some rate stability as seven or 7.5 out of ten, noting the need for more extended use to provide a comprehensive assessment. Stability ratings include six or seven from those with shorter usage experience.

These insights are based on the in-depth reviews provided by peers to help you make a better buying decision.

Download our Security Information and Event Management (SIEM) Buyer's Guide for additional reliable information.

Review data by company size

By reviewers

By visitors reading reviews

Top industries

By visitors reading reviews

Computer Software Company

13%

Manufacturing Company

10%

Financial Services Firm

10%

Government

Comms Service Provider

Retailer

Insurance Company

Healthcare Company

University

Media Company

Energy/Utilities Company

Construction Company

Educational Organization

Outsourcing Company

Real Estate/Law Firm

Transportation Company

Recreational Facilities/Services Company

Legal Firm

Wholesaler/Distributor

Engineering Company

Hospitality Company

Non Profit

Performing Arts

Pharma/Biotech Company

Logistics Company

Consumer Goods Company

Security Firm

Marketing Services Firm

Compare Cortex XSIAM with alternative products

Learn more about Cortex XSIAM

Organizations find Cortex XSIAM beneficial for SOC foundations due to its capability to integrate SIEM and EDR tools, facilitating data collection, detection, and response. It connects with third-party data sources while reducing management effort and offering cost-effective alternatives to competitors like CrowdStrike and Trend Micro. Featuring automation and integration with Palo Alto Networks products, Cortex XSIAM enhances threat detection. Unified architecture allows a comprehensive view of attacks, further supported by machine learning and integration with existing vendor solutions, ensuring that users gain insights without significant manual log analysis.

What are Cortex XSIAM's key features?

Security Orchestration: Streamlines processes across security operations.
Automation and Response: Efficient incident response management.
Detection Enrichment: Enhances identification of threats.
Centralized Endpoint Security: Comprehensive protection and monitoring of endpoints.
Forensic Investigation: Automated investigation to expedite threat analysis.

What benefits are evident in Cortex XSIAM reviews?

Cost-Effectiveness: Provides economical options compared to other market players.
Comprehensive Integration: Seamlessly integrates with multiple data sources and vendors.
Reduced Management Effort: Simplifies the administration of security operations.
Enhanced Threat Detection: Strengthens identification and remediation processes.

Industries implement Cortex XSIAM mainly in technology-driven sectors where centralized endpoint protection and automation of forensic investigation are paramount. By integrating several third-party systems for incident response, companies in competitive markets leverage its attributes for heightened operational security efficiency. However, users note areas for improvement, such as Attack Surface Management and integration enhancements, to better suit tech-heavy industries needing extensive connectivity with cybersecurity solutions.