Cortex XSIAM Reviews

I am trying to check the solution for a new organization I have moved to. Previously, I used the older version of the solution.

The flexibility for creating manual workflows stands out. Although it is time-consuming, it offers significant flexibility. 

Additionally, from a ticketing point of view, the platform works very well.

The standard integrations are very limited, and the integrations available are not listed in the marketplace. Obtaining validation for integrations from Palo Alto takes around eight months, which is quite long. The solution would benefit from having more standard playbooks and templates available, as in other partners. 

Currently, everything must be created from scratch. In terms of incident response automation, it is quite poor due to the lack of integration with all security tools, making manual intervention necessary.

I have been familiar with the solution for almost six years.

I would rate the stability of Cortex XCM as around seven to 7.5 out of ten.

The solution is only rated five out of ten for scalability. Scalability heavily relies on the integration aspect. Without proper integration, scaling up with more servers is meaningless.

The technical support from Palo Alto is very slow. It is ineffective in terms of responding to basic queries and addressing future requirements. I rate their support at four out of ten.

Neutral

I have moved to other products, however, I cannot disclose which ones due to a nondisclosure agreement with my company.

The initial setup was phase-by-phase, with configuration being the most challenging part, especially moving the playbooks manually as they cannot be imported.

There were around ten engineers involved in the installation and deployment.

There has been no return on investment.

The product is very expensive. Additional integration and support are not provided by Cortex and must be purchased from partners. This adds to the cost and delays projects due to resource dependency.

Overall, I rate the solution a five out of ten. 

I would recommend it to organizations requiring a standardized tool for regulation purposes. It is suitable for highly regulated organizations and not for standard operations seeking automation.