Exabeam vs Palo Alto Networks Cortex XSOAR comparison

Sponsored
 

Comparison Buyer's Guide

Executive Summary
 

Categories and Ranking

Microsoft Sentinel
Sponsored
Ranking in Security Orchestration Automation and Response (SOAR)
1st
Average Rating
8.2
Number of Reviews
87
Ranking in other categories
Security Information and Event Management (SIEM) (2nd), Microsoft Security Suite (5th)
Exabeam
Ranking in Security Orchestration Automation and Response (SOAR)
13th
Average Rating
8.0
Number of Reviews
10
Ranking in other categories
Security Information and Event Management (SIEM) (28th), User Entity Behavior Analytics (UEBA) (5th), Security Incident Response (7th), Threat Intelligence Platforms (21st), AI-Powered Cybersecurity Platforms (4th)
Palo Alto Networks Cortex X...
Ranking in Security Orchestration Automation and Response (SOAR)
2nd
Average Rating
8.4
Number of Reviews
42
Ranking in other categories
SOC as a Service (2nd)
 

Mindshare comparison

As of July 2024, in the Security Orchestration Automation and Response (SOAR) category, the mindshare of Microsoft Sentinel is 22.4%, up from 20.0% compared to the previous year. The mindshare of Exabeam is 1.6%, down from 2.4% compared to the previous year. The mindshare of Palo Alto Networks Cortex XSOAR is 13.3%, down from 16.0% compared to the previous year. It is calculated based on PeerSpot user engagement data.
Security Orchestration Automation and Response (SOAR)
Unique Categories:
Security Information and Event Management (SIEM)
11.9%
Microsoft Security Suite
5.5%
User Entity Behavior Analytics (UEBA)
4.5%
SOC as a Service
45.5%
 

Featured Reviews

Harman Saggu - PeerSpot reviewer
Oct 31, 2023
Provides valuable alerts and saves investigation time, but can use more connectors
It is crucial that Sentinel empowers us to safeguard our hybrid, cloud, and multi-cloud environments. We employ a hybrid cloud setup, and securing our environment using Sentinel is significantly simpler than manual methods. We can gather events in the Central Point and develop playbooks and scripts to automate responses. This streamlines the process and enhances our overall security posture. Additionally, if an alert is triggered, we receive an incident notification via email, prompting us to take action and resolve the issue. Sentinel provides a library of customizable content to address our company's needs. Microsoft Sentinel has helped our organization with alerts. We'll receive alerts from Sentinel indicating that we're at risk. It's important to address these alerts promptly. We first need to review the information in the email, and then work on the issue in the office. After that, we'll contact the team members on the relevant shift. There's nothing particularly difficult about this process. It's based on our access privileges, which are determined by our role in the company. If we have a high-level role, we'll have access to all the necessary tools and resources. We'll even be able to receive alerts at home if there's a security issue. The company that provides this technology grants work-from-home access based on security considerations. If someone has a critical role, they'll also be equipped with the tools they need to work remotely and connect with their team members. So, the company that provided the technology can resolve the issue first, and then we can address it. Once we've taken care of the issue, everything will be much easier. By leveraging Sentinel's AI in conjunction with our playbooks for automation, we can enhance the effectiveness of our security team, subject to the specific rules and policies we implement. The logs provided by Sentinel have helped improve our visibility into our user's network behavior. Sentinel has helped us save 60 percent of our time by prioritizing the severity of the alerts we receive. When we receive an alert with a high-risk level, we immediately address it to mitigate the potential security threat. Additionally, we have configured our anti-ransomware software, to further protect our systems from cyberattacks. In the event of a ransomware attack, our Halcyon system will generate an encryption key that can be used to unlock our system. This key is securely stored by Halcyon. Sentinel has helped reduce our investigation times by enabling us to review an alert, generate a ticket, and resolve the issue simultaneously upon receiving the alert.
AYOUB ECH-CHKAF - PeerSpot reviewer
Jul 10, 2023
An easy-to-use solution, but its data lake features could be simple to understand
We use the solution to investigate incidents and create rules for use cases The solution provides an easy-to-use platform to create rules for use cases. The solution's data lake features could be easier to understand for end users. They should also provide detailed information about detecting…
AYOUB ECH-CHKAF - PeerSpot reviewer
Jul 10, 2023
An easy-to-setup solution with good technical support services
We use the solution for incident orchestration The solution helps us with incident analysis. The solution has the best processing and incident analysis features. The solution's price could be better. Also, they should provide integration with machine learning and artificial intelligence…

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Pros

"Sentinel is a SIEM and SOAR tool, so its automation is the best feature; we can reduce human interaction, freeing up our human resources."
"Native integration with Microsoft security products or other Microsoft software is also crucial. For example, we can integrate Sentinel with Office 365 with one click. Other integrations aren't as easy. Sometimes, we have to do it manually."
"The UI-based analytics are excellent."
"The most valuable feature is the alert notifications, which are categorized by severity levels: informational, low, medium, and high."
"Sentinel uses Azure Logic Apps for automation, which is really powerful. This allows us to easily automate responses to incidents."
"The Log analytics are useful."
"The most valuable feature is the UEBA. It's very easy for a security operations analyst. It has a one-touch analysis where you can search for a particular entity, and you can get a complete overview of that entity or user."
"It is quite efficient. It helps our clients in identifying their security issues and respond quickly. Our clients want to automate incident response and all those things."
"The most valuable feature of Exabeam Fusion SIEM is the easy-to-use user interface."
"The user interface and the timelines they use are the most valuable features. The price model is very simple so that one can understand it easily and there are no surprises within it."
"Timeline based analysis; good platform support"
"The solution's initial setup process is easy."
"The advanced analytics has a really great overview of user behavior."
"It's a very user-friendly product and it's a very comprehensive technology."
"The setup is not difficult. It was easy."
"The way it can connect with AWS is very useful, and the integrations are pretty good."
"It was useful as a ticketing tool."
"It has an extensive list of integrations that are available out of the box which makes it easy to start."
"I chose Cortex XSOAR because the client also has Palo Alto firewalls. I can incorporate the data from the Palo Alto firewalls into Cortex and send it into the same data lake to manipulate that data. It lets me manage and monitor the data in one place."
"The most valuable feature is automation."
"From the security team's standpoint, the solution has improved our organization's overall cybersecurity."
"The drag-and-drop interface enables analysts with no programming knowledge to create playbooks easily."
"Its agility and scalability are valuable."
"The most valuable features are the orchestration because of the way in which it coordinates the loss from all the devices and it provides us with a high-level overview of the critical log information."
 

Cons

"They should just add more and more out-of-the-box connectors. It is quite a new product, and it has a lot of connectors, and even more would be good."
"They could use some kind of workbook. There is some limitation doing the editing and creating the workbook."
"Its implementation could be simpler. It is not really simple or straightforward. It is in the middle. Sometimes, connectors are a little bit complex."
"The interface could be more user-friendly. It''s a small improvement that they could make if they wanted to."
"If we want to use more features, we have to pay more. There are multiple solutions on the cloud itself, but the pricing model package isn't consistent, which is confusing to clients."
"The solution should allow for a streamlined CI/CD procedure."
"I believe one of the challenges I encountered was the absence of live training sessions, even with the option to pay for them."
"Sentinel still has some anomalies. For example, sometimes when we write a query for log analysis with KQL, it doesn't give us the data in a proper way... Also, the fields or columns could be improved. Sometimes, it is not giving the desired results and there is a blank field."
"Adding to the number of certifications that they have, for example, ISO 27001, would be helpful."
"The only problem is that the UI is not very impressive."
"The initial setup of Exabeam Fusion SIEM is complex because it needs to integrate with the SIEM solution, but after this is complete it is straightforward."
"We still have questions surrounding hardware deployment."
"The organzation is rigid and not flexible in the way they operate"
"They should provide detailed information about detecting phishing emails."
"They need to focus on more of the MITRE ATT&CK Framework and coverage. They claim they cover about 70 to 80%. I'm not sure if it's really quite that much, however."
"We had a large volume right from the beginning and they weren't quite prepared for that. That's something that they should think about when it comes to customers that have a large volume to start off with."
"XSOAR could have more integration options."
"The solution's technical support could be better."
"Palo Alto Networks Cortex XSOAR could improve the Panorama feature. We had to turn it off because it was not working properly."
"The configuration of the solution could improve it is difficult."
"The solution is very expensive."
"The dashboard could be better."
"It is not a very scalable solution."
"The user interface could be a bit better."
 

Pricing and Cost Advice

"Sentinel is a pay-as-you-go solution. To use it, you need a Log Analytics workspace. This is where the logs are stored and the cost of Log Analytics is based on gigabytes... On top of that, there is the cost of Sentinel, which is about €2 per gigabyte. If a customer has an M365 E5 license, the logs that come from Microsoft Defender are free."
"No license is required to make use of Sentinel, but you need to buy products to get the data. In general, the price of those products is comparable to similar products."
"Sentinel is a bit expensive. If you can figure a way of configuring it to meet your needs, then you can find a way around the cost."
"Microsoft is costlier. Some organizations may not be able to afford the cost of Sentinel orchestration and the Log Analytics workspace. The transaction hosting cost is also a little bit on the high side, compared to AWS and GCP."
"The cost of Sentinel is high. It typically costs more than $100 for five to ten users of the licenses or subscriptions. It costs around $123 per day on the cloud. Small- to mid-sized organizations would need a dedicated budget to adopt this solution; however, the cost may not be an issue for large, enterprise-level organizations."
"Sentinel is expensive relative to other products of the class, so it often isn't affordable for small-scale businesses. However, considering the solution has more extensive capabilities than others, the price is not so high. Pricing is based on GBs of ingested daily data, either by a pay-as-you-go or subscription model."
"Sentinel's pricing is on the higher side, but you can get a discount if you can predict your usage. You have to pay ingestion and storage fees. There are also fees for Logic Apps and particular features. It seems heavily focused on microtransactions, but they may be slightly optional. By contrast, Splunk requires no additional fee for their equivalent of Logic. You have a little more flexibility, but Sentinel's costs add up."
"Currently, given our use case, the cost of Sentinel is justified, but it is expensive."
"There is an annual license required to use Exabeam Fusion SIEM. The price of the solution should be reduced."
"They have a great model for pricing that can be based either on user count or gigabits per day."
"The solution is expensive."
"Exabeam Fusion SIEM's pricing is reasonable."
"The price of Palo Alto Networks Cortex XSOAR is expensive."
"When I first looked at Demisto, it had a price tag of $250,000 but when we finally purchased it, it was $345,000."
"It is approx $10,000 or $20,000 per year for two user licenses."
"There is a yearly license required for this solution and it is expensive."
"Palo Alto offers significant discounts to customers who purchase the products repeatedly."
"The pricing is fair. The pricing reflects the value and feature set it offers."
"There is a perception that it is priced very high compared to other solutions."
"From the cost perspective, I have heard that its price is a bit high as compared to other similar products."
report
Use our free recommendation engine to learn which Security Orchestration Automation and Response (SOAR) solutions are best for your needs.
790,361 professionals have used our research since 2012.
 

Top Industries

By visitors reading reviews
Computer Software Company
16%
Financial Services Firm
10%
Government
9%
Manufacturing Company
8%
Computer Software Company
14%
Financial Services Firm
12%
Manufacturing Company
8%
Government
8%
Financial Services Firm
14%
Computer Software Company
13%
Government
9%
Manufacturing Company
8%
 

Company Size

By reviewers
Large Enterprise
Midsize Enterprise
Small Business
 

Questions from the Community

Is there a common threat intelligence tool that aggregates multiple threat intelligence sources?
Yes, Azure Sentinel is a SIEM on the Cloud. Multiple data sources can be uploaded and analyzed with Azure Sentinel an...
What is a better choice, Splunk or Azure Sentinel?
It would really depend on (1) which logs you need to ingest and (2) what are your use cases Splunk is easy for ingest...
Which is better - Azure Sentinel or AWS Security Hub?
We like that Azure Sentinel does not require as much maintenance as legacy SIEMs that are on-premises. Azure Sentinel...
What are the biggest differences between Securonix UEBA, Exabeam, and IBM QRadar?
It mostly depends on your use-cases and environment. Exabeam and Securonix have a stronger UEBA feature set, friendli...
What do you like most about Exabeam Fusion SIEM?
The solution's initial setup process is easy.
What is your experience regarding pricing and costs for Palo Alto Networks Cortex XSOAR?
Whether the product is cheap or expensive depends on the company and how much they are willing to spend on security. ...
What needs improvement with Palo Alto Networks Cortex XSOAR?
The solution is complicated to learn. Customers find it difficult to learn how the solution works. We need profession...
 

Also Known As

Azure Sentinel
No data available
Demisto Enterprise, Cortex XSOAR, Demisto
 

Overview

 

Sample Customers

Microsoft Sentinel is trusted by companies of all sizes including ABM, ASOS, Uniper, First West Credit Union, Avanade, and more.
Hulu, ADP, Safeway, BBCN Bank
Cellcom Israel, Blue Cross and Blue Shield of Kansas City, esri, Cylance, Flatiron Health, Veeva, ADT Cybersecurity
Find out what your peers are saying about Exabeam vs. Palo Alto Networks Cortex XSOAR and other solutions. Updated: May 2024.
790,361 professionals have used our research since 2012.