The industry’s most comprehensive security orchestration marketplace

Discover. Automate. Transform.

Accelerate Your Security Automation

Cortex XSOAR Marketplace is the premier digital storefront for discovering, exchanging, and contributing security automation playbooks, built into Cortex™ XSOAR. Solve any security use case and scale your use of SOAR with turnkey content contributed by SecOps experts and the world’s largest security orchestration, automation, and response (SOAR) partner community.

Download the solution overview

Check out the largest SOAR community in the world
Check out the largest SOAR community in the world

680+ prebuilt content packs
700+ product integrations

For a list of available integrations and featured content packs, check out our SOAR Ecosystem.

Deploy elegant automation solutions in a matter of clicks

Cortex XSOAR content packs are prebuilt bundles of integrations, playbooks, dashboards, fields, subscription services and all the dependencies needed to support specific security orchestration use cases (see Figure 1).

Subscription Services

Content service offerings

Dashboard Layouts

Curated dashboard views of specific data sets that support key security use cases, playbooks, and integrations

Automation Scripts

Prebuilt integrations with leading security products and technology vendors

Orchestration Playbooks

Prebuilt automated orchestration playbooks for simplified security investigation and response

Technology Integrations

Prebuilt actions that preform functions across the platform and the ecosystem of technology integrations
Figure 1: Content pack components (content packs include one or more of these content types)
  • Deploy packs with a single click to simplify and speed up the adoption of automation.
  • Cortex XSOAR is the only SOAR platform that verifies all free and paid third-party content in the marketplace to be safe for immediate use.
  • Want to learn more about Cortex XSOAR Marketplace?

Featured packs of the month

Each month, we feature two content packs and walk you through how you can use them to improve your security operations. See all of our different packs.

Join our monthly webinar to learn from expert presenters, see demos, and engage in a live Q&A. Our September webinar features Code42 and IRONSCALES. Reserve your spot today!


The Code42 Incydr pack with XSOAR provides the right level of insider risk context and accurate alert prioritization with optimal automation to speed the time it takes to remediate. This content pack is available in the XSOAR Marketplace!


To provide immediate understanding of threats attempting to infiltrate your environment, IRONSCALES has integrated with Cortex XSOAR. Leverage their powerful AI driven platform to continuously detect and remediate email incidents in your system. This content pack is available in the XSOAR Marketplace!

slack community

Join our DFIR Community

Join more than 20,000 incident responders on Slack® to discuss forensics tools, incident response best practices and playbooks.

Featured Blogs

From the blog

Escalate Defensive Cyberspace Operations with Cortex XSOAR

Learn how Cyber operators within agencies can accelerate the execution of DCO using Cortex XSOAR.

Read the blog
From the blog

Code42 Incydr + Cortex XSOAR: Right-Sizing Insider Risk Response

Together, Code42 Incydr and Palo Alto Networks Cortex XSOAR provide solutions that deliver the full capabilities of Code42’s response methodology.

Read the blog
From the blog

Automate Email IR with IRONSCALES Self Learning Threat Intel and Cortex XSOAR

To better protect your organization from phishing attempts and other email borne threats, check out the new IRONSCALES content pack for Cortex XSOAR.

Read the blog