above the rest.

SANS independent review: Cortex XSOAR® capabilities.

Navigating security automation.

Your guide to a successful automation journey.

Leading the Pack: Cortex XSOAR

GigaOm Radar rated Cortex® XSOAR™ exceptional for essential SecOps features.

Security Operations Workflow Automation

Transform your operations with scalable, automated processes for any security use case.

AI and automation: The future of SecOps.

Come see where security operations are headed next.


Security teams have plenty of challenges. Workflow automation shouldn’t be one of them. Best-of-breed tools and an expanded threat surface have led to a growth in both the volume and sophistication of security alerts.

  • Slow response times

    Security teams must coordinate across a variety of detection, enrichment and case management tools to resolve incidents, slowing down response.

  • Manual, time-consuming tasks

    Security operations and incident response often involve tasks that, while important, are repetitive, laborious and don’t require nuanced human oversight.

High alert volumes

High alert volumes

Read more


Security automation that’s accessible to everyone

Cortex XSOAR puts automation in everyone’s hands, empowering security teams to free themselves from workflow complexity. Allow them to do more and do it faster with any use case.
  • Prebuilt integrations and automation content packs speed deployment
  • Automation actions and a visual playbook editor for codeless customization
  • Constant innovation from the industry’s largest SOAR ecosystem
  • 700+ integrations
    700+ integrations
  • 680+ content packs
    680+ content packs
  • 1000s of automation scripts
    1000s of automation scripts
  • Visual playbook editor
    Visual playbook editor
  • Built-in ML assistance
    Built-in ML assistance

Our approach to security workflow automation

Open and extensible platform

Our prebuilt integrations and playbooks speed deployment to help jumpstart your automation journey. As your security operations grow and mature, our extensible platform can easily be customized (workflows, integrations, incident views, reports) to scale to your needs.

  • SOAR across your stack

    Orchestrate and automate enrichment and response across Palo Alto Networks and 700+ third-party products.

  • Streamline operations

    Simplify any workflow and instantly automate common use cases (phishing, malware analysis, ransomware, etc.) with hundreds of pre-built playbooks.

Open and extensible platform

Codeless playbook creation

Thousands of automation scripts, UI-based filters and transformers help you manipulate incident data and automate complex tasks during playbook creation.

  • No coding required

    Easily build playbooks through a visual drag-and-drop interface that features thousands of automatable actions across security products, conditional paths, manual tasks and human approval for sensitive automations.

  • Playbook debugger

    This tool enables you to build and troubleshoot playbooks by helping you find tasks that might fail and by testing different conditions, branches, inputs and outputs.

Codeless playbook creation

Constant automation innovation

Solve any security use case and scale your use of SOAR with turnkey content contributed to by SecOps experts and the world’s largest SOAR partner community.

  • Easily discover and deploy new use cases

    Our Cortex XSOAR content packs are prebuilt bundles of integrations, playbooks, dashboards, fields, subscription services and all the dependencies needed to automate a specific use case.

  • Machine-learning assistance

    The perfect ally for security analysts, our machine learning-powered platform provides guidance based on past incidents and analyst actions. For example, our phishing email classifier model is trained on thousands of emails to help you detect malicious messages.

Constant automation innovation

A single platform for end-to-end incident lifecycle management

Cortex XSOAR integrates with 700+ products and services to provide playbook-driven responses that span across teams, products and use cases. This response automation is tightly integrated with Cortex XSOAR's fully customizable case management, enabling security teams to retain control over incidents while improving response times and operational efficiency.
A single platform for end-to-end incident lifecycle management

Use Case Example: Rapid Breach Response

When a breach happens, your team has to act fast. With Cortex XSOAR, you get a head start with workflow best practices and automated actions for isolating and remediating infected hosts. For example, when a ransomware attack is detected by Cortex XDR, a ransomware playbook is triggered to collect the required information from your environment, execute investigation steps, contain the incident and present the data to you in a custom dashboard.

Rapid Breach Response

How Cortex XSOAR Deploys

  • Customer on-premises server

  • Customer virtual/cloud

  • Cortex XSOAR hosted service

  • Cortex XSOAR Marketplace