Cortex XSOAR

Paid#14 of 28 in Incident Management SoftwareSOAR SoftwareSecurity Orchestration, Automation, and Response SoftwareRunbook Automation Software

Cortex XSOAR: A security-operations platform built around incident workflows, playbooks and threat intelligence. Ranked #14 of 28 in Incident Management Software by our editors (7.7/10); pricing: Pricing on request; best for security teams automating incident response.

7.7/10★★★★☆Editor score

Visit Cortex XSOAR

Cortex XSOAR7.7 Visit Cortex XSOAR

At a glance

• Editor score
  7.7 / 10
• Pricing
  Pricing on request
• Best for
  Security teams automating incident response
• Founded
  2005 · Santa Clara, California, USA
• Facts checked
  19 Sep 2026

• Where it wins

  • Visual playbooks automate alert enrichment, investigation and response workflows
  • War rooms support real-time collaboration during investigations
  • Threat intelligence management connects with indicator processing and automation

• Where it doesn't

  • Pricing is contact-sales, with no public product price
  • The documented SaaS incident-retention default is six months
  • Core on-call, escalation and status-page capabilities are not established

Our verdict on Cortex XSOAR

Cortex XSOAR brings incident and case management, investigation collaboration, threat intelligence and automation into a security-operations platform from Palo Alto Networks. It is aimed at teams that need to coordinate response across alerts and indicators from SIEM solutions, network security tools, threat-intelligence feeds and mailboxes. Process-driven playbooks, a visual editor and investigation war rooms give the product a workflow-centered approach; it is a more specialized fit for security operations than a general-purpose incident tool.

Its strongest distinction is the combination of automation and threat intelligence. Teams can ingest alerts and indicators, enrich them, and route investigation and response through playbooks. Prebuilt integrations and automation content packs, plus APIs for incidents, indicators and platform operations, support connections with security tools and Cortex platform products. Management audit logs and audit reporting add a record of platform activity. SaaS and on-premises deployment options suit different operating environments, while the feature set is oriented toward security workflows rather than general service reliability response.

The published editions separate case management and playbook-driven automation in Cortex XSOAR Starter Edition, threat intelligence management and related automation in Cortex XSOAR Threat Intel Management Edition, and orchestration, response and threat intelligence management in Cortex XSOAR Enterprise Edition. Pricing is contact-sales; official documentation states a yearly license per user. SaaS incident retention is six months by default. Choose XSOAR when security orchestration, threat intelligence and investigation workflows are central needs. Teams primarily seeking verified on-call, escalation, status-page or current mobile-app capabilities should compare alternatives: those functions are not established here, and the documented Enterprise mobile app has reached end of life.

Your product? Our editors can test Cortex XSOAR in depth and publish a review, labelled as paid · from $149/mo →

Cortex XSOAR pricing

All 3 Cortex XSOAR plans and prices →

Cortex XSOAR fact sheet

Cortex XSOAR integrations

Cortex XSOAR lists 5 integrations on its own site.

• SIEM solutions
• network security tools
• threat intelligence feeds
• mailboxes
• Cortex platform products

Alternatives to Cortex XSOAR

• AlertOpsBroad incident response coverage with a free plan and paid tiers from $10 per user monthly.9.4
• PagerDutyPagerDuty routes incidents to on-call responders and coordinates response across teams.9.3
• incident.ioA chat-native incident platform with on-call, workflows, status pages, and postmortems.9.1

See all Cortex XSOAR alternatives →

Featured on iTechGuides

Cortex XSOAR is listed in our Incident Management Software directory. Add the badge to your site — it links back to this page.

<a href="https://www.itechguides.com/products/cortex-xsoar/"><img src="https://www.itechguides.com/best/badge/cortex-xsoar.svg" alt="Featured on iTechGuides" width="230" height="46"></a>

Reviewed by iTechGuides Editors · Editorial team · Updated Oct 2026

Advertiser disclosure: iTechGuides is reader-supported. Vendors can pay for top positions in our rankings and for a place on other products' pages, and we may earn a commission when you click some links. Bought places stand at the number bought; this page and our disclosure say so. Paying vendors may get a fuller, more detailed review from our editors, and that review can change their score. How we rank.

Last updated 7 Oct 2026 · How we research and update