Orchestrate. Automate. Innovate.
Join our SOAR ecosystem
Orchestrate. Automate. Innovate.

The industry’s most comprehensive security orchestration, automation and response platform with native threat intelligence management and a built-in marketplace.

  • 90% faster response
  • 500+ product integrations
  • 16,000 DFIR members
2020 State of SOAR Get the free edition
Security operations automation
USE CASES
Virtual Summit

The Premier Summit for Security Operations


Join us in April

Join the launch event

SOAR done right

One platform connecting people, process and technology.
Gartner SOAR Market Guide
Unified SOAR platform

Automate across your security stack

Cortex XSOAR ingests alerts across sources and executes automated workflows/playbooks to speed up incident response.

Speed incident investigations

Cortex XSOAR case management facilitates standardized response for high-quantity attacks while helping your teams adapt to sophisticated one-off attacks.

Break down team silos

Cortex XSOAR playbooks are complemented by real-time collaboration capabilities that let security teams rapidly iterate to solve emergent threats.

Act on threat intelligence with confidence

Cortex XSOAR offers a new approach to threat intelligence management that unifies threat intelligence aggregation, scoring and sharing with proven playbook-driven automation.

Manage incidents on the go

Track and respond to security incidents with a mobile-first experience for iOS and Android®.

Innovate with the best

Cortex XSOAR Marketplace

Discover, consume and share orchestration innovations contributed by experts in the world’s largest SOAR ecosystem.
Learn more

Optimize your operations

Save time, streamline operations and increase SOC productivity.

Watch Now
  • Faster response time
    90%
  • Reduction in alert volume
    95%
  • Product integrations
    500+
Explore Our SOC

Customize and deploy quickly

Respond smarter, faster

ML-powered to learn from each incident

The perfect ally for security analysts, our machine learning-powered platform provides guidance based on past incidents and analyst actions.

Learn more

  • Increase analyst productivity

    Cortex XSOAR recommends the best analysts for the job based on actions and workload. It also correlates and shows related incidents for each case.

  • Accelerate playbook development

    Cortex XSOAR studies the most commonly used arguments and recommends these inputs during playbook creation.

  • Train incident models

    Our phishing email classifier model is trained on thousands of emails to help organizations detect malicious messages with a high degree of accuracy.

Learn more

Flexible deployment

Cortex XSOAR supports on-premises, private cloud or fully hosted deployments .
See the benefits of a hosted solution

Industry-leading Customer Success

Dedicated to helping you get the most of your Cortex XSOAR deployment

Onboarding Assistance

  • Customer journey kickoff
  • Onboarding assistance
  • Service configuration
  • Use case assistance
  • Training, documentation & workshops

Technical Support

  • Support community
  • Support portal
  • Telephone support
  • Response time (S1)
  • Slack DFIR private channel

Optimized Experience

  • Annual health check
  • Customized success plans
  • Periodic operations reviews
  • Executive business reviews
  • Prioritized integration development
Case Study
Esri

Navigating Rough Seas

Problem

Alerts in excess of 10,000 per week caused significant fatigue among the team of five security analysts. Detecting false positives and duplicate incidents was a specific concern that wasn’t being addressed.

Solution

“The automation infused into our security infrastructure by Cortex XSOAR complements our existing SIEM, allowing our SOC team to realize greater efficiencies. Automating these mundane tasks allows our analysts to focus on decision-making.”

– Sean Kohlmeier, Incident Response Lead, Esri

  • Cortex XSOAR
Read full case study
Case Study
Electric Utility Company

Keeping the SOC Lights On

Problem

The SOC team used a mix of tools, ranging from security products and open source platforms to in-house tools. While they had a SIEM to aggregate logs, analysts were frustrated as they still spent a great deal of time investigating duplicate alerts.

Solution

“We are very aggressive in prioritizing alerts. A shortfall of SIEMs is, when you get too granular with alerting, you also get the volume that is too taxing to handle manually. With this platform, we were able to gain value for being aggressive ... because it helps you manage it.”

– Senior SOC Manager

  • Cortex XSOAR
Read full case study
Case Study
The Pokémon Company International

Cortex XSOAR Catches ‘Em All

Problem

The Pokémon Company International needed a solution to help them navigate a fast-moving security environment and improve their ability to observe, evaluate and act upon incidents such as phishing attacks and credential theft.

Solution

“The value we have seen from Cortex XSOAR is we get stronger overall security because the response is instantaneous. We can provide better customer service for whomever reported the incident because they’re actually getting a message back confirming the action that was taken.”

– Sean Hastings, Senior Security Architect, The Pokémon Company International

  • Cortex XSOAR
Read full case study

    Designed for MSSPs

    Cortex XSOAR for MSSPs

    MSSPs can build their managed service operations on Cortex XSOAR to provide best-in-class offerings for their customers and optimize internal team productivity.

    Learn more
    Learn more

    Explore Cortex XSOAR resources

    DATASHEET

    Cortex XSOAR datasheet

    An overview of key Cortex XSOAR features, support programs and deployment options.
    WHITE PAPER

    Top Security Orchestration Use Cases

    Curious about the most-used automation use cases? Check out our white paper.
    WHITE PAPER

    Gartner SOAR Market Guide

    Here’s what Gartner is saying about SOAR in 2020.
    WHITE PAPER

    How SOAR Is Transforming Threat Intelligence

    Find out how you can automate threat intelligence management.

    WHITE PAPER

    The State of SOAR Report, 2020

    Learn the latest trends in SOAR.
    E-BOOK

    Security Orchestration For Dummies

    New to SOAR? This definitive guide will help you navigate your automation journey.

    Features and specifications

    • Delivery Model

      On-premises, private cloud, or fully hosted

    • On-premises specs (minimum)

      8 CPU cores
      16 GB RAM
      500 GB SSD
      Operating system: macOS, Windows, Linux

    • Case Management

      Custom layouts for incidents and indicators
      Indicator and incident correlation
      Flexible, customizable reports and dashboards
      On-the-go incident monitoring
      Automated mapping across integrations

    • Collaboration

      Real-time investigation and collaboration
      Machine learning assistance
      Continuous learning
      Streamlined, automated reporting

    • Threat Intelligence Management

      Automated multi-source feed aggregation
      Granular indicator scoring and management
      Best-in-class operational efficiency
      Powerful native threat intelligence
      Hands-free, automated playbooks with extensible integrations

    • Use cases

      Analytics and SIEM
      Threat intelligence
      Malware analysis
      Endpoint
      Network security
      Authentication
      Email gateway
      Ticketing
      Messaging
      Cloud
      … and hundreds more
    GET A DEMO

    See Cortex in action

    See firsthand how you can automate and streamline your security operations.

    Talk to a Specialist

    Get started with SOC Transformation

    Download your toolkit to get curated articles, case studies, demos and reports to help you transform your SOC.

    Popular Resources

    Legal Notices

    Popular Links

    Report a Vulnerability

    Copyright © 2021 Palo Alto Networks. All rights reserved