SECURITY ATLAS / EVALUATION BRIEF Cortex XSOAR and XSIAM Research reviewed: 2026-10-18 https://atlasofsecurity.com/landscape/vendors/palo-alto-cortex-orchestration/ THE ATLAS TAKE Cortex XSOAR and XSIAM both include automation, but they are not interchangeable purchases. XSOAR emphasizes orchestrated investigation and response across tools; XSIAM is a broader security-operations platform with analytics and automation. Atlas analysis: decide whether the job is adding a response layer to an existing stack or changing the SOC foundation. That decision affects telemetry migration, incident ownership, and implementation effort. Evaluate the same bounded response workflow in the proposed product and keep marketplace content, connector access, and actual response authority separate from the broader platform story. SCOPE These are two licensed software products, not one SKU. The buyer staffs playbooks and owns credentials. XSIAM automation is not a staffed MDR service, and Unit 42 MDR is sold separately. WORTH A LOOK WHEN SOCs choosing either a dedicated cross-tool response layer or a deliberate migration toward a broader Cortex operations platform. THINK TWICE WHEN The proposal treats XSOAR and XSIAM as equivalent bundles or assumes a prebuilt playbook can act without integration credentials. IMPLEMENTATION 1. Freeze the platform decision Record retained SIEM tools, migrated telemetry, incident ownership, and purchased modules. 2. Build one narrow workflow Start from a known alert and use read-only enrichment before a reversible lab action. 3. Govern automation changes Assign owners, separate test credentials, and require evidence for failure handling and promotion. OPERATING REALITY Integration instances, content-pack updates, incident mappings, and playbook permissions need ongoing ownership. Atlas analysis: automation engineering remains a production responsibility. Start with enrichment and analyst-approved actions, then test retries, partial failure, and rollback before allowing a workflow to change endpoint, identity, or network state. COMMERCIAL CONSIDERATIONS Compare the full architecture and purchased products, including telemetry, deployment, integration services, and ongoing content maintenance. - XSOAR versus XSIAM product scope - Telemetry and integration deployment requirements - Playbook engineering and content maintenance EVALUATION PLAN / PROPOSED TESTS, NOT COMPLETED RESULTS 1. Trace one delegated action Acceptance evidence: Retain the trigger, integration identity, target, approval, and resulting state. Owner: __________ Pass criterion: __________ Observed result: __________ Evidence location: __________ 2. Test partial failure Acceptance evidence: Fail one lab enrichment or response dependency and inspect case status and retries. Owner: __________ Pass criterion: __________ Observed result: __________ Evidence location: __________ 3. Validate product boundaries Acceptance evidence: Demonstrate the workflow in the quoted product without relying on an unpurchased adjacent module. Owner: __________ Pass criterion: __________ Observed result: __________ Evidence location: __________ QUESTIONS FOR THE VENDOR - Which product owns cases when detections already live in other tools? - Who on the buyer staff maintains playbooks after professional services leave? - How do playbooks hand off to Unit 42 or a retainer when an incident exceeds automation? EVIDENCE GAPS - No independent automation reliability or staffing-savings measurement was performed. - Exact product entitlement and content-pack compatibility require deployment-specific confirmation. SOURCES Cortex XSOAR scope (Product information) https://www.paloaltonetworks.com/cortex/cortex-xsoar Cortex XSIAM scope (Product information) https://www.paloaltonetworks.com/cortex/cortex-xsiam Automation in Cortex XSIAM (Documentation) https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/automations/automation-in-cortex-xsiam Use synthetic fixtures in an authorized environment. Agree rollback and acceptance criteria before enforcement. Documentation research and Atlas analysis. Independent hands-on effectiveness, effort, and complete price remain unassessed.