- The SOC needs deep cross-tool automation with both low-code and code-based development: The current product and documentation describe a visual editor, custom scripts, testing, reusable content, remote repositories, versions, and hundreds of integrations.
- Incident response requires cases, collaborative investigation, SLAs, threat intelligence, and auditability in one operating layer: War Room collaboration, cases, indicators, SLA controls, dashboards, reports, role permissions, and audit logs are documented within Cortex XSOAR.
Security & Privacy / Security Orchestration, Automation, and Response (SOAR) Software
Cortex XSOAR Review, Pricing, Pros & Cons
Cortex XSOAR is a security orchestration, automation, and response platform for coordinating incident investigations, playbooks, threat intelligence, and response actions across security tools.
Research by Global Tool Radar Research SystemEvidence checked: Aug 10, 2026AI-assisted · No Global Tool Radar hands-on testView research methodology
Buying snapshot
Quick buying snapshot
A compact view of who this tool fits, what it costs, and what to confirm before choosing it.
- The buyer needs a current permanent free production edition: The official license guide states that Community Edition reached end of life on August 15, 2024.
- The team cannot dedicate security engineering capacity to integrations and playbook lifecycle management: The product's flexibility depends on configuring integrations, permissions, repositories, playbooks, debugging, testing, versions, and production governance.
- Sales-assisted yearly per-user licensing. Starter, full Cortex XSOAR, threat-intelligence, development, and multi-tenant entitlements vary by order; multi-year licenses are available.
- Paid amounts unverified — check official pricing
- No current public self-service free edition was verified. Cortex XSOAR Community Edition reached end of life on August 15, 2024.
Product scope
Product functionality and purchase scope
This profile evaluates the current Cortex XSOAR security orchestration, automation, case-management, and threat-intelligence product, including Starter and full XSOAR purchase routes where their capabilities differ.
Product checked: Aug 10, 2026
- Cortex XSOAR Starter Edition
- Full Cortex XSOAR edition
- Visual and coded playbooks
- Incident, case, War Room, SLA, and reporting workflows
- Cortex XSOAR Marketplace integrations and content packs
- Threat-intelligence capabilities included with the selected license
- Cloud-hosted and self-managed deployment routes
- Cortex XSIAM
- Cortex XDR
- Cortex Xpanse
- Cortex Cloud
- Unit 42 managed detection and response services
- Retired Cortex XSOAR Community Edition
- Paid third-party marketplace content unless separately licensed
Pricing plans
Cortex XSOAR pricing table
Pricing checked: Aug 10, 2026
Official factConfidence 99%2 linked sources
Official documentation establishes yearly per-user licensing and product editions but does not publish a binding numeric price, payment timing, minimum user count, services fee, or renewal amount. No Offer is generated.
Pricing cautions
- No public numeric license price: Per-user yearly licensing is documented, but amounts, minimums, support tiers, implementation, hosting, development tenants, renewal terms, and marketplace costs require a proposal.
- Edition and add-on scope must be mapped before quoting: Starter, full XSOAR, threat-intelligence, development, multi-tenant, and third-party content entitlements are not interchangeable.
PlanPriceKey differencesBest for
Cortex XSOAR Starter EditionSupporting pricing evidenceAmount unverified — check official pricing
- Starter scope: Case management, collaboration, and playbook-driven automation; Current published edition description.
Cortex XSOARFull Cortex XSOAR editionSupporting pricing evidenceAmount unverified — check official pricing
- License term: Yearly per user; multi-year licenses available; Current on-premises license documentation.
- Marketplace integrations: 850+ product integrations; Current marketplace description.
Plan upgrade triggers
Verified plan boundaries that can change the required edition.
The SOC requires the complete security automation and threat-intelligence capabilities documented for the full product rather than Starter case management and playbook scope.
Supporting pricing evidenceWhat is included, connected, or sold separately
Product scope
What is included, connected, or sold separately
Material capabilities are separated by their verified relationship to the target product.
Paid third-party content packs and subscription servicesRelationship not verified
Marketplace content can be free or paid and may introduce separate commercial terms.
Cortex XSOAR Marketplace paid content
Unified SIEM, XDR, and automation platformRelationship not verified
Do not treat Cortex XSIAM packaging or pricing as Cortex XSOAR.
Cortex XSIAM
How the score is calculated
Scoring method
How the score is calculated
The score uses the category-specific buying dimensions below and their displayed weights.
This page is based on public product information, official sources, structured feature data, and multi-model AI evaluation. It is not a hands-on lab test unless explicitly stated. Confidence percentages describe our research indicators, not the probability that a claim is true or a measured accuracy rate.
- Evidence confidence
- 76%
- AI claim confidence
- 99%
- Required-field evidence status
- 100%
- Evidence freshness
- 54%
- Field traceability
- 100%
- Model agreement
- 92%
Why this confidence level
- Evidence confidence uses source level and claim-to-source support; AI claim confidence is shown separately.
- Required-field evidence status measures whether weighted required claims have evidence links; it does not mean every product behavior was independently verified.
- 8 of 8 weighted claims have evidence links.
- 0 A1 documentary official sources and 8 A2 official product sources are linked.
- 3 independent review sources are retained, including 0 professional sources with an explicit hands-on method.
- 4 weighted claims are past the review window.
- No blocking evidence conflict was identified.
Automation and response depth20%
88Coordinates thousands of third-party actions and complex automated playbooks, but maximizing this capability requires dedicated builder resources to write and manage scripts.
Playbook building and maintenance17%
91Facilitates visual playbook creation with embedded debugging, version control, scripting, and remote repository integration to maintain lifecycle hygiene.
Connectors and ecosystem16%
93Connects to a vast security ecosystem with more than 850 marketplace integrations and 900+ packs, though external feeds and third-party tools may add licensing costs.
Case and incident operations14%
89Incident cases, tasks, evidence, War Room collaboration, SLAs, and reports cover core case and incident operations, but the score stops short of the maximum because the facts do not establish every possible case workflow or regional operating rule.
Governance and execution security13%
88Role-based permissions, integration-command controls, API-key controls, and audit logs give the platform meaningful execution governance, but the score is not higher because the facts still require buyer-owned testing, approvals, and credential control.
Deployment, support, and total cost10%
57The product has documented yearly per-user licensing and multi-year availability, but no binding public numeric license price, support cost, implementation cost, or renewal amount is verified, which leaves total cost planning dependent on proposal-level quoting.
Scale and operational analytics10%
84Custom dashboards, multi-tenant deployment routes, and broad integration coverage support operating at larger SOC scale, but the facts do not establish benchmarked performance or native scale limits, so the score reflects supported scale operations rather than guaranteed capacity.
Public review signals
Cortex XSOAR earns strong product-level ratings for automation and integration depth
Three exact-product sources show consistently favorable aggregate ratings. Users most often value flexible playbooks, broad integrations, centralized incident work, and threat-intelligence enrichment, while cautioning about learning effort, debugging, reporting flexibility, performance, support consistency, and licensing cost.
Public review signals updated: Aug 10, 2026
Commonly reported strengths
- Flexible visual and coded automation
- Broad integration and content-pack ecosystem
- Centralized incident, case, and threat-intelligence workflows
Commonly reported concerns
- Playbook engineering and implementation require specialist skills
- Debugging, reporting, or complex-interface workflows can require improvement
- Enterprise licensing and support can be costly
G24.6/5
- Review count
- 27 reviews
- Source context
- Cortex XSOAR on G2Exact product
Gartner Peer Insights4.5/5
- Rating count
- 69 ratings
- Source context
- Cortex XSOAR on Gartner Peer InsightsExact product
PeerSpot4.2/5
- Review count
- 52 reviews
- Source context
- Cortex XSOAR on PeerSpotExact product
Cortex XSOAR tag profile
Company size
- Enterprise
- Mid-market
Cortex XSOAR core capabilities
- Visual playbook editor, scripts, debugging, versions, and remote repositories
- More than 850 marketplace product integrations and more than 900 integration and automation packs
- Thousands of security actions across third-party tools
- Incident cases, tasks, evidence, War Room collaboration, SLAs, and reports
- Indicator extraction, enrichment, verdicts, expiration, and lifecycle management
- Role-based permissions, integration-command controls, API-key controls, and audit logs
Detailed strengths and purchase cautions
Why it is worth considering
- The platform includes a visual playbook editor with scripts, debugging, versions, and remote repositories, which supports teams that need both guided automation and code-level maintenance.
- The product includes incident cases, tasks, evidence, War Room collaboration, SLAs, and reports, which supports structured SOC operations around investigation and response tracking.
- The platform includes more than 850 marketplace product integrations and more than 900 integration and automation packs, which supports teams that need broad cross-tool orchestration.
What to confirm before buying
- No binding public numeric license price, implementation cost, support cost, or renewal amount was verified, so budget planning requires a proposal.
- Starter and full-product threat-intelligence scope must be confirmed in the order, so buyers should map the exact edition and add-ons before purchase.
- Automation quality and safety depend on integration health, credentials, permissions, testing, approvals, and operational ownership, so the product still needs active governance.
Cross-model buying perspectives
Multi-AI review
Cross-model buying perspectives
Multiple AI models assess this tool against the same buying criteria, so you can compare scores, confidence, fit, cautions, and final views.
AI assessment updated: Sep 21, 2026
Score comparisonGeminiGPTxAIRange
Automation and response depth8991856
Playbook building and maintenance9194886
Connectors and ecosystem9395914
Case and incident operations9089873
Governance and execution security9187856
Scale and operational analytics8786789
Deployment, support, and total cost68544820
soar playbook automation depth9092866
soar alert triage enrichment8584841
soar case management coordination9290884
soar response action reliability86787412
soar metrics process improvement8880808
- Deployment, support, and total cost: 48–68 (20-point range)
- soar response action reliability: 74–86 (12-point range)
- Scale and operational analytics: 78–87 (9-point range)
GeminiAI-assisted buyer perspective88
Cortex XSOAR provides a highly structured orchestration platform for enterprise security operations to automate incident response workflows, manage cases, and coordinate threat intelligence, though buyers must evaluate the operational ownership required to maintain playbooks and account for sales-assisted yearly licensing.
- Review confidence
- 88/100
Model details
- Strengths
- Supports a comprehensive playbook development lifecycle through a visual editor, scripting capabilities, debugging tools, version control, and remote repositories.
- Provides extensive ecosystem connectivity with more than 850 marketplace product integrations and more than 900 integration and automation packs.
- Facilitates structured team coordination during incidents using dedicated incident cases, tasks, evidence tracking, SLAs, and collaborative War Room spaces.
- Cautions
- Lacks transparent public pricing and a free entry point, as the Community Edition reached end of life on August 15, 2024.
- Requires significant operational commitment to manage credentials, permissions, integration health, and continuous playbook testing.
- Restricts complete threat-intelligence lifecycle features to the full edition, meaning Starter Edition users must operate without native full-scale threat-intelligence operations.
GPTAI-assisted buyer perspective85
Cortex XSOAR fits enterprise SOCs that want case management, collaboration, and playbook-driven automation with governed integrations, but buyers should confirm edition scope, licensing terms, and marketplace costs before committing.
- Review confidence
- 85/100
Model details
- Strengths
- The platform includes a visual playbook editor with scripts, debugging, versions, and remote repositories, which supports teams that need both guided automation and code-level maintenance.
- The product includes incident cases, tasks, evidence, War Room collaboration, SLAs, and reports, which supports structured SOC operations around investigation and response tracking.
- The platform includes more than 850 marketplace product integrations and more than 900 integration and automation packs, which supports teams that need broad cross-tool orchestration.
- Cautions
- No binding public numeric license price, implementation cost, support cost, or renewal amount was verified, so budget planning requires a proposal.
- Starter and full-product threat-intelligence scope must be confirmed in the order, so buyers should map the exact edition and add-ons before purchase.
- Automation quality and safety depend on integration health, credentials, permissions, testing, approvals, and operational ownership, so the product still needs active governance.
xAIAI-assisted buyer perspective81
Cortex XSOAR fits enterprise SOCs that will govern visual and scripted playbooks across a large integration catalog, provided the buyer confirms Starter versus full threat-intelligence scope and accepts sales-assisted yearly per-user commercial terms.
- Review confidence
- 81/100
Model details
- Strengths
- A visual playbook editor with scripts, debugging, versions, and remote repositories supports controlled automation design and change management.
- More than 850 marketplace product integrations and more than 900 integration and automation packs, with thousands of security actions, enable cross-tool orchestration once connectors are configured.
- Incident cases, tasks, evidence, War Room collaboration, SLAs, and reports support coordinated investigation handoffs inside one case workspace.
- Indicator extraction, enrichment, verdicts, expiration, and lifecycle management support structured threat-intelligence handling on the full product scope.
- Cautions
- No binding public numeric license, implementation, support, hosting, development-tenant, or renewal price is published, so total cost requires a vendor proposal.
- Starter Edition centers on case management, collaboration, and playbook-driven automation, while complete threat-intelligence scope belongs to the full product and must be confirmed per order.
- Automation safety and outcome quality depend on integration health, credentials, permissions, testing, approvals, and ongoing operational ownership.
- Third-party marketplace content and external intelligence feeds can add separate licenses or usage costs beyond the core entitlement.
Research transparency
How this page was researched
A compact record of the evidence used, what was not tested, and which conclusions still need verification.
- Official sources
- 8
- Broad product review sources
- 3
- Marketplace and app-store sources
- 0
- Editorial sources
- 0
- Latest evidence check
- Aug 10, 2026
Research basis
Global Tool Radar generated this assessment from structured facts linked to public sources. No Global Tool Radar hands-on test is recorded in this page's research data. Any external hands-on assessment is identified separately and does not affect the Global Tool Radar score.
Conflict handlingNo unresolved evidence conflict is currently recorded.
View research methodologyVerified findingsNo current public self-service free edition was verified. Cortex XSOAR Community Edition reached end of life on August 15, 2024.
- Sales-assisted yearly per-user licensing. Starter, full Cortex XSOAR, threat-intelligence, development, and multi-tenant entitlements vary by order; multi-year licenses are available.
- Visual playbook editor, scripts, debugging, versions, and remote repositories More than 850 marketplace product integrations and more than 900 integration and automation packs Thousands of security actions across third-party tools Incident cases, tasks, evidence, War Room collaboration, SLAs, and reports Indicator extraction, enrichment, verdicts, expiration, and lifecycle management Role-based permissions, integration-command controls, API-key controls, and audit logs Custom dashboards for incidents, SLAs, system health, playbooks, and integrations Cloud-hosted, self-managed, development, and multi-tenant deployment routes
- No current public numeric starting price was verified.
- Official documentation establishes yearly per-user licensing and product editions but does not publish a binding numeric price, payment timing, minimum user count, services fee, or renewal amount. No Offer is generated.
Verification notes and unresolved itemsCurrent official sources support the Cortex XSOAR identity, eight SOAR attributes, yearly per-user license model, edition boundaries, and Community Edition end of life.
- No numeric price, payment timing, or unsupported commitment term is inferred.
Sources checked
Sources checked
Cortex XSOAR source links
Indicator lifecyclePalo Alto NetworksLevel A2Linked to 0 scored claimsChecked Aug 10, 2026
SLAs in Cortex XSOARPalo Alto NetworksLevel A2Linked to 0 scored claimsChecked Aug 10, 2026
Role-based permissionsPalo Alto NetworksLevel A2Linked to 0 scored claimsChecked Aug 10, 2026
Manage playbook contentPalo Alto NetworksLevel A2Linked to 0 scored claimsChecked Aug 10, 2026
Cortex XSOAR licensesPalo Alto NetworksLevel A2Linked to 4 scored claimsChecked Aug 10, 2026
Add the Cortex XSOAR licensePalo Alto NetworksLevel A2Linked to 0 scored claimsChecked Aug 10, 2026
Cortex XSOAR MarketplacePalo Alto NetworksLevel A2Linked to 5 scored claimsChecked Aug 10, 2026
Cortex XSOARPalo Alto NetworksLevel A2Linked to 0 scored claimsChecked Aug 10, 2026
FAQ
Cortex XSOAR FAQ
Does Cortex XSOAR publish a starting price?
No binding public numeric starting price was verified. Current documentation confirms yearly per-user licensing and multi-year availability.
Is Cortex XSOAR Community Edition still available?
No. The official license guide states that Community Edition reached end of life on August 15, 2024.
What is the difference between Starter and full Cortex XSOAR?
Starter focuses on case management, collaboration, and playbook-driven automation. The full product adds the complete security automation and threat-intelligence scope described by Palo Alto Networks.
Is Cortex XSOAR the same product as Cortex XSIAM?
No. Cortex XSOAR remains a distinct SOAR product; Cortex XSIAM is a separate security operations platform and is outside this profile.
Popular comparisons
Common Cortex XSOAR comparisons
Only high-scoring and nearby tools from the same subcategory are shown, avoiding comparisons between unrelated use cases.