Palo Alto Networks XSOAR

Rising cyberattack volume and sophistication have exposed limits in traditional security tooling, leaving many organizations operating 50+ disjointed products. While SIEMs still underpin many Security Operations Centers (SOCs), SOAR platforms have emerged to streamline incident investigation and response through centralized orchestration and automation across disparate tools. SOAR systems integrate upstream telemetry via out-of-the-box API connectors, initiate workflows, open cases and tickets, correlate and enrich events, and automatically gather additional forensic evidence (e.g., EPP scan outputs, non-standard logs, memory dumps). Some solutions also automate threat hunts for indicators of compromise (IOCs), query threat intelligence sources, and apply machine learning to reduce false positives, ideally before or while an analyst is alerted. When cases are assigned, SOAR should present a coherent investigation package with context, descriptions, and recommended actions.

Palo Alto Networks’ Cortex XSOAR (from Demisto, acquired in 2019) is positioned as a SOAR foundation for modern SOCs, deployable on-premises or cloud-to-cloud, and licensed per admin/analyst user. Its Marketplace (launched 2020) offers 550+ integrations and content packs—ranging from threat intel subscriptions to playbooks and scripts—validated for safety and purchased via a points model. XSOAR ingests from major SIEMs and supports broad integrations across ITSM, threat intelligence (including AutoFocus and Unit 42 plus third-party feeds and STIX/TAXII), endpoint/EDR actions (isolation, process kill, rollback), network controls (blocking IPs/domains/URLs), email remediation, IAM actions, and vulnerability management queries. The console emphasizes collaboration, case management, dashboards (including MITRE ATT&CK mapping), modular playbooks, and time tracking for process optimization. Noted gaps include fewer integrations for some EU-based vendors and a desire for more native MFA options, though APIs and multi-tenancy support help address scalability needs, especially for MSSPs.

• Many security-conscious organizations administer over 50 different and disjointed security tools.
• SIEM products still form the foundation of modern SOCs in many organizations.
• Palo Alto Networks was founded in 2005 in Santa Clara, California.
• Demisto launched in 2015 and was acquired by Palo Alto Networks in 2019.
• Cortex XSOAR is available for on-premises and cloud-to-cloud deployment, with a management console that can run on-premises or in the cloud.
• Cortex XSOAR is licensed per admin/analyst user.
• The Cortex XSOAR Marketplace launched in 2020 and contains over 550 connectors/integrations and content packs.
• Cortex XSOAR includes more than 3,000 playbook actions.
• Cortex XSOAR can integrate with ITSM tools including ServiceNow, Jira, Zendesk, and BMC Remedy.
• Cortex XSOAR supports full multi-tenant environments.

• “Many security-conscious organizations can find themselves administering over 50 different and disjointed security tools.”
• “SOAR products are the latest iteration of this evolution.”
• “SOAR platforms aim to become the foundation of contemporary SOCs.”
• “The orchestration aspect of SOAR involves not only the collection of telemetry from these different sources, but also initiating a workflow, opening cases and tickets where appropriate, and correlation and enrichment of event information.”
• “Ideally, SOAR solutions will accomplish many of these listed actions automatically prior to or while alerting a human analyst.”
• “When an analyst is alerted and assigned a case, all pertinent information related to the event should be constructed and presented by the SOAR platform to the analysts for their investigation.”
• “Most SOAR vendors adhere to the paradigm of a playbook.”
• “SOAR systems deliver the highest value to customers when they can easily integrate and interoperate with all the other security and identity tools in customer environments.”
• “The console tracks time on tasks, so that management can see which parts of investigations take the most time to help in streamlining processes.”
• “Cortex XSOAR also supports full multi-tenant environments, making it an ideal solution for MSSPs that need to scale to support hundreds of clients.”