We changed our name from IT Central Station: Here's why
KostiantynFrolov
Lead Security Engineer at ESKA
Real User
Top 5
Scalable with excellent protection features and is very user-friendly
Pros and Cons
  • "The solution doesn't need a high level of technical training."
  • "Cortex does not offer an on-premises solution. However, some customers would prefer not to be on the cloud. It would be ideal if it could offer something on-prem as well."

What is our primary use case?

Cortex XDR is used for endpoint detection and response. This is software placed into endpoints and work in this cloud. In cloud has the analytics, login, prevention models, et cetera.

What is most valuable?

If a company uses Palo Alto and supports Cortex XDR for endpoint protection it is very well protected. Palo Alto is the best security solution in the market. It's very advanced and its protection is extremely reliable.

The solution doesn't need a high level of technical training. The solution is very usable and doesn't take a lot of personnel.

The product is very scalable.

The stability is very good.

What needs improvement?

For working with the solution, you only really need a web browser, however, we've found that working on Chrome, for example, is horrible.

Cortex does not offer an on-premises solution. However, some customers would prefer not to be on the cloud. It would be ideal if it could offer something on-prem as well.

For how long have I used the solution?

I've been working with this security solution for ten years or so and Palo Alto Networks for two years.

What do I think about the stability of the solution?

The solution has been very stable and very reliable. There are no bugs or glitches. It doesn't crash or freeze. It's one of the best on the market.

What do I think about the scalability of the solution?

The solution is very scalable. It works well for companies that are quite sizeable. If an organization needs to expand it, it can do so easily.

We have about 50 to 55 users on the solution.

How are customer service and technical support?

I personally handle technical questions for those working with Palo Alto. 

Support of Palo Alto is English, however, I work in this local technical solution, local technical and I'm working with customers with a warranty.

I've found technical support from Palo Alto to be very good. We're local and we can assist as well, however, Palo Alto is capable of handling any size of issue and they are quite helpful.

How was the initial setup?

I am not directly handling the installation. My client is.

You do need a team of people on this solution that understand the cloud and the solution itself if you have a large, complex environment. If you have a robust security team, it's good. However, if you don't have the resources, it's not an ideal product. 

That said, if your company requires a small, simple setup, one person may be enough. It really depends on the size.

What about the implementation team?

My client is actually handling the installation. I often field questions from them, however, I don't participate in the installation directly.

What's my experience with pricing, setup cost, and licensing?

For basic needs, the solution isn't very expensive. However, as you grow more complex in your needs, the more you use, the more costly it can get.

The licensing is typically for one year. There's a one-time installation. If you would like to continue with the service, you can continue. There's no need to install and reinstall.

What other advice do I have?

Cortex XDR is a threat analytics security manager that allows users to see what threats are going to endpoints. It's a very high-security solution. 

The next step up from Cortex XDR is Cortex XSOAR. XSOAR is an automated threat solution. It's a security solution from Palo Alto. 

I'd recommend the solution to others. I'd rate it at a nine out of ten overall. 

Which deployment model are you using for this solution?

Public Cloud
Disclosure: My company has a business relationship with this vendor other than being a customer: Integrator
Flag as inappropriate
System Manager at a consumer goods company with 10,001+ employees
Real User
Top 5
This is a recommended solution for total end-to-end protection
Pros and Cons
  • "Being a cloud solution it is very flexible in serving internal and external connections and a broad range of devices."
  • "The connection to the internet has not performed as expected."

What is our primary use case?

We are still in the testing stages so there is not currently any primary use case beyond the base use of endpoint protection.  

What is most valuable?

Cortex has several good features that I am interested in. There is a nice Sandbox function that is very strong, there is the Traps (endpoint protection) solution, the real-time filtering of suspect linkages is good, and the automatic blocking of suspect behavior is always active and protecting the network.  

What needs improvement?

As an improvement, I would like to see enhanced connection speeds. On China's side, we need to set up a local server for the definition updates, and the performance has not been very good for the company when directly connected to the internet. We are a little disappointed with that.  

For how long have I used the solution?

We have been using Cortex XDR (Extended Detection and Response) for around two months.  

What do I think about the stability of the solution?

It is stable. From the moment we installed it has been up with no restarts of maintenance until now.  

What do I think about the scalability of the solution?

I think that this product is scalable. The testing environment we use right now has around 200 users. In the future, when we deploy it to the company we will move up to around 4,000 users.  

How are customer service and technical support?

The technical support is okay. They have already helped us to fix the installation and then we had an issue and they were available for correction of the problem. They also have made some useful suggestions. So the support team is okay in my estimation.  

Which solution did I use previously and why did I switch?

We have been exploring a similar solution. Right now I am also doing testing on Sentinel at the center. This is a similar solution. But we have only just begun testing Sentinel, so we do not really have enough experience with it to comment on the product.  

How was the initial setup?

As we just started with Cortex and we are using a cloud solution, I do not have the impression that it was difficult to install and begin using.  

What's my experience with pricing, setup cost, and licensing?

The setup costs are a bit higher than some other solutions. Overall it is a little bit expensive, I think. If we could get it for around a 10% discount then that would be a better price point for us.  

For our pricing plan, we are not on a subscription, so we do not have to pay every month. We have a yearly license for the product.  

The approximate amount we pay per license is around $80 per user per year.  

What other advice do I have?

My suggestion for people considering this product is that Cortex is a very good total solution on the endpoints. Because I needed Cortex to work for external and internal users and devices, it helps that it is cloud-based because it is good for working in the office or other locations. So we wanted to have the total end-to-end protection including on the mobile devices, that is what we got. This product will be a good suggestion for people who need the same capability.  

On a scale from one to ten where one is the worst and ten is the best, I would rate Cortex XDR as around nine-out-of-ten. The cost is the reason it would not be higher. Nine is good but this is a very good product except for the cost.  

Which deployment model are you using for this solution?

Public Cloud
Disclosure: I am a real user, and this review is based on my own experience and opinions.
Learn what your peers think about Cortex XDR by Palo Alto Networks. Get advice and tips from experienced pros sharing their opinions. Updated: January 2022.
563,208 professionals have used our research since 2012.
Lead Consultant at a tech services company with 1-10 employees
Real User
Top 5Leaderboard
Helpful support that can be reached quickly and easily, and the endpoint reporting is good
Pros and Cons
  • "The protection offered by this product is good, as is the endpoint reporting."
  • "Being able to filter the events to see those that are related to the actual alert would save time spent by the engineer."

What is our primary use case?

We are a solution provider and one of the Palo Alto products that we implement for our clients is Cortex XDR (Extended Detection and Response).

It is also known as Traps, and it is mostly used for endpoint protection. For example, when remote users want to connect to their organization using a VPN, they will be protected.

What is most valuable?

The protection offered by this product is good, as is the endpoint reporting.

Once installed, this product is easy to manage, whether it is on-premises or the cloud-based management system.

What needs improvement?

There are a lot of logs generated and an engineer has to go through all of the events to find out exactly what the bottleneck is. We do need to collect the events but this can be time-consuming. Being able to filter the events to see those that are related to the actual alert would save time spent by the engineer.

A better pricing plan would make this product more competitive.

For how long have I used the solution?

We have been dealing with Palo Alto, including Cortex XDR for more than three years.

What do I think about the stability of the solution?

This is a stable product and it is good, but we will keep evaluating other products as we continue to offer this type of solution to our customers.

What do I think about the scalability of the solution?

Cortex XDR is a scalable solution.

How are customer service and technical support?

The technical support team is good, and we can reach them quickly and easily. However, finding a resolution might take time.

Which solution did I use previously and why did I switch?

We have used Cylance in the past, although we stopped using it about three years ago.

We are currently using K7 Endpoint Protection. Unfortunately, it is not catching anything, whether it is malware or a virus.

How was the initial setup?

When we first implemented this product, it was called Traps. However, I don't see any difference, other than the name. For new customers, it might be a bit difficult to install and set up. It takes perhaps eight hours to install.

What about the implementation team?

I deployed this product, and I was also involved with the initial POC.

Only one admin is needed for deployment and a second person should be available to work with the users.

What's my experience with pricing, setup cost, and licensing?

This is an expensive solution.

Which other solutions did I evaluate?

We are currently trying to evaluate ELK.

What other advice do I have?

Overall, this is a good product and I can recommend it to others.

I would rate this solution an eight out of ten.

Disclosure: My company has a business relationship with this vendor other than being a customer: Partner
Mayur Jadhav
Senior Security Consultant at a tech services company with 201-500 employees
Real User
Top 5
Automated, with well defined policies, but privacy is a concern
Pros and Cons
  • "The most valuable feature is that you can select remote access of any machine for sandboxing."
  • "Data privacy is a matter of concern. You have to be careful with data privacy, it can be sensitive and Cortex can have most of your access."

What is our primary use case?

We use this solution specifically in endpoint response, endpoint detection, endpoint sandboxing, and as a firewall.

How has it helped my organization?

The product is mostly automated, and we do not have to make decisions. All the decisions are made by the product itself. 

We are not required to create any custom policies. 

The policies that are created are well defined in the product itself.

What is most valuable?

The most valuable feature is that you can select remote access of any machine for sandboxing.

Irrespective of whether you have the rights or not, you can still access it from the cloud.

What needs improvement?

I would like to see some sort of attachment scanning included.

Data privacy is a matter of concern. You have to be careful with data privacy, it can be sensitive and Cortex can have most of your access.

I want a plugin for email attachment scanning and email body scanning.

For how long have I used the solution?

I have been using this solution for two years.

We are using version seven.

What do I think about the scalability of the solution?

Scalability is not a problem with this solution.

It's a cloud setup. You can scale in and you can scale out as per the cloud.

We have close to 500 users in our company.

How are customer service and technical support?

Technical support is very good, but it can be a problem, especially in the Gulf region.

If you do not take direct support, you have to wait for 72 hours. 

Also, direct support is a little bit costly.

Which solution did I use previously and why did I switch?

We used McAfee previously. We switched because the solution is pretty automated. You don't have to manually decide on the policy.

How was the initial setup?

The initial setup is pretty straightforward.

In one hour, you can deploy the entire setup and get started.

After the setup, deployment can take up to three to four days.

We had one admin test the solution and maintain it for us.

What about the implementation team?

We did not use an integrator or vendor team. 

What's my experience with pricing, setup cost, and licensing?

The pricing is okay, although direct support can be expensive.

What other advice do I have?

It is a very straightforward product with minimum administer interference, once it is deployed.

I would rate this solution a seven out of ten.

Which deployment model are you using for this solution?

Public Cloud
Disclosure: My company has a business relationship with this vendor other than being a customer: Partner
Gian Michele Roletto
SOC Manager at Nais Srl
Real User
Top 5Leaderboard
Good dashboard, and is easy to use, but is not very informative, or complete
Pros and Cons
  • "The information the dashboard provides is very clear."
  • "When it comes to core analysis, and security analysis, Cortex needs to provide more information."

What is our primary use case?

I am an integrator. I deploy and implement solutions for our customers.

What is most valuable?

It is a simple platform to use.

The dashboard is good, it's very clean and very simple to read. The information the dashboard provides is very clear.

What needs improvement?

This solution is not complete enough to help us. We use a different platform that provides us with more information.

In my opinion, it is not a very complete program. I prefer to work with Carbon Black. It's a better solution as well as Cynet. For example, I use Cynet when I check installations, which provides me with more information. It is not easy to use for beginners, but it provides me with more information, which is lacking in Cortex. When it comes to core analysis, and security analysis, Cortex needs to provide more information. Cynet is a complete platform in my opinion.

We are ready to use a new solution called Deep Instinct. It's a new concept of the security platform. It's a very new company from the USA.

I would like to see a feature that allows you to check the endpoints included. I am currently having trouble checking the endpoints when using Cortex. Including this feature would benefit the platform's endpoints.

What do I think about the stability of the solution?

Cortex XDR by Palo Alto Networks is absolutely stable.

What do I think about the scalability of the solution?

Cortex XDR by Palo Alto Networks is a scalable platform.

Which solution did I use previously and why did I switch?

I am currently using QRadar in more than one enterprise, as well as Cynet, and Darktrace. We also use all of the Microsoft platforms with QRadar.

I have a team working on this solution. So I assisted a customer in deploying and implementing this solution. My colleague and I have formed a team. I am a SOC manager, my new role is that of a SOC manager. I don't use it directly, but I try to assist my colleague in working with more enterprises or customers. We have, I believe, five or six different IBM QRadar platforms.

We use several solutions and they are all good, but each one is different.

Cynet is a good platform, but helpful for my team because it is not simple to understand.

What other advice do I have?

I would rate Cortex XDR by Palo Alto Networks a seven out of ten.

Disclosure: My company has a business relationship with this vendor other than being a customer: Integrator
Flag as inappropriate
Olivier Regal
Account Manager at Securelink NV
Real User
Top 20
Easy to use with excellent root cause analysis and interesting pricing
Pros and Cons
  • "I've found the solution to be highly scalable for enterprises."
  • "It's not an ideal choice for smaller businesses, as you need a minimum of 200 endpoints to even use the solution at all."

What is our primary use case?

It can work as a standalone solution, however, it also fully integrates with the firewall. It operates on an endpoint level and on firewall level. It's endpoint security, so there are not 35 use cases. It's pretty specific.

What is most valuable?

Overall, it's a great platform. It integrates very well with other solutions from Palo Alto and also with our vendors. 

The ease of use is excellent. 

I love the root cause analysis from Cortex, which is amazing. It's really fantastic. In a few clicks, you can just have the full root cause. 

The price is quite interesting. It's not overly expensive.

The solution is stable. 

I've found the solution to be highly scalable for enterprises. 

What needs improvement?

What would be interesting, is if it could also read IoT protocols. If they can improve on the IoT part that would be great. In general, in this area, they can still improve.

It's not an ideal choice for smaller businesses, as you need a minimum of 200 endpoints to even use the solution at all. 

For how long have I used the solution?

The solution is quite new. I've been using it for approximately the last two years. It hasn't been that long just yet. 

What do I think about the stability of the solution?

There are no performance issues. It's really very stable. I haven't dealt with bugs or glitches. It doesn't crash or freeze. It's reliable. 

What do I think about the scalability of the solution?

The product is absolutely scalable. It's an enterprise solution. However, one less positive thing about it, is that it's only from 200 users, from 200 endpoints. That's bad. What do you do with clients who have only 100 endpoints? They cannot purchase Cortex. That has to be improved, with high priority. Palo Alto is aware of that.

What's my experience with pricing, setup cost, and licensing?

The pricing is quite good. It's interesting. It's not a particularly expensive option. 

What other advice do I have?

We are using the Cortex Pro version of the solution. 

I'd advise users to do a proof of concept (POC) and try it out. It's amazing. 

I'd rate the solution at a nine out of ten. It's one of the top solutions on the market. We've been very happy with it so far.

Disclosure: My company has a business relationship with this vendor other than being a customer: Partner
Flag as inappropriate
Mantu Shaw
Sr. Technology Architect at Incedo Inc.
Real User
Top 5Leaderboard
A stable part of our security solution that correlates logs from relevant sources
Pros and Cons
  • "The most valuable for us is the correlation feature."
  • "There are some third-party solutions that are difficult to integrate with, which is something that can be improved."

What is our primary use case?

We use Cortex XDR as part of our security solution.

How has it helped my organization?

its a very good solution and single solution for entire infrastructure, give us good co-relation of incident. Single solution for Network, Endpoint, Servers. 

What is most valuable?

The most valuable for us is the correlation feature. You are able to correlate data that is coming from the firewall, network, server, and endpoints. This is one of our main requirements and makes for a good product.

It works with the data lake in an agent-based or agentless manner.

It is easy to integrate most with network devices, including firewalls, and Active Directory. We use firewalls from different vendors including Palo Alto and Check Point, and it supports them.

What needs improvement?

There are some third-party solutions that are difficult to integrate with, which is something that can be improved.

What do I think about the stability of the solution?

We have not experienced any issues with respect to stability at this point.

What do I think about the scalability of the solution?

Scalability has not been a problem.

How are customer service and support?

We have been in contact with technical support and are satisfied with them.

How would you rate customer service and support?

Positive

How was the initial setup?

its a Straightforward

What about the implementation team?

We have an in-house team for deployment and maintenance.

What was our ROI?

It replace multiple solution and due to this it will reduce the Administrative effort.

Which other solutions did I evaluate?

I have run a PoC with both CrowdStrike and Cortex XDR, and from my observation, I felt that Cortex was much better at meeting our requirements. It is also easier to use.

CrowdStrike was difficult when it came to integrating with other products and it does not work on mobile devices.

What other advice do I have?

My advice for anybody who is considering Cortex XDR is that it is a complete solution, and has very good features. From my experience, it is one of the better ones in the market. That said, no product is 100%.

I would rate this solution a nine out of ten.

Which deployment model are you using for this solution?

Public Cloud

If public cloud, private cloud, or hybrid cloud, which cloud provider do you use?

Disclosure: I am a real user, and this review is based on my own experience and opinions.
Flag as inappropriate
Network and Cybersecurity Consultant at a tech services company with 11-50 employees
Reseller
Top 5
A stable detection and response app with a good policy management feature
Pros and Cons
  • "Stability is a primary factor, and then there's the ease of distribution and policy management."
  • "It would be good to have a better way to search for a file within the UI."

What is our primary use case?

We're primarily a Palo Alto shop, and we integrate solutions in the Palo Alto ecosystem. But for firewalls and threat hunting, it's all through Cortex XDR. We also compliment the Cortex XDR product with other endpoint protection solutions, like Windows Defender, or whatever the customer is using,

What is most valuable?

Stability is a primary factor, and then there's the ease of distribution and policy management. Cortex XDR by Palo Alto Networks is very easy to work with, and we're quite happy with them.

What needs improvement?

It would be good to have a better way to search for a file within the UI. Like in SentinelOne, you can search for an arbitrary file, and in Cortex XDR, you can't. You can do it with an addendum license, but I think we could all benefit from getting it with the standard license. Because if you want to do threat hunting with this product, you have to search for files now and not wait to get a license.

For how long have I used the solution?

I've been using Cortex XDR by Palo Alto Networks for about two years.

What do I think about the stability of the solution?

Cortex XDR by Palo Alto Networks is a stable solution.

How are customer service and technical support?

We used to talk to Palo Alto support extensively, and we always had a pleasant experience and never had a problem with them.

How was the initial setup?

Cortex XDR is quite easy to install. The time it takes to deploy depends on the infrastructure. We have had cases that lasted a few days and other cases where it took two to four months for a proof of concept.

What's my experience with pricing, setup cost, and licensing?

Every customer has to pay for a license because it doesn't work with what you get from a managed services provider. It's quite expensive, and they can't sell it for less than 200 euros a license. It's the lowest license price we can get from them.

What other advice do I have?

I would recommend Cortex XDR by Palo Alto Networks to potential users.

On a scale from one to ten, I would give Cortex XDR by Palo Alto Networks a nine.

Which deployment model are you using for this solution?

Public Cloud
Disclosure: My company has a business relationship with this vendor other than being a customer: Integrator
Buyer's Guide
Download our free Cortex XDR by Palo Alto Networks Report and get advice and tips from experienced pros sharing their opinions.