Palo Alto Networks Cortex XDR The Next-Gen Security Backbone for Modern Enterprises
March 10, 2026

Palo Alto Networks Cortex XDR The Next-Gen Security Backbone for Modern Enterprises

Anonymous | TrustRadius Reviewer
Score 10 out of 10
Vetted Review
Verified User

Overall Satisfaction with Palo Alto Networks Cortex XDR

Palo Alto Networks Cortex XDR is used in our organization to gain the better visibility in terms of networks, cloud, endpoint. it provide the single pane of glass visibility where user don't have to go tab by tab for multiple tool, rather than that they get the visibility from a single console. It reduce the mean time to detect and respond. Before we are facing the challenge that in a single day analyst are getting more than 500 alerts. The analyst not able to identicy which one is false positive and which one true positive this bring that a single analyst is busy on a single incident for 1-2 hour. Meanwhile the most important and priority aleert get breached. So Palo Alto Networks Cortex XDR bring the feature of case which bring same type of incidents into a single case which reduce the alert noise as well as analyst do not have to focus on a single alert rather than that they investigate a case and that investigation can solve 15 or more alerts from a single case. It also provides the RBAC which help admin to provide the necessary permission to analyst, admin, investigator etc. Previously if we have to get the visibility of application, autoruns, registry etc then we have to check individual endpoint on by one but from Palo Alto Networks Cortex XDR host insights model we get all this type of visibility from a single console. its also providing the Vulnerability management platform which help admin to get visibility of vulnerability of assets, OS even of application. It is the one solution which provides GUI based live terminal where admin can get the visibility of drive, folders, file and can also download it over from console of specific endpoint. Even we can also run python code, script and also get visibility of task manager and we can end process from task manager from Live terminal only. So we do not need to go one by one on every endpoint rather we can manage and get visibility of all this thing from a single console.

Pros

  • GUI based live terminal which provides visibility of task manager, Drive, folder, file. Even we can execute python code, command in PowerShell and cmd.
  • Incident / alert grouping into a Case. It minimize the mean time to respond. before analyst focus on every alert and some of them great breached and lasty they find its false positive. But with case they can focus on multiple alert which is grouped in a single case based on behavioural, hostname, Ip, incident type. this reduce time to respond and identify the alert whether its false positive or true positive.
  • Vulnerability Management - Now organization can get visibility of Vulnerability over their assets, OS, application which is running on endpoint. even they get remediation suggestion and what CVE is getting over that vulnerability.
  • Automatic Sandbox analysis- on every detection or prevention done by Palo Alto Networks Cortex XDR agent you will get analysis report for it over the console from the Wildfire. It provides the sandbox and analysis report so that admin or analyst can get better visibility what it can impact on their organization and how.

Cons

  • Within a short time period if same time of malware is executing again and again it provides the timeline of first execution but as a analyst if we think we need all the time whether it should be in second.
  • Malware Title for alerts- It provides the malware name as wildfire malware rather than it can provide the exact malware name which can help analyst to identify the alert based on name only then they can go for deep analysis.
  • ZIP file Quarantine- Now Palo Alto Networks Cortex XDR is blocking execution of malware but it should quarantine the ZIP file also but now its quarantining the file file after extracting from Zip and when we try to execute it. No ZIP file quarantine is available now.
  • Before investing money on multiple product now from a single product its done.
  • Too much resources we need previously, now less resources can do the same work in less time.
  • Reduce the MTTR, MTTD which reduced the chance of get attacked and hacked.
As every attacks get started because of user mistake or employee mistake. they click on any link they open any software without knowing its behavioural. But after Palo Alto Networks Cortex XDR we able to identify what user is doing We can put sudden type of restriction as per our organization policy. If some malicious file is found it can be quarantined. easy remote terminal access for investogation rather going one by one user for endpoint if they are busy then we have to wait but now from console only we can do this all.
Due to budget some of them are too costly as compare to Palo Alto Networks Cortex XDR. For some level of add on license for specific features other OEM charge higher based on data but Palo Alto Networks Cortex XDR gives use benefits in it also. Easy GUI to understand and not need much time to analyst to learn and work on it.

Do you think Palo Alto Networks Cortex XDR delivers good value for the price?

Yes

Are you happy with Palo Alto Networks Cortex XDR's feature set?

Yes

Did Palo Alto Networks Cortex XDR live up to sales and marketing promises?

Yes

Did implementation of Palo Alto Networks Cortex XDR go as expected?

Yes

Would you buy Palo Alto Networks Cortex XDR again?

Yes

It help organization to gain visibility over all Network, Cloud, Endpoint. Also it help to correlate the events from multiple aspects and on the basics of it it provide the visibility and incidents over console. It reduce the noise of alert so that analyst can focus on priory alert which is actual need attention and can affect organization. It map the alert and incidents with Mitre ATT&CK which gives better analysis that how the incident is behaving in our environment and what types of tactics and techniques its using. So we have a scenario that we have to use multiple product and solution for network, cloud and endpoint. If something or malware we find we have to go every tool one by one to investigate this, we are not getting the better visibility and it also taking much time. But after Palo Alto Networks Cortex XDR it make easy to correlate the data from multiple verdict and it reduce time also. now we get visibility from a single console rather going tab and tab to see and find the aspects. Even we can take action over it from the console only rather going on individual endpoints.

Comments

More Reviews of Palo Alto Networks Cortex XDR

  1. Home
  2. Extended Detection and Response (XDR) Platforms
  3. Palo Alto Networks Cortex XDR Reviews
  4. User Review of Palo Alto Networks Cortex XDR