Item: Palo Alto Networks Cortex XSOAR
Rating: 6
Author: Darshil Sanghvi

Overall Satisfaction with Palo Alto Networks Cortex XSOAR (formerly Demisto)

Use Cases and Deployment Scope

With Palo Alto Networks Cortex XSOAR (formerly Demisto) in our organization, our SOC team is seamlessly able to triage and investigate malicious traffic in our network. This is hence enhancing our network security posture. We have also created playbooks and integrated our firewalls to automate policy creation at time of any attacks are being identified.

Pros and Cons

Pros

Triage and investigation of malicious traffic
Automate firewall policy modifications and actions in playbooks using Panorama
Automate malware sample analysis

Cons

SAML is not stable, it gives a lot of issues.
Pre-defined playbooks need a lot of fine tuning
Lacks proper documentation

Most Important Features

Integration with Panorama for automating policies on firewall
Simplicity and ease of integration with applications and devices
Marketplace has a lot of apps supported

Return on Investment

Demisto has Eased malware analysis and threat hunting
With Demisto, it is simple to create playbooks and scripts
This is helped automate policy configurations on our PA firewalls through Panorama

Alternatives Considered

FortiSOAR (formerly CyberSponse) and SonicWall Analytics

Key Insights

Do you think Palo Alto Networks Cortex XSOAR delivers good value for the price?

Not sure

Are you happy with Palo Alto Networks Cortex XSOAR's feature set?

Yes

Did Palo Alto Networks Cortex XSOAR live up to sales and marketing promises?

I wasn't involved with the selection/purchase process

Did implementation of Palo Alto Networks Cortex XSOAR go as expected?

Yes

Would you buy Palo Alto Networks Cortex XSOAR again?

Yes

Other Software Used

Palo Alto Networks Cortex XDR (Traps), Palo Alto Networks GlobalProtect Mobile Security Manager, Palo Alto Networks Prisma Access

Likelihood to Recommend

Palo Alto Networks Cortex XSOAR (formerly Demisto) is well suited in scenarios where there is a dedicated threat hunting team working continuously for analyzing logs and alerts. This even has a lot of out-of-the-box and ready-to-use features, that makes life easy for your malware hunting team. In cases where there is no such team, or SOC deployed, it will not b much useful.

Comments

Please log in to join the conversation

Cortex XSOAR - Comprehensive incident management solution