Palo Alto Cortex XSOAR vs Tines
Palo Alto Cortex XSOAR is a playbook-driven SOAR product with a marketplace of integration packs. Tines is a no-code workflow platform with a Cases add-on and an AI SOC page. They split on published time-to-contain evidence, where the rubric reads Palo Alto Cortex XSOAR as partial and Tines as not documented on the pages read on 2026-11-03.
0.29points apart
The difference that decides it
On published time-to-contain evidence, Palo Alto Cortex XSOAR claims a 90 percent cut in time spent on incidents, from aggregated customer use cases with no baseline, sample or method. Tines publishes no MTTR or containment figure. paloaltonetworks.com, read
8criteria
Rubric side by side
| Criterion | Weight | Palo Alto Cortex XSOAR | Tines | Gap, first minus second |
|---|---|---|---|---|
| Native containment coverage (20 and 22 of 25 actions) | 25 | 8.0 | 8.6 | -0.6 |
| Published time-to-contain evidence with method | 15 | 5.0 | 3.0 | +2.0 |
| Approval, rollback and blast-radius controls documented | 15 | 5.0 | 3.5 | +1.5 |
| Explanation and audit trail | 15 | 6.0 | 5.0 | +1.0 |
| Integration depth documented | 10 | 8.0 | 6.5 | +1.5 |
| Detection-to-response coupling | 8 | 4.0 | 6.5 | -2.5 |
| Pricing transparency | 6 | 3.0 | 5.5 | -2.5 |
| Deployment and data handling | 6 | 3.5 | 4.0 | -0.5 |
| Total | 100 | 5.91 | 5.62 | 0.29 |
Full reasons and sources for every score are on the profiles of Palo Alto Cortex XSOAR and Tines.
5.0 : 3.5approval score each
Approval and rollback controls
Palo Alto Cortex XSOAR. The product page states no approval, rollback or scope controls; a secondary read says the AgentiX layer adds approval for high-impact actions, which needs a docs check. paloaltonetworks.com, read
Tines. The product page says Agents enable "autonomous workflow activity and user interaction" but states no approval step, rollback or scope limit. tines.com, read
20 : 22actions of 25
Containment coverage by domain
| Domain | Palo Alto Cortex XSOAR | Tines |
|---|---|---|
| EDR | 6 of 6 | 6 of 6 |
| Identity | 5 of 5 | 5 of 5 |
| 3 of 5 | 4 of 5 | |
| Cloud | 4 of 5 | 4 of 5 |
| Network | 2 of 4 | 3 of 4 |
| All five | 20 of 25 | 22 of 25 |
Published time to contain: Palo Alto Cortex XSOAR, no published figure; Tines, no published figure.
5buyer types
Verdict by buyer type
- regulated financial
- Neither separates itself on published approval and audit detail. Palo Alto Cortex XSOAR states no approval controls and offers only auto-documentation for audit; Tines states neither an approval step nor an audit log on the pages read. Ask both for the control documentation in writing.
- lean team
- Tines is easier to size up before a call: it publishes a free edition with 3 live workflows. Palo Alto Cortex XSOAR publishes no price and offers an ROI calculator.
- MSSP
- Only Palo Alto Cortex XSOAR states anything for MSSPs: it mentions a multitenant platform for MSSPs. Tines states no MSSP terms on the pages read.
- Microsoft estate
- Only Tines says anything specific: it lists Microsoft and Microsoft Teams in its story library. Palo Alto Cortex XSOAR states no Microsoft-specific detail on the pages read.
- CrowdStrike estate
- Only Tines says anything specific: it lists CrowdStrike in its story library. Palo Alto Cortex XSOAR states no CrowdStrike-specific detail on the pages read.
When to pick each
Pick Palo Alto Cortex XSOAR when connector count and breadth matter most, because it states 900+ prebuilt integration and automation packs, a public count with no per-action detail.
Pick Tines when detection and response should arrive in one product, because it accepts automated webhook notifications and does not mention a SIEM.
Read dates are on each source link. See also Palo Alto Cortex XSOAR alternatives and Tines alternatives, or the buyer-type rankings.