Cortex — Security Orchestration
Cortex XSOAR
Security Orchestration & Response
The connective tissue of the PANW security operations portfolio. 1,000+ integrations, visual playbook automation, War Room collaboration, and centralized threat intelligence management.
Product brief
One-line value
The connective tissue of the PANW security operations portfolio. 1,000+ integrations, visual playbook automation, War Room collaboration, and centralized threat intelligence management.
- Who buys: not a separate section on this page
- Pains solved: not a separate section on this page
- Discovery questions
- Key capabilities
- Competitors
- Related plays: not a separate section on this page
- Details
Discovery questions
Pre-Sales
Scoping Checklist
Data points to collect before quoting Cortex XSOAR — and before deciding XSOAR vs AgentiX.
Sales Conversations
Discovery Questions
Questions to uncover SOAR gaps and qualify the XSOAR or XSIAM automation opportunity.
Key capabilities
Overview
What is Cortex XSOAR?
Cortex XSOAR (formerly Demisto, acquired 2019) is PANW's Security Orchestration, Automation, and Response (SOAR) platform—the "connective tissue" of the PANW security operations portfolio. With 1,000+ out-of-the-box integrations spanning SIEM, EDR, firewalls, ticketing, TI feeds, cloud, and identity, XSOAR is the de facto automation layer for multi-vendor SOC environments.
In 2026, XSOAR ranks as the #1 SOAR platform in multiple analyst and practitioner rankings for large enterprise SOCs. Available as cloud SaaS (XSOAR 8 Cloud) or on-premises; the cloud version is the strategic future direction and PANW is migrating on-prem customers to SaaS at no charge for single-tenant deployments.
Current releases: XSOAR 8.13 on-premises, released May 22, 2026. The SaaS train runs ahead of on-prem and is at 8.15. Quote and scope against the train the customer will actually run.
Platform Capabilities
Core Capabilities
Playbook automation, real-time collaboration, and centralized threat intelligence — all in one platform.
Competitors
Win Strategy
Key Differentiators vs. Competition
| Differentiator | vs. Splunk SOAR | vs. Microsoft Sentinel | vs. IBM QRadar SOAR | vs. Swimlane/Tines |
|---|---|---|---|---|
| Integration depth | 300+ integrations, 2,800 actions — narrower than XSOAR's 1,000+ | Azure Logic Apps-based; Microsoft-ecosystem oriented | Strong in IBM stack; narrower third-party coverage | Pure automation; limited security-specific content |
| War Room | Basic collaboration; no dedicated War Room workspace | No comparable collaboration environment | Basic collaboration features | No War Room equivalent |
| PANW native integration | Requires connector; no PANW native advantage | Microsoft-native only | IBM-native only | Connector-only model |
| TIM capability | Relies on Splunk ES for TI; not natively integrated in SOAR | Requires Microsoft TI connectors; separate workbench | QRadar TI is a separate product | No native TIM capability |
| MSSP multi-tenancy | Available in Splunk SOAR Enterprise | Limited; workspace-per-tenant model | Available in QRadar | Limited MSSP support |
Details
Optiv Opportunity
MSSP Multi-Tenant Deployment
XSOAR supports multi-tenant deployments for MSSPs — each tenant maintains data isolation with Optiv managing the shared platform infrastructure. This enables Optiv to deliver a branded managed SOAR service to dozens of clients simultaneously from one XSOAR instance.
Managed SOAR Service
Optiv manages the XSOAR platform and playbook library on behalf of customers — ongoing playbook maintenance, integration updates, SOC metrics reporting. Recurring revenue stream.
SOAR Implementation & PS
XSOAR deployment, integration buildout, and custom playbook development for customer-specific response procedures. Typically 6–16 week engagement; high-value PS opportunity.
IR Playbook Standardization
Formalize and automate customer IR runbooks — phishing response, ransomware, insider threat, cloud compromise — aligned to NIST CSF or MITRE D3FEND. Compliance-driven demand.
Platform Evolution
Migration: XSOAR to XSIAM
Customers on standalone XSOAR should be evaluated for the XSIAM upgrade — SOAR is natively included in XSIAM, eliminating a separate license.
Platform Synergy
PANW Ecosystem Integration
| Cortex XDR | XSOAR triggers XDR response actions (endpoint isolation, process kill, file quarantine) via native integration. XDR alerts flow into XSOAR as incidents for automated triage and response playbooks. |
| Cortex XSIAM | XSIAM includes XSOAR automation natively. Customers on XSIAM use XSOAR automation without a separate license. XSIAM 3.1 introduced Automation Rules that extend beyond traditional playbook triggers. |
| Cortex Xpanse | Xpanse ASM alerts trigger XSOAR playbooks for investigation, owner notification, service remediation, and validation re-scanning. Full Cortex ASM pack available in Marketplace. |
| PANW NGFW / Panorama | XSOAR can push firewall policy changes — block IPs, quarantine zones, update External Dynamic Lists — as automated response actions. Native integration with no additional connector cost. |
| ServiceNow / Jira / Slack | XSOAR integrates with ticketing and communication platforms for automated ticket creation, SOC notifications, and escalation workflows from security incidents. |
Licensing
Pricing & Licensing
- Pricing model Active user-based licensing. Users who log into the tenant drive the license count. No user limits on development tenant.
- Enterprise reference ~$250,000+/year for enterprise-scale deployments. Varies significantly based on user count, features, and deployment scope.
- Deployment options XSOAR 8 Cloud (SaaS, currently 8.15, strategic direction) or on-premises (currently 8.13, released May 22, 2026). Free migration from on-prem to SaaS for single-tenant customers.
- Free trial 30-day full enterprise trial available. Rolling 30-day incident history, multiple active feeds.
- MSSP pricing Separate commercial track for multi-tenant; pricing to be announced for XSOAR 8 Cloud multi-tenant.