Cortex XSOAR

Redefining Security Orchestration, Automation,

and Response
Security teams lack the people and scalable processes to keep pace with
an overwhelming volume of alerts and endless security tasks. Analysts
waste time pivoting across consoles for data collection, determining
false positives, and performing repetitive, manual tasks throughout the
lifecycle of an incident. As they face a growing skills shortage, security
leaders deserve more time to make decisions that matter, rather than
drown in reactive, piecemeal responses.

Cortex by Palo Alto Networks | Cortex XSOAR | Datasheet 1

An Industry First Business Benefits
Cortex XSOAR is the industry’s first extended ­security
™
With Cortex XSOAR, your organization will be able to:
­orchestration and automation platform that simplifies ­security
• Scale and standardize incident response processes
operations by unifying automation, case ­management,
­real-time collaboration, and threat intelligence manage- • Speed up resolution times and boost SOC efficiency
ment. Teams can manage alerts across all sources, standardize • Improve analyst productivity and enhance team learning
­processes with playbooks, take action on threat intelligence, and • Gain immediate ROI from existing threat intelligence
automate response for any security use case. ­investments

400+
Third-Party Tools SIEM Tools People API

Playbook-Driven Automation

Marketplace

Cortex XSOAR Community

Ecosystem

Automation & Real-Time Case Threat Intel

Orchestration Collaboration Management Management

Threat
Alerts
Intel Feeds

{...} {...} AF

SIEM Cortex XDR Mail Other Sources ISAC Open Source Premium AutoFocus

Figure 1: Cortex XSOAR platform

Table 1: Standardize and Automate Processes for Any Security Use Case
Speed up deployment with hundreds of out-of-the-box (OOTB) playbooks covering a wide range
Scalable, consistent incident
of security use cases (e.g., phishing prevention, IOC enrichment, vulnerability management,
response
cloud security). A powerful software development kit allows you to build your own integrations.

Address simple use cases and complex, custom workflows using a visual drag-and-drop play-
Modular, customizable book editor with thousands of executable actions. Playbook blocks/tasks can be nested and
­playbooks ­reused across playbooks. Real-time editing, a playground for testing playbooks, and YAML-
based ­sharing make playbook creation quick and easy.

Perfect balance of automation Maintain control over automated processes with manual approval tasks available as part of any
and human response playbook.

Automate incident enrichment and response across more than 400 integrations with data
Orchestration across the
enrichment tools, threat intelligence feeds, SIEMs, firewalls, EDRs, sandboxes, forensic tools,
product stack
messaging systems, and more.

Cortex by Palo Alto Networks | Cortex XSOAR | Datasheet 2

Security Orchestration
Cortex XSOAR empowers security professionals to
­efficiently carry out security operations and incident
­response by streamlining security processes, connecting
disparate security tools, and maintaining the right ­balance
of machine-powered security automation and human
­intervention.

Case Management
Automation of incident response needs to be ­complemented
by real-time investigations for complex use cases when
­human intervention is required. Cortex XSOAR ­accelerates
incident response by unifying alerts, incidents, and
­indicators from any source on a single platform for ­lightning- Figure 2: Cortex XSOAR phishing playbook
quick search, query, and investigation.

Table 2: Adapt to Any Alert with Security-Focused Case Management

Custom layouts for incidents Fully customizable incident and indicator layouts help you quickly surface relevant information
and indicators when responding to events.

Indicator and incident A central indicator repository enables searches and automated indicator correlation across inci-
­correlation dents from multiple sources to spot duplicates, trends, and patterns.

Flexible, customizable reports and Widget-driven dashboards and reports offer unparalleled visibility into metrics so you can cut and
dashboards dice data for your reporting needs.

The Cortex XSOAR mobile application provides dashboards, task lists, and incident actions on the go.
On-the-go incident monitoring

Mirrored connections can be created with other applications so incident updates in Cortex XSOAR
Automated mapping across
will be pushed automatically to third-party applications (ServiceNow, Jira, Slack, etc.) for auto-
integrations
mated ticketing management.

Collaboration and Learning

Cortex XSOAR offers interactive investigation features,
providing a potent toolkit to help analysts collaborate,
run real-time security commands, and learn from each
incident.

Figure 3: Customizable incident views

Table 3: Boost SecOps Efficiency with Real-Time Collaboration

Real-time investigation and Each incident has a virtual War Room with built-in ChatOps and command line i­ nterface (CLI) so
collaboration analysts can collaborate and run security actions in real time.

An ML-driven virtual assistant learns from actions taken in the platform and offers guidance on
Machine learning assistance
analyst assignments and commands to execute actions.

Continuous learning Auto-documentation of all investigation actions aids analyst learning and development.

Flexible, widget-driven dashboards and reports eliminate manual reporting and can be fully cus-
Streamlined, automated ­reporting
tomized to your organization’s needs.

Cortex by Palo Alto Networks | Cortex XSOAR | Datasheet 3

Threat Intelligence Management
Cortex XSOAR takes a new approach with native threat intelli-
gence management, unifying aggregation, scoring, and sharing
of threat intelligence with playbook-driven automation.

Figure 4: Intelligence-based automated playbook

Table 4: Act on Threat Intelligence with Confidence and Speed

Automated multi-source feed Eliminate manual tasks with automated playbooks to aggregate, parse, deduplicate, and man-
aggregation age millions of daily indicators across dozens of supported sources.

Granular indicator scoring and Take charge of your threat intelligence with playbook-based indicator lifecycle management
management and transparent scoring that can be extended and customized with ease.

Best-in-class operational Boost collaboration and reveal critical threats by layering third-party threat intelligence with
­efficiency internal incidents to prioritize alerts and make smarter response decisions.

Supercharge investigations with built-in, high-fidelity threat intelligence from Palo Alto Net-
Powerful native threat intelligence
works AutoFocus™ contextual threat intelligence service.

Hands-free, automated playbooks Take automated action to shut down threats across more than 400 third-party products with
with extensible integrations purpose-built playbooks based on proven SOAR capabilities.

Breadth of Use Cases

Cortex XSOAR provides an open, extensible platform ­applicable to any use case, with common ones including phishing,
to a wide range of use cases—even processes outside the ­s­­ecurity operations, incident alert handling, cloud security
­purview of the security operations center (SOC) or security ­orchestration, vulnerability management, and threat hunting.
­incident response team. The flexible platform can be ­adapted

Incident
Management
Security Phishing
Alert Sources Operations Response Enrich & Respond

SIEM and analytics Threat intelligence

XDR (or EDR) Malware analysis
Cloud security alerts Email web gateways
Vulnerability Ticketing
scanner
Email
Ticketing
Threat intel feeds

Cloud Threat
Security Hunting
Vulnerability
Management

Figure 5: Ingestion of alerts and IOCs in Cortex XSOAR

Cortex by Palo Alto Networks | Cortex XSOAR | Datasheet 4

Cortex XSOAR Marketplace
Cortex XSOAR Marketplace is the industry’s most comprehen- Content packs are pre-built bundles of integrations, play-
sive security orchestration marketplace. As a native extension books, dashboards, fields, and subscription services designed
of Cortex XSOAR, the Marketplace enables you to discover, to address specific security use cases. Packs can be deployed
share, and consume content packs contributed by the indus- with a single click, simplifying and speeding up the adoption
try’s largest SOAR community. of automation.

Figure 6: Highly rated, validated content to discover

Breadth of Integrations Benefits of Our Extensive Integration Ecosystem

Cortex XSOAR has the industry’s most extensive and in-depth • Promote your platform and solution offerings
OOTB integrations with security and non-security tools used • Develop a strategic partnership with Palo Alto Networks
by security teams. New integrations and content packs are
• Take advantage of co-marketing activities and lead generation
c­ontinuously added to the Cortex XSOAR Marketplace to facili-
tate quick and seamless deployments for our customers. • Gain brand recognition in the security industry
Join the Marketplace today.

Figure 7: Some of our 400+ OOTB integrations

Cortex by Palo Alto Networks | Cortex XSOAR | Datasheet 5
Industry-Leading Customer ­Success
Our Customer Success team is dedicated to helping you Premium Success, the recommended plan, includes every-
­continuously optimize your security posture and get the most thing in the Standard plan plus guided onboarding, custom
out of your Cortex XSOAR implementation. workshops, 24/7 technical phone support, and access to the
Standard Success, included with every Cortex XSOAR subscrip- Customer Success team to give you a personalized experience
tion, makes it easy for you to get started. You’ll have access to to help you realize optimal return on investment (ROI).
self-guided materials and online support tools to get you up
and running quickly.

Standard Premium
Summary Value Self-Help Optimized Experience

Customer journey kickoff • •

Onboarding Onboarding assistance •
Assistance Initial service configuration •
Use case assistance •
Access to support community • •
Technical Access to Support Portal
Telephone support
• •
24/7
Support
Response time (S1) < 1 hour
Slack DFIR private channel •
Access to online documentation • •
• •
Education
Access to online training
•
Training
Custom workshop

Annual health check • •

Customized success plans •
•
Optimized
Periodic operation reviews
•
Experience
Executive business reviews
Prioritized integration development •
Figure 8: Key aspects of Standard and Premium Customer Success plans

­ omplete tasks from any device, and improve investigation

c
Cortex XSOAR Community Edition quality by working together.
To experience the capabilities of Cortex XSOAR, try the free Get the app from the App Store® and Google Play®.
Community Edition. With its included 30-day enterprise
­license, it’s the perfect way to test-drive Cortex XSOAR.
Sign up for our free Community Edition. Designed for MSSPs
Cortex XSOAR supports full multitenancy with data segmen-

Cortex XSOAR Mobile App

tation and scalable architecture for managed security service
providers (MSSPs). MSSPs can build their managed service
Use Cortex XSOAR to track and respond to security incidents ­operations on Cortex XSOAR to provide best-in-class offerings
on the go with a mobile-first experience for iOS and ­Android®. for their customers and optimize internal team productivity.
Create and access personalized dashboards, assign and

Table 5: The Connective Fabric for Your Security Infrastructure and Teams
Feature Value

MSSPs can create playbooks and enforce policy at both the master and tenant levels, creating
True multitenancy flexibility to quickly onboard new customers, offer different levels of service, and expand into
additional management options.

MSSPs can also build custom playbooks for specific services and service levels. Inside each play-
Modular playbooks book, tool actions can be simply “copied” and reused in other playbooks at both the master and
tenant levels for efficient scaling with new customer additions.

Cortex XSOAR features built-in SLA tracking capabilities to help MSSPs guarantee timely service
SLA and team performance
outcomes to their customers. An MSSP can trigger a notification—via Slack, email, etc.—to the
tracking
analyst team to handle a timely incident before an SLA breach.

Cortex by Palo Alto Networks | Cortex XSOAR | Datasheet 6

 Table 5: The Connective Fabric for Your Security Infrastructure and Teams (continued)
Feature Value

MSSPs can leverage all Cortex XSOAR capabilities as a powerful backend automation and orches-
Extensive APIs
tration enabler for their services while maintaining existing customer-facing portals.

For MSSPs, adding threat intelligence to any service to increase customer value is vastly s
­ implified.
Threat intelligence management Threat intelligence feeds can be compiled at the master and tenant levels to cater to different
­customer types and use cases.

Flexible Deployment Benefits of a Hosted Solution

Cortex XSOAR can be deployed on-premises, in a private • Reliable, flexible, and scalable technology
cloud, or as a fully hosted solution. We offer the platform in
• Ironclad security and privacy
multiple tiers to fit your needs.
• Lower total cost of ownership
• Accelerated, standardized incident response
Cortex XSOAR Hosted Solution
With our hosted solution, security teams can improve ­response
times and efficiencies without having to devote dedicated
­resources for infrastructure, maintenance, and storage. ­Cortex
XSOAR will manage and maintain the infrastructure and
­platform layer, enabling SOCs to focus on the critical aspects of
incident response.

Table 6: Cortex XSOAR Server—System Requirements for On-Premises Deployment

Component Minimum Recommended

CPU 8 CPU cores 16 CPU cores

Memory 16 GB RAM 32 GB RAM

Storage 500 GB SSD 1 TB SSD with minimum 3K dedicated IOPS

Physical or virtual server Linux OS: Ubuntu 16.04, 18.04; RHEL 7.x & 8; Oracle Linux 7.x; Amazon Linux 2; CentOS 7.x & 8

Table 7: Cortex XSOAR Engine—System Requirements for On-Premises Deployment

Component Minimum Recommended

CPU 8 CPU cores 16 CPU cores

Memory 16 GB RAM 32 GB RAM

Storage 500 GB SSD 1 TB SSD with minimum 3K dedicated IOPS

Operating system macOS, Windows, Linux

3000 Tannery Way © 2020 Palo Alto Networks, Inc. Palo Alto Networks is a registered
Santa Clara, CA 95054 ­trademark of Palo Alto Networks. A list of our trademarks can be found at
https://www.paloaltonetworks.com/company/trademarks.html. All other
Main: +1.408.753.4000 marks mentioned herein may be trademarks of their respective companies.
Sales: +1.866.320.4788 cortex-xsoar-ds-100820
Support: +1.866.898.9087

www.paloaltonetworks.com