Palo Alto Cortex XSOAR
Palo Alto Cortex XSOAR is a SOAR product with a visual playbook editor and a 900+ pack count, and Palo Alto names Cortex AgentiX as its successor. It places fourth of 14 at 5.91, with 20 of 25 containment actions documented. The product page gives no approval, rollback or price, and no time-to-contain figure with a method.
What Palo Alto Cortex XSOAR is
XSOAR runs playbooks through a visual editor and draws on a marketplace of prebuilt integration and automation packs (paloaltonetworks.com/cortex/cortex-xsoar, read 2026-11-03). Palo Alto completed its acquisition of Demisto in March 2019, and the product became Cortex XSOAR in February 2020.
The product line is in motion. A Palo Alto press release of 2025-10-28 calls Cortex AgentiX the successor to XSOAR, available in Cortex Cloud and XSIAM at launch. The XSOAR product page read on 2026-11-04 does not mention AgentiX and does not say whether XSOAR is sold standalone.
vendor claim Cortex XSOAR is a SOAR product for incident response and automation. It runs playbooks through a visual editor and draws on a marketplace of prebuilt integration and automation packs. The product page lists it beside Cortex XSIAM under Palo Alto Networks' AI-driven security operations platform. paloaltonetworks.com, read
Products named: Cortex XSOAR.
Ownership. Palo Alto Networks completed its acquisition of Demisto in March 2019 (completion announced 2019-03-28). Demisto's platform became Cortex XSOAR, launched at RSA Conference in February 2020. vendor claim paloaltonetworks.com, read
no figureon the pages read
Published time to contain
No figure on time to contain, or on any adjacent response metric, was found for Palo Alto Cortex XSOAR on the pages read. Page says it reduces investigation time from hours to minutes; no containment figure.
20 of 255 of 5 domains
Containment coverage
Of 25 containment actions across EDR, identity, email, cloud and network, Palo Alto Cortex XSOAR documents 20 as native or partner on the pages read: 20 native, 0 partner, 0 custom step only, 5 not documented. Coverage share is 80 percent.
- native, vendor-documented
- partner or third-party documented
- custom step only
- not documented on the pages read
| Platform | EDR | Identity | Cloud | Network | |||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Isolate host | Release isolation | Kill process | Quarantine file | Run script or live response | Block hash | Disable user | Force password reset | Revoke sessions or tokens | Require MFA re-enrolment | Remove from group or role | Delete a delivered message | Quarantine a delivered message | Block sender or domain | Remove a URL rewrite exemption | Pull from quarantine | Disable IAM user or access key | Revoke cloud session | Isolate or stop an instance | Change a security group or firewall rule | Revoke OAuth app consent | Block IP or domain at the firewall | Block at the proxy or DNS filter | Disable a switch port or NAC quarantine | Add to a threat list on the NDR | |
| Palo Alto Cortex XSOAR20 of 25 documented | Palo Alto Cortex XSOAR: Quarantine a delivered message, not documented | Palo Alto Cortex XSOAR: Remove a URL rewrite exemption, not documented | Palo Alto Cortex XSOAR: Revoke cloud session, not documented | Palo Alto Cortex XSOAR: Disable a switch port or NAC quarantine, not documented | Palo Alto Cortex XSOAR: Add to a threat list on the NDR, not documented | ||||||||||||||||||||
Basis: Command lists in the integration README files of the Cortex content packs (the source of the marketplace and docs pages). Pack support level from pack_metadata.json: 'xsoar' read as native, 'partner' read as partner (SentinelOne). Read 2026-11-03.
Limits: Cisco ISE and email URL exemption not confirmed.
Note: Cortex AgentiX is named the next generation of Cortex XSOAR (D3 summary, not verified on a Palo Alto page in this pass).
Scorecard reflects XSOAR content packs only.
The full grid, with the page behind each cell, is on the scorecard. A cell reads not documented when the pages read did not show the action. That is a finding about public material, not a claim that the action is absent.
5.91rank 4 of 14
Rubric scores
Palo Alto Cortex XSOAR is in a band with Cyware (6.11), Google Security Operations (6.09), Swimlane (Turbine) (5.84), Splunk SOAR (Cisco) (5.79), Torq (5.74), Tines (5.62). A band is a run of neighbouring totals. Bands chain: a new band starts only where the gap to the total above exceeds 0.25, so a band can be wider than 0.25 and the order inside it is not an order.
| Criterion | Weight | Score | Points | Status, reason and source |
|---|---|---|---|---|
| Native containment coverage | 25 | 8.0 | 2.000 | documented. 20 of 25 containment actions documented as native or partner (80 percent) across 5 of 5 domains. Score is 2.0 plus 7.5 times the share, capped at 9.5. |
| Published time-to-contain evidence with method | 15 | 5.0 | 0.750 | partial. Page claims "Reduce time spent on incidents by 90%" as reported time savings from aggregated customer use cases, with no baseline, sample or method, and it is not a containment time. vendor claim paloaltonetworks.com, read |
| Approval, rollback and blast-radius controls documented | 15 | 5.0 | 0.750 | partial. The product page states no approval, rollback or scope controls; a secondary read says the AgentiX layer adds approval for high-impact actions, which needs a docs check. secondary source paloaltonetworks.com, read |
| Explanation and audit trail | 15 | 6.0 | 0.900 | partial. Page says "Auto-documentation for knowledge sharing and audit reporting" and describes a war room for post-incident analysis, without record fields or retention. vendor claim paloaltonetworks.com, read |
| Integration depth documented | 10 | 8.0 | 0.800 | documented. Page states "900+ prebuilt integration and automation packs", a public count, though the page lists no per-action detail. vendor claim paloaltonetworks.com, read |
| Detection-to-response coupling | 8 | 4.0 | 0.320 | not documented. The page says incident data and indicators are "fully integrated" but does not say whether detections arrive directly or through a SIEM. paloaltonetworks.com, read |
| Pricing transparency | 6 | 3.0 | 0.180 | not documented. No price or unit on the page, only a link to an ROI calculator. paloaltonetworks.com, read |
| Deployment and data handling | 6 | 3.5 | 0.210 | not documented. Deployment options and data handling are not stated on the page; it mentions a multitenant platform for MSSPs and links an XSOAR privacy datasheet that was not read. paloaltonetworks.com, read |
| Total | 100 | 5.91 | Sum of the eight weighted points above, to two decimals. | |
Scores are proposals under the rubric bands, computed in code from the published weights. Where a score rests on a vendor's marketing page only, a read of its documentation can move it.
Where Palo Alto Cortex XSOAR is strong
- Vendor claim: the product page states 900+ prebuilt integration and automation packs, a public count. The Marketplace page states 850+ product integrations, so the two counts differ and neither is dated. paloaltonetworks.com, read
- The product page names 24 customers and links a SANS review and a KuppingerCole SOAR ranking. Both are vendor claims here, because neither report was read and the ranking edition is not stated. paloaltonetworks.com, read
- Developer docs, as shown in search results read on 2026-11-04, say integrations and scripts are stored as YAML metadata with embedded code, in Python or JavaScript. The page bodies were not opened. xsoar.pan.dev, read
Where Palo Alto Cortex XSOAR is behind
- Time-to-contain evidence: a figure without a method. The page claims time spent on incidents reduced by 90 percent, from aggregated customer use cases, with no baseline or sample, and not a containment time. The AgentiX release claims up to a 98 percent MTTR reduction with no sample or period. paloaltonetworks.com, read
- The product page states no approval, rollback or scope controls, and says incident data and indicators are fully integrated without saying whether detections arrive directly or through a SIEM. paloaltonetworks.com, read
- No price is published, and the pricing path under the product returned 404 on 2026-11-03. Whether XSOAR is sold alone or inside XSIAM is not stated on the page. paloaltonetworks.com, read
What only Palo Alto Cortex XSOAR has
Palo Alto lists XSOAR 8.x on-premises end of life as 2029-09-30, and version 8.11 reaches end of life on 2026-11-13. paloaltonetworks.com, read
nonelisted
Pricing as published
vendor claim No price is published on the product page read. The pricing URL under the product path returned 404 on 2026-11-03. paloaltonetworks.com, read
23names on its pages
Named customers
Customers below are names on Palo Alto Cortex XSOAR's own pages, so each is a vendor claim. A logo is not a reference, and none of these entries says what the customer uses the product for.
- State of North Dakota Information Technology (NDIT), BNL, Logicalis, Infosys, Esri, Naranja, Flex, PLDT, Turkcell, Resolution Life, Inspira, AZ Vesalius, Saudi Information Technology Company (SITE), Better, Korea Credit Data (KCD), Axitea, Schlumberger, Pague Menos, Playtika, Forvia Faurecia, GrowPro Consulting, Pokemon Company International, Sitecore. paloaltonetworks.com, read
1dated entries
Recent releases
| Date | Release | Source |
|---|---|---|
| 2025-10-28 | Palo Alto Networks unveils Cortex AgentiX. Launched as the next generation of Cortex XSOAR;available in Cortex Cloud and XSIAM at launch, XDR and standalone planned for early 2026. | vendor claim paloaltonetworks.com, read |
1graded
Claims Palo Alto Cortex XSOAR makes about itself
Each is a vendor claim, graded A to D on the method published: A independent with method, B vendor-measured with sample and method, C a number with no method, D unverifiable. This site's own voice does not repeat any of them as fact.
| Claim | Method stated | Grade | Source |
|---|---|---|---|
| AgentiX delivers up to a 98 percent reduction in MTTR with 75 percent less manual work | not stated. Measured by vendor. | C | vendor claim paloaltonetworks.com, read |
Who should shortlist Palo Alto Cortex XSOAR
- You already run XSOAR and need the end-of-life dates in hand before you decide on a move to its successor.
- You want the widest published integration count among the SOAR products, and will check actions yourself.
- You buy for an MSSP and need a multitenant platform.
Palo Alto Cortex XSOAR places 4th of 14 at a total of 5.91, with 20 of 25 containment actions documented. A deep action catalogue, 20 of 25 documented, in a band with Cyware, Google Security Operations, Swimlane, Splunk SOAR, Torq and Tines. Ask what Palo Alto states about the successor, Cortex AgentiX, before committing to a platform it describes as being replaced. Approval, rollback and price are not published.
The same platform under other weights
- Regulated financial: 5th of 14, total 5.84.
- Lean team: 5th of 14, total 5.72.
- MSSP: 4th of 14, total 5.94.
- Microsoft estate: 7th of 14, total 5.64.
- CrowdStrike estate: 7th of 14, total 5.78.
Compare Palo Alto Cortex XSOAR
- Palo Alto Cortex XSOAR alternatives: 3 gaps and 5 platforms that answer them.
- Palo Alto Cortex XSOAR against Swimlane (Turbine), totals 5.91 and 5.84.
- Palo Alto Cortex XSOAR against Splunk SOAR (Cisco), totals 5.91 and 5.79.
- Palo Alto Cortex XSOAR against Torq, totals 5.91 and 5.74.
- Palo Alto Cortex XSOAR against Google Security Operations, totals 5.91 and 6.09.
Facts on this page were read 2026-11-03 and the days before it; the date beside each source is the date it was read. Last updated 4 November 2026.