Cortex XDR by Palo Alto Networks Reviews

We primarily use the solution for security.

We're trying to explore Cortex's possibly to detect digital forensics and the source of the issues. 

The initial setup isn't too bad.

I have run into some detection issues with Cortex XDR. 

If they had pulse rate detection, it would be better.

The whole state IPS should be better. 

It needs to be better at detection of internal attacks. 

We started using the solution since about 2019 or 2020. It's been around two or three years.

The stability is pretty good except for one or two cases. Based on the performance, it's been okay. It's got pretty high performance. There are no bugs or glitches. It doesn't crash or freeze. 

We have around 4,500 users on the solution currently. It usually handles around 1,400 people. We have these devices across many departments. 

The solution has the capability to scale. A company can expand it as necessary.

I've contacted technical support one or two times and found that their support is very fast to respond. They are helpful in each case. We are very satisfied with their level of service.

We used to use Symantec. We have since stopped.

Symantec can easily be put on a USB device, and then they can check it all to scan within the computer. However, we tried to submit a case for a feature enhancement, and, after two or three years, they still do not have this feature enabled and available. 

The initial setup isn't overly difficult on the cloud. We do not wish to have endpoint clients plow into our internal environment. The deployment shouldn't take up too much manpower. 

The pricing is pretty good. It's reasonable. I'd rate it four out of five. Of course, it could always be a bit lower. 

I'm a customer and end-user. 

I'd rate the solution seven out of ten. 

The primary use case is endpoint security. The product is my main endpoint, IP, and threat management.

In organizations where they don't implement a NAC, this product helps stop threats at the endpoint level. Everything goes through the endpoint. By the time you get something to a server, you are compromised at your perimeter, and you might be compromised at your ID or main control. With a third-party, you need a NAC, so you can put on something like McAfee or you need authorization so the organization can scan your computer, then you can connect to the network.

We can't do that for a daily operation. We can't just have personnel waiting for someone to connect, and say, "We need to scan your computer before you go into our network." We don't have time for that." So, you need to implement a NAC. However, if you don't implement a NAC from day one of your business, it is very complicated to do it after many years because the NAC is not like a security software. You have to go server by server and do an assessment. Meanwhile, you need to protect your organization. So, you can use tools like Traps to manage your security, even stopping the threat at the last contact. 

For organizations which do not have a NAC implemented, there has to be some type of endpoint security, and it needs to be tough, like Traps. With Traps, you can search events, manage them quickly, and locate any half exceptions. Trap's traffic is encrypted. 

We like the features where you can quickly locate exceptions and can configure process exceptions. You are building your own defense. Therefore, you are not only relying on Palo Alto, but you are applying day-to-day operations of configured language that a tool can understand.

If the user leaves our premises or network, Palo Alto Traps will still be on that endpoint and will still apply our policies. For example, if you take that endpoint out of our network, go to a Starbucks with a company laptop, then connect to our our virtualized gateway. That local endpoint will still have our network policies.

I'm so used to IPS IDS endpoint security that I don't see anything else that catches my attention other than it's working fine. It's a very good tool. It's the best one that we have.

It has Android support.

There are some limitations on the Traps agents. Traps for Windows has limitations and Traps for Linux too. Traps doesn't work with McAfee. You need to remove McAfee to install Traps. This is very common, and its nothing that should be an issue. Some antivirus engines recognize Traps as an threat component, so maybe they need to shake hands somewhere.

With Windows 7 and Windows 8 64-bit, when you want to install Traps, because its Windows, it will crash. They need a little more flexibility with antivirus engines.

It is very stable.

You can grow as much as you want.

We have four users: a cybersecurity analyst, two infrastructure security personnel, and a security administrator.

The technical support is very good.

We were previously using Malwarebytes and McAfee. We are still using them along with Traps.

The initial setup was straightforward, after we had to remove McAfee first.

The deployment took a couple of weeks. We centralized all our perimeter firewalls first, then we started deploying the agent.

We needed two personnel for deployment and maintenance: an infrastructure security person and a security administrator.

Our third-party installer was very efficient.

Traps pays for itself within the first 16 months of a three-year subscription. This is attributed to OPEX savings, as security teams spent less time trying to identify and isolate malware for analysis as a result of a reduction in malware incidents, false positives, and breach avoidance. Security teams will spend less time and effort managing and mitigating breaches. They will be able to avoid having to activate their organization’s incident response team.

It is "expensive" and flexible.

We evaluated the following other large endpoint security companies: Kaspersky Endpoint Security, CrowdStrike Falcon Endpoint Protection, Symantec Endpoint Protection, and McAfee Endpoint Security.

If you have Malwarebytes and you want to control a malware that you have on your computer, Malwarebytes will quarantine that malware. However, it depends how infected you got.

Test normal behavior of the Traps agents (injection and policy) and confirm that there has been no change in the user experience.

I use the solution in my company for incident detection and response. We use it to address specific security challenges at work, like detecting and responding to incidents.

The most valuable feature of the solution stems from the fact that the tool provides real-time visibility of our network activity and allows us to detect threats early and respond quickly. It is an easy-to-use tool. The tool's interface is good and simple to use.

I would like to see improvement in the tool's user interface, particularly in the area of managing alerts and providing more reporting capabilities. The user interface should include a built-in compliance framework, and I think it will make the tool even more valuable for organizations with statistical regulatory requirements.

I have been using Cortex XDR by Palo Alto Networks for two years. I don't remember the version of the solution. I am a customer of the tool.

Around three people in my company use the tool.

I have contacted the solution's technical support once. I know of the support team, but I don't think we have ever contacted them multiple times.

Although I have some experience in some intrusion detection software, I have not used them practically, such as Cortex XDR.

The product's initial setup phase is not difficult to do. Anyone can follow the tool's manual to install it.

The tool's price is moderate.

I can recommend the tool to others, especially to organizations that need a robust integration solution for threats, detection, and response.

The tool is easy to learn as the interface is simple to understand, especially if you have some experience with server security and a little bit of knowledge of it. It is a very easy-going platform.

I rate the tool a nine out of ten.

We use the solution to deduct from the endpoints any files in the network or any suspicious thing happening in the host machine or servers. We have the Palo Alto Networks Firewall team, and we check the connection from the Palo Alto Networks Firewalls using Cortex XDR by collecting all the information.

The best thing about Cortex XDR is that it has host servers, networks, and proxy servers. On the other hand, CrowdStrike has only hosts and servers. The solution helps find bugs, and it is safe to use to prevent attacks by hackers.

The solution should add unwanted malicious hash values to a block list so that whenever the action is triggered, it will automatically prevent the malicious content. We can even block the IP address in malicious content. If any host is affected, we can isolate the host, rectify that problem, and prevent it from happening in the future.

I have been using Cortex XDR by Palo Alto Networks for one year.

More than 15,000 people are using the solution in our organization.

We contacted the technical support team for a downgrade issue with Cortex XDR. Due to some network errors, we worked with the support team. They rectified the problem, but it affected us for over two hours. We had to check all the hosts and servers connected to Cortex XDR. We rechecked and reinstalled Cortex XDR. I was happy with the support team’s fast response time.

We are also using CrowdStrike. Compared to CrowdStrike, Cortex XDR gives more detailed information for us to work with. We can connect to the host's live terminal, work with that host in an emergency, and prevent that host.

The solution's ease of deployment depends on the user's experience. It would be easy for someone with experience.

Compared to CrowdStrike, Cortex XDR is an expensive solution.

A beginner will take some time to learn to use the solution. I would recommend the solution to other users.

Overall, I rate the solution an eight out of ten.

I use the solution for endpoint security to capture endpoint security devices' logs and security events.

The solution's most valuable feature is its general integration with various Palo Alto Networks products. The tool is a unified platform that includes a firewall, Prisma Cloud, and Cortex's storage. It is also a single data platform that consolidates data from endpoints and network traffic into a single data lake. For behavior analytics, the tool uses advanced behavior analytics and machine learning to detect sophisticated threats.

I think sometimes Cortex XDR agent automatically stops event capturing from the device, and then even the dashboard does not get any notifications from the agent. A particular endpoint message with the events captured gets stopped, making it an area where there is a need to improve the agent's real-time monitoring.

I have been using Cortex XDR by Palo Alto Networks for around five years.

The tool is designed to scale for large enterprises and handle large volumes of data. The tool has a scalable architecture, and accessing or processing data is leveraged by the tool, making it a robust infrastructure process that allows for efficient data analysis and timely detection and response.

In my company, around 15,000 employees use the tool.

Many times, I raised requests for follow-up with the support team, but only sometimes there is a response. Palo Alto's team needs to work on its issues so that they can provide twenty-four hours and seven days of support to users.

From a deployment and integration perspective, I can say it is an easy and user-friendly tool, so I don't face any challenges with the tool.

The solution is deployed on the cloud and in the on-premises model. Mostly, the tool was in the cloud for my previous client.

One needs to look into the support and services, especially Palo Alto's support and professional services, which is an area that is not yet available. When it comes to the implementation and optimized XDR solutions, sometimes third-party integrations do not happen with XDR. When it comes to third-party integrations, a playbook in Palo Alto should be there for all the third-party tools, showing how we can implement them.

The tool is very easy and user-friendly.

I rate the tool an eight and a half out of ten.

Our primary use case is anti-malware and anti-exploit.

Traditional anti-virus is signature-based, whereas Traps is behavior-based. Therefore, it doesn't necessarily whitelist things, it looks for anything with bad behavior. Thus, we've had a significant increase in blocking with a decrease in false positives, because it's looking at how the files work, not just a list of files that it's been told to look for.

The anti-exploit is impenetrable. We chose Traps because it is the only product that we were not able to get anything past.

Going from version 4 to version 5, they had a major change in their user interface. Version 5 is now all cloud managed, while it has a very intuitive, useful interface, it doesn't have all the features that were in the version 4 interface. For example, we lost being able to automatically trigger upgrades, like creating manual groups to upgrade with. It doesn't currently have the ability to use the Active Directory to create groups. 

It's fairly stable. They do have bugs which come up every once in a while, but they're usually good about getting them taken care of within a release.

It is definitely scalable.

Primarily, it is just being used by myself. The help desk also uses it. There are probably a total of around ten users.

We've deployed it to about 1500 endpoints so far. There is a possibility that we may expand our usage, but not in the foreseeable future. We are at pretty much at 100 percent deployment at this point.

I would describe Palo Alto's technical support as audio waterboarding. They have the worst support, as a company, that I have ever worked with, as they are difficult to get a hold of and keep on the phone. They don't know what they are talking about when you get them on the phone. They don't like to respond to messages when you send them to them. They like to "research problems" for weeks on end, then pass you off to somebody else.

We were previously using Sophos for antivirus, and are still using Sophos for antivirus, but we're using Traps to augment it.

The initial setup was pretty straightforward on version 4, but on version 5, it is almost idiot-proof.

The initial deployment of getting the servers and everything up took about a week, but getting everything deployed was somewhere closer to six weeks.

We implemented it in-house. We incrementally did some systems to make sure that it wouldn't block anything that it shouldn't. After that, we used Active Directory to push it to everything else.

Very little staff is required for deployment and maintenance, as Traps is self-maintaining.

I feel that we have seen ROI. There have been a number of blocked, bad files that could have gotten through, but were stopped by Traps.

The pricing seems fair, and I do like the licensing model. You use wherever they are, and it is elastic. So, if you have 1100 computers today, you can license that. Therefore, as long as you're below your licensing cap, you're fine.

We looked at Palo Alto vs Sophos, which has a anti-malware system called Intercept X, but it did quite literally nothing. We thought about Symantec, but we didn't end up testing them against Traps.

The implementation is fairly straightforward and easy. With version 5, everything is now on the cloud. It is easy to work with and use. I would use mobile device management (MDM) or Active Directory (AD) to push the file everywhere when installing it, as it will auto go from there. The management is pretty low. Thus, it will be set it, and for the most part, you can forget it.

Our primary use case for Cortex XDR is endpoint detection and response (EDR) across our enterprise environment, which includes over 1000 endpoints distributed globally. We use it to monitor and protect against advanced threats, perform real-time threat hunting, and streamline incident response processes.

The platform has significantly improved our organization by enhancing our ability to detect and respond to threats. It has reduced our incident response times and provided greater visibility into endpoint activities, bolstering our overall cybersecurity posture.

The product's most valuable features are behavioral analytics and AI-driven threat detection capabilities.

They could improve the product's reporting and customization options. Additionally, there should be better integration with niche cloud platforms.

In the next release, I would like to see enhancements in automated response capabilities and integrations with emerging technologies, such as container security solutions and serverless architectures.

I have been using Cortex XDR for approximately three years now.

The product is stable. 

The product is highly scalable. 

The technical support services are good. 

Positive

Before Cortex XDR, we used a combination of traditional endpoint protection solutions and standalone EDR products. We switched to Cortex XDR for its comprehensive feature set and seamless integration capabilities.

The initial setup was straightforward, thanks to comprehensive documentation and support from Palo Alto Networks. Integration with our existing infrastructure was seamless.

We implemented the product with the assistance of a vendor team from Palo Alto Networks.

The product pricing is reasonable. The licensing model was flexible based on the number of endpoints.

We evaluated alternatives such as CrowdStrike Falcon and Microsoft Defender for Endpoint. However, Cortex XDR stood out due to its superior detection capabilities and flexibility in deployment.

I recommend conducting a thorough evaluation for organizations considering Cortex XDR based on your specific security requirements and environment. Engage closely with Palo Alto Networks or a certified partner to leverage their expertise in deployment and configuration.

I rate it a ten out of ten. 

Cortex XDR is an artificial intelligence-based solution that automatically detects malicious activity performed by users or user machines, blocking it with the help of AI. We also create security policies on Cortex XDR that can be managed by Cortex XDR. Let's say that a company wants a security policy to work for a home user or VPN client user. It also includes an enterprise network at home.

User control in Cortex XDR allows users to restrict access to certain websites from a company laptop used over a home network. The solution allows control over the user and his machine through Cortex XDR security policies.

Cortex XDR is not that smart compared to Check Point. We also deal with Check Point. Check Point solutions, Check Point Firewall, Check Point solution WAF technology, or anti-virus technology can be considered smart because of Palo Alto. The detection of malicious activities performed by Check Point is good. Artificial intelligence is not a good match for Check Point because sometimes Palo Alto Networks Cortex XDR does not detect malicious activity like in other anti-virus solutions like Trend Micro and Windows with Cisco.

I also want a better detection feature like the one in Check Point and any other anti-virus, for a matter of fact.

I am a consultant for the solution. I work with Palo Alto, our solution provider, and offer Cortex solutions and Palo Alto firewalls. We also sell Cortex XDR at Mac Global. It has been approximately six months to a year since I started working with this solution. Speaking about the version, it is the Cortex XDR client. Our responsibilities are centered around the client-based solution, including managing clients and installing software and rules. Palo Alto’s team manages the other aspects of the solution.

It is a stable solution since it is on the cloud. CPU utilization and hardware requirements are not necessary. According to some user licenses, when we purchase them, we get much utilization of hardware requirements through the cloud.

Cortex XDR is a scalable solution with around 500 to 600 users. User visibility, user policy, and security policy can be implemented in one view on Cortex XDR. The approximate number of clients constantly using Cortex XDR is between 200 to 250.

I am working with iDream Networks, and we are partners of Palo Alto Networks.

I will give 50 out of 100 points since the setup of Cortex XDR is neither too easy nor too difficult to implement. Its dashboard is very easy to manage since no other sites need to be opened to manage it. Also, it can be managed from anywhere. I am not involved in the deployment process as I only manage the solution.

The configuration and implementation are done by Palo Alto’s team.

Licensing for Palo Alto Networks Cortex XDR can be costly, especially when it comes to a hundred users. A license is required for each user, and the subscription must be renewed on a yearly basis.

I recommend Palo Alto Networks Cortex XDR as a dependable option for future requirements. Cyberattacks are on the rise, and so that's why I have Palo Alto’s XDR. I also suggest Palo Alto Networks Cortex XDR to all customers. On a scale of 100, I rate this solution at 85, and on a scale of one to ten, I give it an eight.