[](https://www.paloaltonetworks.com/cortex?ts=markdown)  [](https://www.paloaltonetworks.com/cortex?ts=markdown) 
* [](https://www.paloaltonetworks.com/cortex?ts=markdown)
* [Industry Validation](https://www.paloaltonetworks.com/cortex/whycortex?ts=markdown)
* Products
 Products
Products
* [AI-Driven SOC](https://www.paloaltonetworks.com/cortex?ts=markdown)
* [Cortex XSIAM](https://www.paloaltonetworks.com/cortex/cortex-xsiam?ts=markdown)
* [Cortex XDR](https://www.paloaltonetworks.com/cortex/cortex-xdr?ts=markdown)
* [Cortex AgentiX](https://www.paloaltonetworks.com/cortex/agentix?ts=markdown)
* [Cortex XSOAR](https://www.paloaltonetworks.com/cortex/cortex-xsoar?ts=markdown)
* [Cortex Exposure Management](https://www.paloaltonetworks.com/cortex/exposure-management?ts=markdown)
* [Cortex Xpanse](https://www.paloaltonetworks.com/cortex/cortex-xpanse?ts=markdown)
* [Cortex Advanced Email Security](https://www.paloaltonetworks.com/cortex/advanced-email-security?ts=markdown)
* [Managed Detection \& Response](https://www.paloaltonetworks.com/cortex/managed-detection-and-response?ts=markdown)
* [Managed XSIAM](https://www.paloaltonetworks.com/cortex/managed-xsiam?ts=markdown)
* [Cloud Security](https://www.paloaltonetworks.com/cortex/cloud?ts=markdown)
* [Cortex Cloud](https://www.paloaltonetworks.com/cortex/cloud?ts=markdown)
* [Application Security](https://www.paloaltonetworks.com/cortex/cloud/application-security?ts=markdown)
* [Cloud Posture Security](https://www.paloaltonetworks.com/cortex/cloud/cloud-posture-security?ts=markdown)
* [Cloud Runtime Security](https://www.paloaltonetworks.com/cortex/cloud/runtime-security?ts=markdown)
[
The Forrester Total Economic Impact^™^ of Cortex XSIAM
257% 3-year ROI and \<6-month payback for SOC transformation.
Get the facts](https://start.paloaltonetworks.com/forrester-total-economic-impact-xsiam)
* Solutions
 Solutions
[Threat Prevention, Detection \& Response](https://www.paloaltonetworks.com/cortex/detection-and-response?ts=markdown)
* [Cloud Detection and Response](https://www.paloaltonetworks.com/cortex/cloud-detection-and-response?ts=markdown)
* [Security Information and Event Management](https://www.paloaltonetworks.com/cortex/modernize-siem?ts=markdown)
* [Endpoint Protection](https://www.paloaltonetworks.com/cortex/endpoint-protection?ts=markdown)
* [Endpoint Detection and Response](https://www.paloaltonetworks.com/cortex/endpoint-detection-and-response?ts=markdown)
* [Extended Detection \& Response](https://www.paloaltonetworks.com/cortex/detection-and-response?ts=markdown)
* [Managed Detection \& Response](https://www.paloaltonetworks.com/cortex/managed-detection-and-response?ts=markdown)
* [Managed Threat Hunting](https://www.paloaltonetworks.com/cortex/managed-threat-hunting?ts=markdown)
* [Ransomware Protection](https://www.paloaltonetworks.com/cortex/ransomware-protection?ts=markdown)
* [Digital Forensics](https://www.paloaltonetworks.com/cortex/digital-forensics?ts=markdown)
[Security Automation](https://www.paloaltonetworks.com/cortex/security-operations-automation?ts=markdown)
* [Network Security Automation](https://www.paloaltonetworks.com/cortex/network-security-automation?ts=markdown)
* [Incident Case Management](https://www.paloaltonetworks.com/cortex/incident-case-management?ts=markdown)
* [Security Operations Workflow Automation](https://www.paloaltonetworks.com/cortex/security-operations-automation?ts=markdown)
* [Threat Intel Management](https://www.paloaltonetworks.com/cortex/threat-intel-management?ts=markdown)
* [Extended Data Lake (XDL)](https://www.paloaltonetworks.com/cortex/cortex-xdl?ts=markdown)
* [Agentic Assistant](https://www.paloaltonetworks.com/cortex/cortex-agentic-assistant?ts=markdown)
[External Attack Surface Protection](https://www.paloaltonetworks.com/cortex/cortex-xpanse/attack-surface-management?ts=markdown)
* [Attack Surface Management](https://www.paloaltonetworks.com/cortex/cortex-xpanse/attack-surface-management?ts=markdown)
* [Unmanaged Cloud Security](https://www.paloaltonetworks.com/cortex/cortex-xpanse/unmanaged-cloud-asset-management?ts=markdown)
* [Third-Party Security](https://www.paloaltonetworks.com/cortex/cortex-xpanse/attack-surface-management-for-third-party-and-supply-chain-security?ts=markdown)
* [Compliance Management](https://www.paloaltonetworks.com/cortex/cortex-xpanse/compliance-management?ts=markdown)
* [Internet Operations Management](https://www.paloaltonetworks.com/cortex/cortex-xpanse/internet-operations-management?ts=markdown)
* [Remote Network Security](https://www.paloaltonetworks.com/cortex/cortex-xpanse/asm-for-remote-workers?ts=markdown)
[Cloud Security](https://www.paloaltonetworks.com/cortex/cloud?ts=markdown)
* [Application Security](https://www.paloaltonetworks.com/cortex/cloud/application-security?ts=markdown)
* [Cloud Runtime Security](https://www.paloaltonetworks.com/cortex/cloud/runtime-security?ts=markdown)
* [Cloud Posture Security](https://www.paloaltonetworks.com/cortex/cloud/cloud-posture-security?ts=markdown)
[
Tested. Reviewed. Proven
See Industry Validation](https://www.paloaltonetworks.com/cortex/cortex-xdr-industry-validation?ts=markdown)
* [Blog](https://www.paloaltonetworks.com/blog/security-operations/?ts=markdown)
* Resources
 Resources
Resources
* [White Papers](https://www.paloaltonetworks.com/resources?q=cortex&_charset_=UTF-8&fq=RC_TYPE_DFACET%3Apan%253Aresource-center%252Frc-type%252Fwhitepaper&ts=markdown)
* [Cortex Partners](https://cortex.marketplace.pan.dev/marketplace/)
* [Customer Stories](https://www.paloaltonetworks.com/cortex/customer-stories?ts=markdown)
* [Cortex vs. The Competition](https://www.paloaltonetworks.com/cortex/cortex-vs-the-competition?ts=markdown)
* [Cortex XSOAR Marketplace](https://xsoar.pan.dev/marketplace)
* [Events](https://www.paloaltonetworks.com/resources/cortex-events?ts=markdown)
* [Datasheets](https://www.paloaltonetworks.com/resources?q=Cortex&_charset_=UTF-8&fq=RC_TYPE_DFACET%3Apan%253Aresource-center%252Frc-type%252Fdatasheet&ts=markdown)
* [Research Reports](https://www.paloaltonetworks.com/resources?q=cortex&_charset_=UTF-8&fq=RC_TYPE_DFACET%3Apan%253Aresource-center%252Frc-type%252Fresearch&ts=markdown)
* [Videos](https://www.paloaltonetworks.com/resources?q=cortex&_charset_=UTF-8&fq=RC_TYPE_DFACET%3Apan%253Aresource-center%252Frc-type%252Fvideo&ts=markdown)
* [Cortex XDR Resource Center](https://www.paloaltonetworks.com/cortex/cortex-xdr-resource-center?ts=markdown)
[
DIGITAL ASSET
THE CORTEX PLATFORM](https://www.paloaltonetworks.com/resources/infographics/soc-transformation-infographic?ts=markdown)
[
WHITEPAPER
Cortex XSIAM Solution Brief](https://www.paloaltonetworks.com/resources/techbriefs/cortex-xsiam?ts=markdown)
[
REPORT
Unlock customized recommendations for transforming your SecOps.](https://www.paloaltonetworks.com/cortex/secops-readiness-report?ts=markdown)
* Get In Touch
 Get In Touch
Get in Touch
* [Request a Demo](https://www.paloaltonetworks.com/cortex/request-demo?ts=markdown)
* [Contact us](https://www.paloaltonetworks.com/company/contact-sales?ts=markdown)
* [Attend a Workshop](https://www.paloaltonetworks.com/cortex/cortex-xdr/hands-on-workshop?ts=markdown)
* [Find a Partner](https://technologypartners.paloaltonetworks.com/English/directory)
* [Join our Community](https://live.paloaltonetworks.com/)
[
SecOps analyst: A day in the life.
Start product tour](https://www.paloaltonetworks.com/resources/infographics/xsoar-product-tour?ts=markdown)
*
* [Request a Demo](https://www.paloaltonetworks.com/cortex/request-demo?ts=markdown)
 
[](https://www.paloaltonetworks.com/cortex?ts=markdown)
Search
All
* [Tech Docs]()
Close search modal
*** ** * ** ***
## Palo Alto Networks: \#1 in SOC Automation
#### Cortex XSOAR^®^ ranked Overall Leader in SOAR by KuppingerCole.
* [See the analysis](https://start.paloaltonetworks.com/kuppingercole-soar-report.html)
**cortex****cortex****cortex\*\*\*\*cortex**
WEBINAR SERIES"\>
## *WEBINAR SERIES*
*CORTEX*
*Introducing Cortex AgentiX:
Meet Your AI Agent Workforce*
*Episode 1*
* [Watch now](https://www.paloaltonetworks.com/engage/cortex-forward-webinar-series/introducing-cortex-agentix)
**cortex****cortex****cortex\*\*\*\*cortex**
A day in the life."\>
SecOps analyst:
A day in the life.
---
#### See intelligent automation
at work with Cortex XSOAR^®^.
* [Start product tour](https://www.paloaltonetworks.com/resources/infographics/xsoar-product-tour?ts=markdown)
**cortex****cortex****cortex\*\*\*\*cortex**
above the rest."\>
SOARing
above the rest.
---
## SANS independent review: Cortex XSOAR® capabilities.
* [Learn more](https://start.paloaltonetworks.com/cortex-xsoar-sans-review)
**cortex****cortex****cortex\*\*\*\*cortex**
PrevNext
{#why} WHY IT MATTERS
### Security teams rarely get the most value out of their threat intel investments, given the millions of indicators that come in daily.
*
### Not all threat intel is relevant
Threat feeds vary in quality and relevance, forcing analysts to manually tune and score them before they can be distributed to enforcement points.
\*
### Insights into threat impact
Security teams need to quickly assess how external threats are related to what is happening in their network.
\*
### Acting on threat intel is hard
Managing dynamic threat feeds is a highly manual and repetitive process. The sheer volume of data results in a lag between intelligence processing and action.
* [Watch video](https://players.brightcove.net/1050259881001/rJLR3mDB_default/index.html?videoId=6257452144001)
[Learn how](https://start.paloaltonetworks.com/tips-and-tactics-for-better-threat-hunting)
## Threat Intelligence Management, Elevated
[Watch now](https://start.paloaltonetworks.com/cortex-xsoar-tim-3dot0.html)
CORTEX XSOAR THREAT INTELLIGENCE MANAGEMENT
## A powerful threat intelligence platform designed for action
Cortex XSOAR TIM unlocks the power of your threat intelligence, with a mission-control platform that gives you unmatched visibility into the global threat landscape, ties threat information to incidents in real-time, and automates the distribution of your threat intelligence at scale.
* Manage threat intelligence lifecycle
* Eliminate silos
* Actionable intel
[Watch video](https://players.brightcove.net/1050259881001/rJLR3mDB_default/index.html?videoId=6257452144001)
* 
Planning \& Direction
* 
Collection
* 
Processing
* 
Analysis \& Production
* 
Dissemination
*** ** * ** ***
## Our approach to threat intel management
### Centralize and manage all threat intelligence
Leverage a global threat landscape with native access to the massive Palo Alto Networks threat intelligence repository from Unit42.
*
#### Proactive defense against attacks
Rich threat intelligence findings by Unit 42 threat researchers are automatically embedded in an analyst's existing tools for instant, unrivaled context and understanding of every event and threat.
\*
#### Centralized threat intelligence library
Better model your threat landscape with threat data from hundreds of sources automatically aggregated into a single, cohesive set. Discover new sources of threat intelligence from the hundreds of threat feed integrations within our Cortex Marketplace.
[Watch webinar](https://start.paloaltonetworks.com/tips-and-tactics-for-better-threat-hunting)
[](#prismastickyimagecom_prisma-custom-background_prismacustombackgrou_1130711440_cleanParsys_threat-intel-management_cortex_en_US_pan_content_)
*** ** * ** ***
### Automatically map threat information to incidents
Automatic mapping to help you identify relevant threats, relationships between threat actors and attack techniques previously unknown in your environment.
*
#### Take automated action
Expand the scope of your investigations by easily sharing threat intelligence across internal teams and trusted organizations with enhanced reporting capabilities.
\*
#### Enrich and prioritize
Make informed decisions, take action and respond confidently with enrichment playbooks that automatically enrich indicators with more details and context.
[Watch video](https://bcove.video/3E9K6eu)
[](#prismastickyimagecom_414334980_prisma-custom-background_prismacustombackgrou_1130711440_cleanParsys_threat-intel-management_cortex_en_US_pan_content_)
*** ** * ** ***
### Operationalize threat intelligence with automation
Take immediate action on this intelligence data by leveraging automation to parse, prioritize and distribute relevant threat information.
*
#### Eliminate manual tasks
Automated playbooks to aggregate, parse, deduplicate and manage millions of daily indicators across multiple feed sources. Extend and edit IoC scoring with ease.
\*
#### Operationalize
In order to operationalize cyberthreat intelligence, it needs to be actionable. To make it actionable, you need to build context. Threat intelligence without context is just noise.
[Download](https://start.paloaltonetworks.com/xsoar-threat-intel.html)
[](#prismastickyimagecom_2038177655_prisma-custom-background_prismacustombackgrou_1130711440_cleanParsys_threat-intel-management_cortex_en_US_pan_content_)
*** ** * ** ***
*** ** * ** ***
## The industry's most complete threat intelligence platform
THREAT INTELLIGENCE MANAGEMENT
* Most powerful built-in threat data
* Collect and correlate all threat intelligence sources and incidents
* Advanced reporting capabilities to create, collaborate and share finished intelligence programs
* Aggregate, parse and score indicators with precision
* Act on threat intelligence with automated playbooks and 700+ integrations
[Learn more](https://www.paloaltonetworks.com/resources/datasheets/cortex-xsoar-threat-intelligence-management?ts=markdown)
## Featured Resources
[See all documents](https://www.paloaltonetworks.com/resources?q=soar&_charset_=UTF-8&ts=markdown)
Report
### Palo Alto Networks: \#1 in SOC Automation
[See the analysis](https://start.paloaltonetworks.com/kuppingercole-soar-report.html)
PODCAST
### Using Threat Intelligence Effectively in Incident Investigation
[Listen now](https://www.paloaltonetworks.com/resources/podcasts/using-threat-intelligence-effectively-in-incident-investigation?ts=markdown)
WHITE PAPER
### The Future of Threat Intelligence
[Download](https://start.paloaltonetworks.com/xsoar-the-future-of-threat-intel.html)
PODCAST
### Optimizing Managed Detection and Response (MDR) with Automation
[Listen now](https://www.paloaltonetworks.com/resources/podcasts/optimizing-managed-detection-and-response-with-automation?ts=markdown)
DATASHEET
### Cortex XSOAR Threat Intelligence Management
[Read](https://www.paloaltonetworks.com/resources/datasheets/cortex-xsoar-threat-intelligence-management?ts=markdown)
WHITE PAPER
### How SOAR Is Transforming Threat Intelligence
[Download](https://start.paloaltonetworks.com/xsoar-threat-intel.html)
CYBERPEDIA
### What Is Threat Intel Management
[Read now](https://www.paloaltonetworks.com/cyberpedia/what-is-cyberthreat-intelligence-cti?ts=markdown)
THREAT FEEDS
### Threat Intel integrations via Marketplace
[Explore](https://cortex.marketplace.pan.dev/marketplace/)
REPORT
### Gartner SOAR Market Guide (How TIM fits in)
[Read](https://start.paloaltonetworks.com/2020-gartner-mg-for-soar.html)
PrevNext
[See all documents](https://www.paloaltonetworks.com/resources?q=soar&_charset_=UTF-8&ts=markdown)
{#footer}
## Products and Services
* [AI-Powered Network Security Platform](https://www.paloaltonetworks.com/network-security?ts=markdown)
* [Secure AI by Design](https://www.paloaltonetworks.com/precision-ai-security/secure-ai-by-design?ts=markdown)
* [Prisma AIRS](https://www.paloaltonetworks.com/prisma/prisma-ai-runtime-security?ts=markdown)
* [AI Access Security](https://www.paloaltonetworks.com/sase/ai-access-security?ts=markdown)
* [Cloud Delivered Security Services](https://www.paloaltonetworks.com/network-security/security-subscriptions?ts=markdown)
* [Advanced Threat Prevention](https://www.paloaltonetworks.com/network-security/advanced-threat-prevention?ts=markdown)
* [Advanced URL Filtering](https://www.paloaltonetworks.com/network-security/advanced-url-filtering?ts=markdown)
* [Advanced WildFire](https://www.paloaltonetworks.com/network-security/advanced-wildfire?ts=markdown)
* [Advanced DNS Security](https://www.paloaltonetworks.com/network-security/advanced-dns-security?ts=markdown)
* [Enterprise Data Loss Prevention](https://www.paloaltonetworks.com/sase/enterprise-data-loss-prevention?ts=markdown)
* [Enterprise IoT Security](https://www.paloaltonetworks.com/network-security/enterprise-device-security?ts=markdown)
* [Medical IoT Security](https://www.paloaltonetworks.com/network-security/medical-device-security?ts=markdown)
* [Industrial OT Security](https://www.paloaltonetworks.com/network-security/medical-device-security?ts=markdown)
* [SaaS Security](https://www.paloaltonetworks.com/sase/saas-security?ts=markdown)
* [Next-Generation Firewalls](https://www.paloaltonetworks.com/network-security/next-generation-firewall?ts=markdown)
* [Hardware Firewalls](https://www.paloaltonetworks.com/network-security/hardware-firewall-innovations?ts=markdown)
* [Software Firewalls](https://www.paloaltonetworks.com/network-security/software-firewalls?ts=markdown)
* [Strata Cloud Manager](https://www.paloaltonetworks.com/network-security/strata-cloud-manager?ts=markdown)
* [SD-WAN for NGFW](https://www.paloaltonetworks.com/network-security/sd-wan-subscription?ts=markdown)
* [PAN-OS](https://www.paloaltonetworks.com/network-security/pan-os?ts=markdown)
* [Panorama](https://www.paloaltonetworks.com/network-security/panorama?ts=markdown)
* [Secure Access Service Edge](https://www.paloaltonetworks.com/sase?ts=markdown)
* [Prisma SASE](https://www.paloaltonetworks.com/sase?ts=markdown)
* [Application Acceleration](https://www.paloaltonetworks.com/sase/app-acceleration?ts=markdown)
* [Autonomous Digital Experience Management](https://www.paloaltonetworks.com/sase/adem?ts=markdown)
* [Enterprise DLP](https://www.paloaltonetworks.com/sase/enterprise-data-loss-prevention?ts=markdown)
* [Prisma Access](https://www.paloaltonetworks.com/sase/access?ts=markdown)
* [Prisma Browser](https://www.paloaltonetworks.com/sase/prisma-browser?ts=markdown)
* [Prisma SD-WAN](https://www.paloaltonetworks.com/sase/sd-wan?ts=markdown)
* [Remote Browser Isolation](https://www.paloaltonetworks.com/sase/remote-browser-isolation?ts=markdown)
* [SaaS Security](https://www.paloaltonetworks.com/sase/saas-security?ts=markdown)
* [AI-Driven Security Operations Platform](https://www.paloaltonetworks.com/cortex?ts=markdown)
* [Cloud Security](https://www.paloaltonetworks.com/cortex/cloud?ts=markdown)
* [Cortex Cloud](https://www.paloaltonetworks.com/cortex/cloud?ts=markdown)
* [Application Security](https://www.paloaltonetworks.com/cortex/cloud/application-security?ts=markdown)
* [Cloud Posture Security](https://www.paloaltonetworks.com/cortex/cloud/cloud-posture-security?ts=markdown)
* [Cloud Runtime Security](https://www.paloaltonetworks.com/cortex/cloud/runtime-security?ts=markdown)
* [Prisma Cloud](https://www.paloaltonetworks.com/prisma/cloud?ts=markdown)
* [AI-Driven SOC](https://www.paloaltonetworks.com/cortex?ts=markdown)
* [Cortex XSIAM](https://www.paloaltonetworks.com/cortex/cortex-xsiam?ts=markdown)
* [Cortex XDR](https://www.paloaltonetworks.com/cortex/cortex-xdr?ts=markdown)
* [Cortex XSOAR](https://www.paloaltonetworks.com/cortex/cortex-xsoar?ts=markdown)
* [Cortex Xpanse](https://www.paloaltonetworks.com/cortex/cortex-xpanse?ts=markdown)
* [Unit 42 Managed Detection \& Response](https://www.paloaltonetworks.com/cortex/managed-detection-and-response?ts=markdown)
* [Managed XSIAM](https://www.paloaltonetworks.com/cortex/managed-xsiam?ts=markdown)
* [Threat Intel and Incident Response Services](https://www.paloaltonetworks.com/unit42?ts=markdown)
* [Proactive Assessments](https://www.paloaltonetworks.com/unit42/assess?ts=markdown)
* [Incident Response](https://www.paloaltonetworks.com/unit42/respond?ts=markdown)
* [Transform Your Security Strategy](https://www.paloaltonetworks.com/unit42/transform?ts=markdown)
* [Discover Threat Intelligence](https://www.paloaltonetworks.com/unit42/threat-intelligence-partners?ts=markdown)
## Company
* [About Us](https://www.paloaltonetworks.com/about-us?ts=markdown)
* [Careers](https://jobs.paloaltonetworks.com/en/)
* [Contact Us](https://www.paloaltonetworks.com/company/contact-sales?ts=markdown)
* [Corporate Responsibility](https://www.paloaltonetworks.com/about-us/corporate-responsibility?ts=markdown)
* [Customers](https://www.paloaltonetworks.com/customers?ts=markdown)
* [Investor Relations](https://investors.paloaltonetworks.com/)
* [Location](https://www.paloaltonetworks.com/about-us/locations?ts=markdown)
* [Newsroom](https://www.paloaltonetworks.com/company/newsroom?ts=markdown)
## Popular Links
* [Blog](https://www.paloaltonetworks.com/blog/?ts=markdown)
* [Communities](https://www.paloaltonetworks.com/communities?ts=markdown)
* [Content Library](https://www.paloaltonetworks.com/resources?ts=markdown)
* [Cyberpedia](https://www.paloaltonetworks.com/cyberpedia?ts=markdown)
* [Event Center](https://events.paloaltonetworks.com/)
* [Manage Email Preferences](https://start.paloaltonetworks.com/preference-center)
* [Products A-Z](https://www.paloaltonetworks.com/products/products-a-z?ts=markdown)
* [Product Certifications](https://www.paloaltonetworks.com/legal-notices/trust-center/compliance?ts=markdown)
* [Report a Vulnerability](https://www.paloaltonetworks.com/security-disclosure?ts=markdown)
* [Sitemap](https://www.paloaltonetworks.com/sitemap?ts=markdown)
* [Tech Docs](https://docs.paloaltonetworks.com/)
* [Unit 42](https://unit42.paloaltonetworks.com/)
* [Do Not Sell or Share My Personal Information](https://panwedd.exterro.net/portal/dsar.htm?target=panwedd)
* [Privacy](https://www.paloaltonetworks.com/legal-notices/privacy?ts=markdown)
* [Trust Center](https://www.paloaltonetworks.com/legal-notices/trust-center?ts=markdown)
* [Terms of Use](https://www.paloaltonetworks.com/legal-notices/terms-of-use?ts=markdown)
* [Documents](https://www.paloaltonetworks.com/legal?ts=markdown)
Copyright © 2025 Palo Alto Networks. All Rights Reserved
* [](https://www.youtube.com/user/paloaltonetworks)
* [](https://www.paloaltonetworks.com/podcasts/threat-vector?ts=markdown)
* [](https://www.facebook.com/PaloAltoNetworks/)
* [](https://www.linkedin.com/company/palo-alto-networks)
* [](https://twitter.com/PaloAltoNtwks)
* EN
Select your language