[](https://www.paloaltonetworks.com/cortex?ts=markdown)  [](https://www.paloaltonetworks.com/cortex?ts=markdown) 
* [](https://www.paloaltonetworks.com/cortex?ts=markdown)
* [Industry Validation](https://www.paloaltonetworks.com/cortex/whycortex?ts=markdown)
* Products
 Products
Products
* [AI-Driven SOC](https://www.paloaltonetworks.com/cortex?ts=markdown)
* [Cortex XSIAM](https://www.paloaltonetworks.com/cortex/cortex-xsiam?ts=markdown)
* [Cortex XDR](https://www.paloaltonetworks.com/cortex/cortex-xdr?ts=markdown)
* [Cortex AgentiX](https://www.paloaltonetworks.com/cortex/agentix?ts=markdown)
* [Cortex XSOAR](https://www.paloaltonetworks.com/cortex/cortex-xsoar?ts=markdown)
* [Cortex Exposure Management](https://www.paloaltonetworks.com/cortex/exposure-management?ts=markdown)
* [Cortex Xpanse](https://www.paloaltonetworks.com/cortex/cortex-xpanse?ts=markdown)
* [Cortex Advanced Email Security](https://www.paloaltonetworks.com/cortex/advanced-email-security?ts=markdown)
* [Managed Detection \& Response](https://www.paloaltonetworks.com/cortex/managed-detection-and-response?ts=markdown)
* [Managed XSIAM](https://www.paloaltonetworks.com/cortex/managed-xsiam?ts=markdown)
* [Cloud Security](https://www.paloaltonetworks.com/cortex/cloud?ts=markdown)
* [Cortex Cloud](https://www.paloaltonetworks.com/cortex/cloud?ts=markdown)
* [Application Security](https://www.paloaltonetworks.com/cortex/cloud/application-security?ts=markdown)
* [Cloud Posture Security](https://www.paloaltonetworks.com/cortex/cloud/cloud-posture-security?ts=markdown)
* [Cloud Runtime Security](https://www.paloaltonetworks.com/cortex/cloud/runtime-security?ts=markdown)
[
The Forrester Total Economic Impact^™^ of Cortex XSIAM
257% 3-year ROI and \<6-month payback for SOC transformation.
Get the facts](https://start.paloaltonetworks.com/forrester-total-economic-impact-xsiam)
* Solutions
 Solutions
[Threat Prevention, Detection \& Response](https://www.paloaltonetworks.com/cortex/detection-and-response?ts=markdown)
* [Cloud Detection and Response](https://www.paloaltonetworks.com/cortex/cloud-detection-and-response?ts=markdown)
* [Security Information and Event Management](https://www.paloaltonetworks.com/cortex/modernize-siem?ts=markdown)
* [Endpoint Protection](https://www.paloaltonetworks.com/cortex/endpoint-protection?ts=markdown)
* [Endpoint Detection and Response](https://www.paloaltonetworks.com/cortex/endpoint-detection-and-response?ts=markdown)
* [Extended Detection \& Response](https://www.paloaltonetworks.com/cortex/detection-and-response?ts=markdown)
* [Managed Detection \& Response](https://www.paloaltonetworks.com/cortex/managed-detection-and-response?ts=markdown)
* [Managed Threat Hunting](https://www.paloaltonetworks.com/cortex/managed-threat-hunting?ts=markdown)
* [Ransomware Protection](https://www.paloaltonetworks.com/cortex/ransomware-protection?ts=markdown)
* [Digital Forensics](https://www.paloaltonetworks.com/cortex/digital-forensics?ts=markdown)
[Security Automation](https://www.paloaltonetworks.com/cortex/security-operations-automation?ts=markdown)
* [Network Security Automation](https://www.paloaltonetworks.com/cortex/network-security-automation?ts=markdown)
* [Incident Case Management](https://www.paloaltonetworks.com/cortex/incident-case-management?ts=markdown)
* [Security Operations Workflow Automation](https://www.paloaltonetworks.com/cortex/security-operations-automation?ts=markdown)
* [Threat Intel Management](https://www.paloaltonetworks.com/cortex/threat-intel-management?ts=markdown)
* [Extended Data Lake (XDL)](https://www.paloaltonetworks.com/cortex/cortex-xdl?ts=markdown)
* [Agentic Assistant](https://www.paloaltonetworks.com/cortex/cortex-agentic-assistant?ts=markdown)
[External Attack Surface Protection](https://www.paloaltonetworks.com/cortex/cortex-xpanse/attack-surface-management?ts=markdown)
* [Attack Surface Management](https://www.paloaltonetworks.com/cortex/cortex-xpanse/attack-surface-management?ts=markdown)
* [Unmanaged Cloud Security](https://www.paloaltonetworks.com/cortex/cortex-xpanse/unmanaged-cloud-asset-management?ts=markdown)
* [Third-Party Security](https://www.paloaltonetworks.com/cortex/cortex-xpanse/attack-surface-management-for-third-party-and-supply-chain-security?ts=markdown)
* [Compliance Management](https://www.paloaltonetworks.com/cortex/cortex-xpanse/compliance-management?ts=markdown)
* [Internet Operations Management](https://www.paloaltonetworks.com/cortex/cortex-xpanse/internet-operations-management?ts=markdown)
* [Remote Network Security](https://www.paloaltonetworks.com/cortex/cortex-xpanse/asm-for-remote-workers?ts=markdown)
[Cloud Security](https://www.paloaltonetworks.com/cortex/cloud?ts=markdown)
* [Application Security](https://www.paloaltonetworks.com/cortex/cloud/application-security?ts=markdown)
* [Cloud Runtime Security](https://www.paloaltonetworks.com/cortex/cloud/runtime-security?ts=markdown)
* [Cloud Posture Security](https://www.paloaltonetworks.com/cortex/cloud/cloud-posture-security?ts=markdown)
[
Tested. Reviewed. Proven
See Industry Validation](https://www.paloaltonetworks.com/cortex/cortex-xdr-industry-validation?ts=markdown)
* [Blog](https://www.paloaltonetworks.com/blog/security-operations/?ts=markdown)
* Resources
 Resources
Resources
* [White Papers](https://www.paloaltonetworks.com/resources?q=cortex&_charset_=UTF-8&fq=RC_TYPE_DFACET%3Apan%253Aresource-center%252Frc-type%252Fwhitepaper&ts=markdown)
* [Cortex Partners](https://cortex.marketplace.pan.dev/marketplace/)
* [Customer Stories](https://www.paloaltonetworks.com/cortex/customer-stories?ts=markdown)
* [Cortex vs. The Competition](https://www.paloaltonetworks.com/cortex/cortex-vs-the-competition?ts=markdown)
* [Cortex XSOAR Marketplace](https://xsoar.pan.dev/marketplace)
* [Events](https://www.paloaltonetworks.com/resources/cortex-events?ts=markdown)
* [Datasheets](https://www.paloaltonetworks.com/resources?q=Cortex&_charset_=UTF-8&fq=RC_TYPE_DFACET%3Apan%253Aresource-center%252Frc-type%252Fdatasheet&ts=markdown)
* [Research Reports](https://www.paloaltonetworks.com/resources?q=cortex&_charset_=UTF-8&fq=RC_TYPE_DFACET%3Apan%253Aresource-center%252Frc-type%252Fresearch&ts=markdown)
* [Videos](https://www.paloaltonetworks.com/resources?q=cortex&_charset_=UTF-8&fq=RC_TYPE_DFACET%3Apan%253Aresource-center%252Frc-type%252Fvideo&ts=markdown)
* [Cortex XDR Resource Center](https://www.paloaltonetworks.com/cortex/cortex-xdr-resource-center?ts=markdown)
[
DIGITAL ASSET
THE CORTEX PLATFORM](https://www.paloaltonetworks.com/resources/infographics/soc-transformation-infographic?ts=markdown)
[
WHITEPAPER
Cortex XSIAM Solution Brief](https://www.paloaltonetworks.com/resources/techbriefs/cortex-xsiam?ts=markdown)
[
REPORT
Unlock customized recommendations for transforming your SecOps.](https://www.paloaltonetworks.com/cortex/secops-readiness-report?ts=markdown)
* Get In Touch
 Get In Touch
Get in Touch
* [Request a Demo](https://www.paloaltonetworks.com/cortex/request-demo?ts=markdown)
* [Contact us](https://www.paloaltonetworks.com/company/contact-sales?ts=markdown)
* [Attend a Workshop](https://www.paloaltonetworks.com/cortex/cortex-xdr/hands-on-workshop?ts=markdown)
* [Find a Partner](https://technologypartners.paloaltonetworks.com/English/directory)
* [Join our Community](https://live.paloaltonetworks.com/)
[
SecOps analyst: A day in the life.
Start product tour](https://www.paloaltonetworks.com/resources/infographics/xsoar-product-tour?ts=markdown)
*
* [Request a Demo](https://www.paloaltonetworks.com/cortex/request-demo?ts=markdown)
 
[](https://www.paloaltonetworks.com/cortex?ts=markdown)
Search
All
* [Tech Docs]()
Close search modal
*** ** * ** ***
## Palo Alto Networks: \#1 in SOC Automation
#### Cortex XSOAR^®^ ranked Overall Leader in SOAR by KuppingerCole.
* [See the analysis](https://start.paloaltonetworks.com/kuppingercole-soar-report.html)
**cortex****cortex****cortex\*\*\*\*cortex**
WEBINAR SERIES"\>
## *WEBINAR SERIES*
*CORTEX*
*Introducing Cortex AgentiX:
Meet Your AI Agent Workforce*
*Episode 1*
* [Watch now](https://www.paloaltonetworks.com/engage/cortex-forward-webinar-series/introducing-cortex-agentix)
**cortex****cortex****cortex\*\*\*\*cortex**
A day in the life."\>
SecOps analyst:
A day in the life.
---
#### See intelligent automation
at work with Cortex XSOAR^®^
* [Start product tour](https://www.paloaltonetworks.com/resources/infographics/xsoar-product-tour?ts=markdown)
**cortex****cortex****cortex\*\*\*\*cortex**
above the rest."\>
SOARing
above the rest.
---
#### SANS independent review: Cortex XSOAR^®^ capabilities.
* [Learn more](https://start.paloaltonetworks.com/cortex-xsoar-sans-review)
**cortex****cortex****cortex\*\*\*\*cortex**
PrevNext
{#why} WHY IT MATTERS
#### While network security has evolved and adapted to new threats and technologies over the past decade, security operations remain challenged by the lack of automation and visibility across siloed teams working the same incidents.
*
### Team silos
Managing network security incidents can be a time sink as it often involves end users, ITOps, network security operations, SOCs and other stakeholders.
\*
### Manual processes
Manual processes still rule for managing change processes for firewalls, making it a challenge to scale and enforce compliance.
\*
### Network complexity
Increasingly complex hybrid environments make it difficult to ensure your IT, OT and cloud enforcement points are up to date on the latest indicators and signatures.
## Security Automation for Everyone: Best-in-Class Automation for Security Teams of Any Size
[Learn more](https://www.paloaltonetworks.com/engage/security-orchestration-automation-response)
The CORTEX XSOAR Solution
## Streamline and speed network security response
Cortex XSOAR automated playbooks orchestrate incident response actions across the network security stack and other security tools, streamlining operations and facilitating collaboration across teams.
* Less repetitive work, more time to focus on critical issues
* Get increased visibility into the threat landscape
* Optimize the advanced capabilities of next-generation firewalls
* 
Workflow automation
* 
Incident case management
* 
Strata product integrations
* 
700+ third-party integrations
* 
Threat intel management
*** ** * ** ***
## Our approach to network security automation
### Ensure your enforcement points are instantly updated to the latest threat signatures, indicators and allowed domains.
Cortex XSOAR automated playbooks can help prioritize, deduplicate, check for coverage and distribute the latest malicious indicators to dozens of network devices simultaneously. Conversely, dynamic web services domain lists can be automatically updated to ensure business continuity.
*
#### Automate deny/allow list administration
Indicators are normalized, scored and prioritized for automated updates of firewall EDLs. Allow lists are updated with each new web services feed.
\*
#### Checks CVE coverage at scale
Automatically checks PAN-OS devices to determine coverage for critical CVEs and if the appropriate defenses are in place.
[Browse Marketplace content packs](https://xsoar.pan.dev/marketplace)
[](#prismastickyimagecom_prisma-custom-background_prismacustombackgrou_1130711440_cleanParsys_network-security-automation_cortex_en_US_pan_content_)
*** ** * ** ***
### Encourage network security incident response best practices
Facilitate collaboration between IR and NetSecOps teams, and encourage network security teams to leverage policy best practices features of next-generation firewalls.
*
#### PAN-OS BPA + XSOAR
Triggers BPA (Best Practice Assessment) across firewalls and collect results in a structured report that can be used to drive custom response playbooks.
\*
#### NetOps and SOC Collaboration for IR with XSOAR
Automate validation of indicators requested for blocking by SOC and IR teams. Streamline approvals. And rapidly block malicious IPs, URLs and Domains without requiring a commit on the firewall.
[!\[Network Incident Response\](https://www.paloaltonetworks.com/content/dam/pan/en\_US/images/cortex/redesign/network-security-auto/nsa-incident response.png)](#prismastickyimagecom_414334980_prisma-custom-background_prismacustombackgrou_1130711440_cleanParsys_network-security-automation_cortex_en_US_pan_content_)
*** ** * ** ***
### Automate workflow processes across your Strata deployments
Cortex XSOAR integrates with Strata network security solutions to automate and scale incident triage for faster response to attacks. Security teams get better visibility and control over incidents happening across their network.
*
#### IoT Security + XSOAR
Automate IoT security incident triage and business owner communications to resolve incidents
\*
#### CN-Series + XSOAR
We combine the native automation in Kubernetes with the integration of Cortex XSOAR and PAN-OS. This helps customers completely automate security for applications deployed in Kubernetes.
\*
#### Prisma Access + XSOAR
Automate triage of alerts for remote connectivity and user activity. Manage egress IP addresses and populate allow lists within third-party services such as AWS, Google Cloud and Okta.
[](#prismastickyimagecom_2038177655_prisma-custom-background_prismacustombackgrou_1130711440_cleanParsys_network-security-automation_cortex_en_US_pan_content_)
*** ** * ** ***
## A single platform for end-to-end incident lifecycle management
Cortex XSOAR integrates with 700+ products and services to provide playbook-driven responses that span across teams, products and use cases. This response automation is tightly integrated with Cortex XSOAR's fully customizable case management, enabling security teams to retain control over incidents while improving response times and operational efficiency.
*** ** * ** ***
### Use Case Example: Self-Service Access to Blocked Web Services
Ease network security team workload by empowering end user self-service for common requests. For example, a request to access a blocked website will trigger a playbook to extract user information and perform URL reputation lookup. It will then present incident details to the security engineer for approval. Once approved, the playbook performs steps to allow access and close the ticket.
[](#prismastickyimagecom_850282163_prisma-custom-background_prismacustombackgrou_1130711440_cleanParsys_network-security-automation_cortex_en_US_pan_content_)
*** ** * ** ***
## How Cortex XSOAR Deploys
CORTEX XSOAR
* Customer on-premises server
* Customer virtual/cloud
* Cortex XSOAR hosted service
* Cortex XSOAR Marketplace
[Hosted service](https://www.paloaltonetworks.com/resources/datasheets/cortex-xsoar-hosted-solution-datasheet?ts=markdown)
## Featured Resources
[See all documents](https://www.paloaltonetworks.com/resources?q=soar&_charset_=UTF-8&ts=markdown)
Report
### Palo Alto Networks: \#1 in SOC Automation
[See the analysis](https://start.paloaltonetworks.com/kuppingercole-soar-report.html)
WHITE PAPER
### State of SOAR report
[Read more](https://start.paloaltonetworks.com/the-2019-state-of-soar-report.html)
WHITE PAPER
### Transforming Threat Intel Management with SOAR
[Read more](https://start.paloaltonetworks.com/xsoar-threat-intel.html)
BLOG
### CN-Series and Cortex XSOAR
[Read blog](https://www.paloaltonetworks.com/blog/security-operations/automation-for-kubernetes/?ts=markdown)
VIDEO
### Prisma Access and Cortex XSOAR
[Watch](https://www.paloaltonetworks.com/resources/webcasts/cortex-xsoar-and-prisma-access-integration?ts=markdown)
ON-DEMAND WEBINAR
### Best Practices for Automating IoT Security
[Watch](https://register.paloaltonetworks.com/bpforautomatingiotsecurity)
PrevNext
[See all documents](https://www.paloaltonetworks.com/resources?q=soar&_charset_=UTF-8&ts=markdown)
{#footer}
## Products and Services
* [AI-Powered Network Security Platform](https://www.paloaltonetworks.com/network-security?ts=markdown)
* [Secure AI by Design](https://www.paloaltonetworks.com/precision-ai-security/secure-ai-by-design?ts=markdown)
* [Prisma AIRS](https://www.paloaltonetworks.com/prisma/prisma-ai-runtime-security?ts=markdown)
* [AI Access Security](https://www.paloaltonetworks.com/sase/ai-access-security?ts=markdown)
* [Cloud Delivered Security Services](https://www.paloaltonetworks.com/network-security/security-subscriptions?ts=markdown)
* [Advanced Threat Prevention](https://www.paloaltonetworks.com/network-security/advanced-threat-prevention?ts=markdown)
* [Advanced URL Filtering](https://www.paloaltonetworks.com/network-security/advanced-url-filtering?ts=markdown)
* [Advanced WildFire](https://www.paloaltonetworks.com/network-security/advanced-wildfire?ts=markdown)
* [Advanced DNS Security](https://www.paloaltonetworks.com/network-security/advanced-dns-security?ts=markdown)
* [Enterprise Data Loss Prevention](https://www.paloaltonetworks.com/sase/enterprise-data-loss-prevention?ts=markdown)
* [Enterprise IoT Security](https://www.paloaltonetworks.com/network-security/enterprise-device-security?ts=markdown)
* [Medical IoT Security](https://www.paloaltonetworks.com/network-security/medical-device-security?ts=markdown)
* [Industrial OT Security](https://www.paloaltonetworks.com/network-security/medical-device-security?ts=markdown)
* [SaaS Security](https://www.paloaltonetworks.com/sase/saas-security?ts=markdown)
* [Next-Generation Firewalls](https://www.paloaltonetworks.com/network-security/next-generation-firewall?ts=markdown)
* [Hardware Firewalls](https://www.paloaltonetworks.com/network-security/hardware-firewall-innovations?ts=markdown)
* [Software Firewalls](https://www.paloaltonetworks.com/network-security/software-firewalls?ts=markdown)
* [Strata Cloud Manager](https://www.paloaltonetworks.com/network-security/strata-cloud-manager?ts=markdown)
* [SD-WAN for NGFW](https://www.paloaltonetworks.com/network-security/sd-wan-subscription?ts=markdown)
* [PAN-OS](https://www.paloaltonetworks.com/network-security/pan-os?ts=markdown)
* [Panorama](https://www.paloaltonetworks.com/network-security/panorama?ts=markdown)
* [Secure Access Service Edge](https://www.paloaltonetworks.com/sase?ts=markdown)
* [Prisma SASE](https://www.paloaltonetworks.com/sase?ts=markdown)
* [Application Acceleration](https://www.paloaltonetworks.com/sase/app-acceleration?ts=markdown)
* [Autonomous Digital Experience Management](https://www.paloaltonetworks.com/sase/adem?ts=markdown)
* [Enterprise DLP](https://www.paloaltonetworks.com/sase/enterprise-data-loss-prevention?ts=markdown)
* [Prisma Access](https://www.paloaltonetworks.com/sase/access?ts=markdown)
* [Prisma Browser](https://www.paloaltonetworks.com/sase/prisma-browser?ts=markdown)
* [Prisma SD-WAN](https://www.paloaltonetworks.com/sase/sd-wan?ts=markdown)
* [Remote Browser Isolation](https://www.paloaltonetworks.com/sase/remote-browser-isolation?ts=markdown)
* [SaaS Security](https://www.paloaltonetworks.com/sase/saas-security?ts=markdown)
* [AI-Driven Security Operations Platform](https://www.paloaltonetworks.com/cortex?ts=markdown)
* [Cloud Security](https://www.paloaltonetworks.com/cortex/cloud?ts=markdown)
* [Cortex Cloud](https://www.paloaltonetworks.com/cortex/cloud?ts=markdown)
* [Application Security](https://www.paloaltonetworks.com/cortex/cloud/application-security?ts=markdown)
* [Cloud Posture Security](https://www.paloaltonetworks.com/cortex/cloud/cloud-posture-security?ts=markdown)
* [Cloud Runtime Security](https://www.paloaltonetworks.com/cortex/cloud/runtime-security?ts=markdown)
* [Prisma Cloud](https://www.paloaltonetworks.com/prisma/cloud?ts=markdown)
* [AI-Driven SOC](https://www.paloaltonetworks.com/cortex?ts=markdown)
* [Cortex XSIAM](https://www.paloaltonetworks.com/cortex/cortex-xsiam?ts=markdown)
* [Cortex XDR](https://www.paloaltonetworks.com/cortex/cortex-xdr?ts=markdown)
* [Cortex XSOAR](https://www.paloaltonetworks.com/cortex/cortex-xsoar?ts=markdown)
* [Cortex Xpanse](https://www.paloaltonetworks.com/cortex/cortex-xpanse?ts=markdown)
* [Unit 42 Managed Detection \& Response](https://www.paloaltonetworks.com/cortex/managed-detection-and-response?ts=markdown)
* [Managed XSIAM](https://www.paloaltonetworks.com/cortex/managed-xsiam?ts=markdown)
* [Threat Intel and Incident Response Services](https://www.paloaltonetworks.com/unit42?ts=markdown)
* [Proactive Assessments](https://www.paloaltonetworks.com/unit42/assess?ts=markdown)
* [Incident Response](https://www.paloaltonetworks.com/unit42/respond?ts=markdown)
* [Transform Your Security Strategy](https://www.paloaltonetworks.com/unit42/transform?ts=markdown)
* [Discover Threat Intelligence](https://www.paloaltonetworks.com/unit42/threat-intelligence-partners?ts=markdown)
## Company
* [About Us](https://www.paloaltonetworks.com/about-us?ts=markdown)
* [Careers](https://jobs.paloaltonetworks.com/en/)
* [Contact Us](https://www.paloaltonetworks.com/company/contact-sales?ts=markdown)
* [Corporate Responsibility](https://www.paloaltonetworks.com/about-us/corporate-responsibility?ts=markdown)
* [Customers](https://www.paloaltonetworks.com/customers?ts=markdown)
* [Investor Relations](https://investors.paloaltonetworks.com/)
* [Location](https://www.paloaltonetworks.com/about-us/locations?ts=markdown)
* [Newsroom](https://www.paloaltonetworks.com/company/newsroom?ts=markdown)
## Popular Links
* [Blog](https://www.paloaltonetworks.com/blog/?ts=markdown)
* [Communities](https://www.paloaltonetworks.com/communities?ts=markdown)
* [Content Library](https://www.paloaltonetworks.com/resources?ts=markdown)
* [Cyberpedia](https://www.paloaltonetworks.com/cyberpedia?ts=markdown)
* [Event Center](https://events.paloaltonetworks.com/)
* [Manage Email Preferences](https://start.paloaltonetworks.com/preference-center)
* [Products A-Z](https://www.paloaltonetworks.com/products/products-a-z?ts=markdown)
* [Product Certifications](https://www.paloaltonetworks.com/legal-notices/trust-center/compliance?ts=markdown)
* [Report a Vulnerability](https://www.paloaltonetworks.com/security-disclosure?ts=markdown)
* [Sitemap](https://www.paloaltonetworks.com/sitemap?ts=markdown)
* [Tech Docs](https://docs.paloaltonetworks.com/)
* [Unit 42](https://unit42.paloaltonetworks.com/)
* [Do Not Sell or Share My Personal Information](https://panwedd.exterro.net/portal/dsar.htm?target=panwedd)
* [Privacy](https://www.paloaltonetworks.com/legal-notices/privacy?ts=markdown)
* [Trust Center](https://www.paloaltonetworks.com/legal-notices/trust-center?ts=markdown)
* [Terms of Use](https://www.paloaltonetworks.com/legal-notices/terms-of-use?ts=markdown)
* [Documents](https://www.paloaltonetworks.com/legal?ts=markdown)
Copyright © 2026 Palo Alto Networks. All Rights Reserved
* [](https://www.youtube.com/user/paloaltonetworks)
* [](https://www.paloaltonetworks.com/podcasts/threat-vector?ts=markdown)
* [](https://www.facebook.com/PaloAltoNetworks/)
* [](https://www.linkedin.com/company/palo-alto-networks)
* [](https://twitter.com/PaloAltoNtwks)
* EN
Select your language