Palo Alto Cortex XSOAR
6.18 of 10 on the nine published rows. 8th of 12 covered, 8th of 14 scored. SOAR. Scores read 3 November 2026.
Palo Alto Cortex XSOAR is a SOAR platform with a visual playbook editor and a vendor-claimed 900+ prebuilt integration and automation packs. Palo Alto documents three deployment models, but the pages read say nothing on approvals or on leaving the product. Cortex AgentiX is named as its successor, and on-prem versions retire on a dated cycle.
What it is
Palo Alto Cortex XSOAR began as Demisto. Palo Alto Networks announced completion of that acquisition on 2019-03-28 and launched the product as Cortex XSOAR in February 2020 (Palo Alto press release, read 2026-11-03). The product page describes a visual playbook editor for code-free automation and lists XSOAR beside XSIAM, without saying whether it is sold on its own or inside XSIAM. The launch release for Cortex AgentiX, dated 2025-10-28, describes AgentiX as the successor to Cortex XSOAR and gives no XSOAR end-of-sale date.
The playbook artefact is a task graph inside a content pack. Playbooks are built from manual, conditional, automated and communication tasks, and the pack layout holds Playbooks, Integrations, Scripts and TestPlaybooks folders. Integrations and scripts carry a YAML metadata file plus Python or JavaScript code, and a pack carries a pack_metadata.json with a MAJOR.MINOR.REVISION version (pan.dev documentation, read 2026-11-03). The playbooks overview page does not state the on-disk playbook file format. A pan.dev job builds a zip bundle of custom content for import on another XSOAR server, and no importer from another vendor is documented.
The vendor describes itself this way: Cortex XSOAR is a SOAR product for incident response and automation. It runs playbooks through a visual editor and draws on a marketplace of prebuilt integration and automation packs. The product page lists it beside Cortex XSIAM under Palo Alto Networks' AI-driven security operations platform. paloaltonetworks.com, read 2026-11-03 (vendor claim)
How Palo Alto Cortex XSOAR scores
Nine rows, weights summing to 100, each scored 0 to 10 from pages read on 2026-11-03. The part is score times weight divided by 100. How the scoring works.
| Row | Score | Weight | Part | Reason and source |
|---|---|---|---|---|
| Playbook authoring model | 7.0 | 14 | 0.98 | Vendor page lists a visual playbook editor for code-free automation and 'thousands of security actions for DIY playbooks'. Scripting and content-pack authoring were not read in the docs. paloaltonetworks.com, read 2026-11-03 (vendor claim) |
| Integration count and depth documented | 8.0 | 14 | 1.12 | Vendor page states 900+ prebuilt integration and automation packs. The count is a vendor claim; community and custom pack paths were not read. paloaltonetworks.com, read 2026-11-03 (vendor claim) |
| Case management and collaboration | 7.0 | 8 | 0.56 | Vendor page lists a virtual war room for incident investigation and collaboration. Case fields, SLAs and role controls were not read. paloaltonetworks.com, read 2026-11-03 (vendor claim) |
| Approvals and human-in-the-loop controls | 4.0 | 12 | 0.48 | Not found in the pages read on 2026-11-03. Manual tasks and approval steps exist in the product but no page read here documents them. Re-read pending. paloaltonetworks.com, read 2026-11-03 |
| Agentic or AI features that are documented | 6.0 | 12 | 0.72 | Cortex AgentiX is described by Palo Alto as the next generation of XSOAR (October 2025 launch; agents for threat intel, email, endpoint and network investigation per launch coverage). The XSOAR product page itself only lists a webinar. What the agents cannot do is not stated.investors.paloaltonetworks.com, read 2026-11-03 (vendor claim) (search summary only); paloaltonetworks.com, read 2026-11-03 (vendor claim) (search summary only) |
| Hosting and data residency options | 8.0 | 8 | 0.64 | Palo Alto lifecycle docs show three deployments: XSOAR 8 SaaS, XSOAR 8 on-prem (versions with dated end-of-life) and XSOAR 6 recommended for on-prem and air-gapped. Data residency regions were not read. cortex-docs.paloaltonetworks.com, read 2026-11-03; cortex-docs.paloaltonetworks.com, read 2026-11-03 |
| Pricing model and transparency | 3.0 | 8 | 0.24 | No price or pricing unit on the product page, which offers an ROI calculator instead. paloaltonetworks.com, read 2026-11-03 |
| Migration tooling and import or export formats | 6.0 | 14 | 0.84 | The pan.dev pages, read in full on 2026-11-03, name the YAML file format of integrations and scripts and the content-pack layout that bundles playbooks, but the playbook on-disk format is not stated and no leaving-XSOAR guide or importer from another vendor was found, so it is counted as a named format under the rule at 6.0 while the zip export bundle, seen in a search summary only, is not counted; a competitor also claims XSOAR scripts are not portable, a claim about a rival. xsoar.pan.dev, read 2026-11-03; paloaltonetworks.com, read 2026-11-03 |
| Ownership stability | 6.0 | 10 | 0.60 | Public parent. XSOAR 6.12 and 6.13 reached end-of-life on 2026-06-30 and XSOAR 8 on-prem versions retire on a three-month cycle; AgentiX is positioned as the successor. No end-of-sale notice found. A third party's 30 September 2029 on-prem end-of-life date does not appear on the Palo Alto lifecycle pages read. cortex-docs.paloaltonetworks.com, read 2026-11-03; cortex-docs.paloaltonetworks.com, read 2026-11-03; investors.paloaltonetworks.com, read 2026-11-03 |
| Total | 6.18 | 100 | 6.18 | Band 3 on the card; totals within 0.25 are a band, not a ladder. |
Where Palo Alto Cortex XSOAR is strong
- The product page states 900+ prebuilt integration and automation packs and the Marketplace page states 850+ product integrations. Both are vendor claims with no measurement date, and the two figures disagree. paloaltonetworks.com, read 2026-11-03
- Palo Alto lifecycle docs show three deployments: XSOAR 8 as SaaS, XSOAR 8 on-prem with dated end-of-life per version, and XSOAR 6 recommended for on-prem and air-gapped installs. Data residency regions were not read. cortex-docs.paloaltonetworks.com, read 2026-11-03
- Content is source-controllable: packs use a content-repo layout with versioned pack_metadata.json, a demisto-sdk command line tool and a secrets scan in a pre-commit hook. Python 3 is the preferred language for new integrations and scripts. xsoar.pan.dev, read 2026-11-03
Where Palo Alto Cortex XSOAR is behind
- No page read documents approval steps. Manual tasks exist as a task type, but no page describes who can approve, what is logged, or whether autonomy is set per action. The criterion scores 4.0 and is flagged for a re-read. paloaltonetworks.com, read 2026-11-03
- XSOAR 6.12 and 6.13 reached end-of-life on 2026-06-30, and XSOAR 8 on-prem versions retire on a three-month cycle, with 8.10 ending on 2026-07-30 and 8.11 on 2026-11-13. The Palo Alto release of 2025-10-28 positions Cortex AgentiX as the successor. cortex-docs.paloaltonetworks.com, read 2026-11-03
- The pages read give no leaving guide and no export format for a single XSOAR 8 playbook, though they name the YAML format of integrations and scripts and the content-pack layout. A pan.dev bundle job moves custom content between XSOAR servers, not to another product. xsoar.pan.dev, read 2026-11-03
A fact only Palo Alto Cortex XSOAR has
Palo Alto pack metadata accepts a marketplaces field listing xsoar, xsoar_on_prem, xsoar_saas, marketplacev2 for XSIAM and xpanse, so one content pack can be built for XSOAR and XSIAM together. xsoar.pan.dev, read 2026-11-03
Pricing as published
No price is published on the product page read. The pricing URL under the product path returned 404 on 2026-11-03. paloaltonetworks.com, read 2026-11-03
Ownership and funding
Palo Alto Networks completed its acquisition of Demisto in March 2019 (completion announced 2019-03-28). Demisto's platform became Cortex XSOAR, launched at RSA Conference in February 2020. paloaltonetworks.com, read 2026-11-03 (vendor claim)
Named customers
- State of North Dakota Information Technology (NDIT) source, read 2026-11-04 (vendor claim)
- BNL source, read 2026-11-04 (vendor claim)
- Logicalis source, read 2026-11-04 (vendor claim)
- Infosys source, read 2026-11-04 (vendor claim)
- Esri source, read 2026-11-04 (vendor claim)
- Naranja source, read 2026-11-04 (vendor claim)
- Flex source, read 2026-11-04 (vendor claim)
- PLDT source, read 2026-11-04 (vendor claim)
- Turkcell source, read 2026-11-04 (vendor claim)
- Resolution Life source, read 2026-11-04 (vendor claim)
- Inspira source, read 2026-11-04 (vendor claim)
- AZ Vesalius source, read 2026-11-04 (vendor claim)
11 more names appear on the vendor's pages.
Recent releases
- 2025-10-28 Palo Alto Networks unveils Cortex AgentiX.
Launched as the next generation of Cortex XSOAR; available in Cortex Cloud and XSIAM at launch, XDR and standalone planned for early 2026.
paloaltonetworks.com, read 2026-11-04 (vendor claim)
Claims Palo Alto Cortex XSOAR makes about itself
These are vendor claims. They are not scored. Each carries an evidence grade: C means a vendor figure with no published method.
| Claim | Grade | Source |
|---|---|---|
| AgentiX delivers up to a 98 percent reduction in MTTR with 75 percent less manual work | C | paloaltonetworks.com, read 2026-11-04 (vendor claim) |
What the public pages did not say
- Pricing page not found (404). No list price published on the product page read.
- No XSOAR release notes dated since 2025-11-01 were read.
Whether XSOAR is sold standalone is not stated on the product page. Palo Alto's own AgentiX release calls AgentiX the next generation of XSOAR; the standalone AgentiX platform was planned for early 2026 and its shipment was not confirmed.
- The Cortex Marketplace page shows no pack count (JavaScript shell). The only counts are 900+ on the product page and 850+ on the marketplace marketing page, which disagree and are undated.
- Playbook and automation format comes from xsoar.pan.dev page descriptions in search results (YAML metadata, Python, JavaScript). The docs-cortex.paloaltonetworks.com playbook pages were not opened; the EOL docs URL tried redirected to cortex-docs.paloaltonetworks.com and returned 404 on 2026-11-04 (the 6.14 lifecycle page worked).
- No price is published. No XSOAR release notes since 2025-11-01 were read.
Gaps recorded on 3 November 2026. A gap is an absence on the pages read, and it is scored that way.
Who should shortlist Palo Alto Cortex XSOAR
- You run XSOAR content packs today and want the 900+ pack catalogue, treated as a vendor claim, plus an air-gapped option documented in Palo Alto lifecycle pages.
- You are a Palo Alto shop weighing XSIAM or Cortex AgentiX and want content that can target both platforms.
- Your engineers write Python and keep automation content in git with a pack layout and a command line tool.
Verdict. Palo Alto Cortex XSOAR is eighth of 14 scored at 6.18, in a band with Tines (6.42), Mate Security (6.22), Microsoft Sentinel (6.21), Swimlane (6.14) and Google Security Operations (5.98), held back by silent approvals and no leaving guide.
Moving playbooks out of Palo Alto Cortex XSOAR
Palo Alto Cortex XSOAR is a source row in the portability matrix: 14 of 70 cells have a documented path. Source format: YAML metadata plus Python or JavaScript in content packs (xsoar.pan.dev, read 2026-11-03). The switching guide is Leaving Palo Alto Cortex XSOAR.
Palo Alto Cortex XSOAR against the other eleven
- BlinkOps v Palo Alto Cortex XSOAR
- Cyware v Palo Alto Cortex XSOAR
- D3 Security v Palo Alto Cortex XSOAR
- Google Security Operations v Palo Alto Cortex XSOAR
- Mate Security v Palo Alto Cortex XSOAR
- Microsoft Sentinel v Palo Alto Cortex XSOAR
- Palo Alto Cortex XSOAR v ServiceNow Security Operations
- Palo Alto Cortex XSOAR v Splunk SOAR (Cisco)
- Palo Alto Cortex XSOAR v Swimlane (Turbine)
- Palo Alto Cortex XSOAR v Tines
- Palo Alto Cortex XSOAR v Torq
Alternatives to Palo Alto Cortex XSOAR, ordered by the rubric.