We just raised a $30M Series A: Read our story
FT
System Manager at a consumer goods company with 10,001+ employees
Real User
Top 5
This is a recommended solution for total end-to-end protection

Pros and Cons

  • "Being a cloud solution it is very flexible in serving internal and external connections and a broad range of devices."
  • "The connection to the internet has not performed as expected."

What is our primary use case?

We are still in the testing stages so there is not currently any primary use case beyond the base use of endpoint protection.  

What is most valuable?

Cortex has several good features that I am interested in. There is a nice Sandbox function that is very strong, there is the Traps (endpoint protection) solution, the real-time filtering of suspect linkages is good, and the automatic blocking of suspect behavior is always active and protecting the network.  

What needs improvement?

As an improvement, I would like to see enhanced connection speeds. On China's side, we need to set up a local server for the definition updates, and the performance has not been very good for the company when directly connected to the internet. We are a little disappointed with that.  

For how long have I used the solution?

We have been using Cortex XDR (Extended Detection and Response) for around two months.  

What do I think about the stability of the solution?

It is stable. From the moment we installed it has been up with no restarts of maintenance until now.  

What do I think about the scalability of the solution?

I think that this product is scalable. The testing environment we use right now has around 200 users. In the future, when we deploy it to the company we will move up to around 4,000 users.  

How are customer service and technical support?

The technical support is okay. They have already helped us to fix the installation and then we had an issue and they were available for correction of the problem. They also have made some useful suggestions. So the support team is okay in my estimation.  

Which solution did I use previously and why did I switch?

We have been exploring a similar solution. Right now I am also doing testing on Sentinel at the center. This is a similar solution. But we have only just begun testing Sentinel, so we do not really have enough experience with it to comment on the product.  

How was the initial setup?

As we just started with Cortex and we are using a cloud solution, I do not have the impression that it was difficult to install and begin using.  

What's my experience with pricing, setup cost, and licensing?

The setup costs are a bit higher than some other solutions. Overall it is a little bit expensive, I think. If we could get it for around a 10% discount then that would be a better price point for us.  

For our pricing plan, we are not on a subscription, so we do not have to pay every month. We have a yearly license for the product.  

The approximate amount we pay per license is around $80 per user per year.  

What other advice do I have?

My suggestion for people considering this product is that Cortex is a very good total solution on the endpoints. Because I needed Cortex to work for external and internal users and devices, it helps that it is cloud-based because it is good for working in the office or other locations. So we wanted to have the total end-to-end protection including on the mobile devices, that is what we got. This product will be a good suggestion for people who need the same capability.  

On a scale from one to ten where one is the worst and ten is the best, I would rate Cortex XDR as around nine-out-of-ten. The cost is the reason it would not be higher. Nine is good but this is a very good product except for the cost.  

Which deployment model are you using for this solution?

Public Cloud
Disclosure: I am a real user, and this review is based on my own experience and opinions.
RN
Lead Consultant at a tech services company with 1-10 employees
Real User
Top 5Leaderboard
Helpful support that can be reached quickly and easily, and the endpoint reporting is good

Pros and Cons

  • "The protection offered by this product is good, as is the endpoint reporting."
  • "Being able to filter the events to see those that are related to the actual alert would save time spent by the engineer."

What is our primary use case?

We are a solution provider and one of the Palo Alto products that we implement for our clients is Cortex XDR (Extended Detection and Response).

It is also known as Traps, and it is mostly used for endpoint protection. For example, when remote users want to connect to their organization using a VPN, they will be protected.

What is most valuable?

The protection offered by this product is good, as is the endpoint reporting.

Once installed, this product is easy to manage, whether it is on-premises or the cloud-based management system.

What needs improvement?

There are a lot of logs generated and an engineer has to go through all of the events to find out exactly what the bottleneck is. We do need to collect the events but this can be time-consuming. Being able to filter the events to see those that are related to the actual alert would save time spent by the engineer.

A better pricing plan would make this product more competitive.

For how long have I used the solution?

We have been dealing with Palo Alto, including Cortex XDR for more than three years.

What do I think about the stability of the solution?

This is a stable product and it is good, but we will keep evaluating other products as we continue to offer this type of solution to our customers.

What do I think about the scalability of the solution?

Cortex XDR is a scalable solution.

How are customer service and technical support?

The technical support team is good, and we can reach them quickly and easily. However, finding a resolution might take time.

Which solution did I use previously and why did I switch?

We have used Cylance in the past, although we stopped using it about three years ago.

We are currently using K7 Endpoint Protection. Unfortunately, it is not catching anything, whether it is malware or a virus.

How was the initial setup?

When we first implemented this product, it was called Traps. However, I don't see any difference, other than the name. For new customers, it might be a bit difficult to install and set up. It takes perhaps eight hours to install.

What about the implementation team?

I deployed this product, and I was also involved with the initial POC.

Only one admin is needed for deployment and a second person should be available to work with the users.

What's my experience with pricing, setup cost, and licensing?

This is an expensive solution.

Which other solutions did I evaluate?

We are currently trying to evaluate ELK.

What other advice do I have?

Overall, this is a good product and I can recommend it to others.

I would rate this solution an eight out of ten.

Disclosure: My company has a business relationship with this vendor other than being a customer: Partner
Learn what your peers think about Cortex XDR by Palo Alto Networks. Get advice and tips from experienced pros sharing their opinions. Updated: October 2021.
542,267 professionals have used our research since 2012.
Mayur Jadhav
Senior Security Consultant at a tech services company with 201-500 employees
Real User
Top 5Leaderboard
Automated, with well defined policies, but privacy is a concern

Pros and Cons

  • "The most valuable feature is that you can select remote access of any machine for sandboxing."
  • "Data privacy is a matter of concern. You have to be careful with data privacy, it can be sensitive and Cortex can have most of your access."

What is our primary use case?

We use this solution specifically in endpoint response, endpoint detection, endpoint sandboxing, and as a firewall.

How has it helped my organization?

The product is mostly automated, and we do not have to make decisions. All the decisions are made by the product itself. 

We are not required to create any custom policies. 

The policies that are created are well defined in the product itself.

What is most valuable?

The most valuable feature is that you can select remote access of any machine for sandboxing.

Irrespective of whether you have the rights or not, you can still access it from the cloud.

What needs improvement?

I would like to see some sort of attachment scanning included.

Data privacy is a matter of concern. You have to be careful with data privacy, it can be sensitive and Cortex can have most of your access.

I want a plugin for email attachment scanning and email body scanning.

For how long have I used the solution?

I have been using this solution for two years.

We are using version seven.

What do I think about the scalability of the solution?

Scalability is not a problem with this solution.

It's a cloud setup. You can scale in and you can scale out as per the cloud.

We have close to 500 users in our company.

How are customer service and technical support?

Technical support is very good, but it can be a problem, especially in the Gulf region.

If you do not take direct support, you have to wait for 72 hours. 

Also, direct support is a little bit costly.

Which solution did I use previously and why did I switch?

We used McAfee previously. We switched because the solution is pretty automated. You don't have to manually decide on the policy.

How was the initial setup?

The initial setup is pretty straightforward.

In one hour, you can deploy the entire setup and get started.

After the setup, deployment can take up to three to four days.

We had one admin test the solution and maintain it for us.

What about the implementation team?

We did not use an integrator or vendor team. 

What's my experience with pricing, setup cost, and licensing?

The pricing is okay, although direct support can be expensive.

What other advice do I have?

It is a very straightforward product with minimum administer interference, once it is deployed.

I would rate this solution a seven out of ten.

Which deployment model are you using for this solution?

Public Cloud
Disclosure: My company has a business relationship with this vendor other than being a customer: Partner
Flag as inappropriate
RP
Network and Cybersecurity Consultant at a tech services company with 11-50 employees
Reseller
Top 5Leaderboard
A stable detection and response app with a good policy management feature

Pros and Cons

  • "Stability is a primary factor, and then there's the ease of distribution and policy management."
  • "It would be good to have a better way to search for a file within the UI."

What is our primary use case?

We're primarily a Palo Alto shop, and we integrate solutions in the Palo Alto ecosystem. But for firewalls and threat hunting, it's all through Cortex XDR. We also compliment the Cortex XDR product with other endpoint protection solutions, like Windows Defender, or whatever the customer is using,

What is most valuable?

Stability is a primary factor, and then there's the ease of distribution and policy management. Cortex XDR by Palo Alto Networks is very easy to work with, and we're quite happy with them.

What needs improvement?

It would be good to have a better way to search for a file within the UI. Like in SentinelOne, you can search for an arbitrary file, and in Cortex XDR, you can't. You can do it with an addendum license, but I think we could all benefit from getting it with the standard license. Because if you want to do threat hunting with this product, you have to search for files now and not wait to get a license.

For how long have I used the solution?

I've been using Cortex XDR by Palo Alto Networks for about two years.

What do I think about the stability of the solution?

Cortex XDR by Palo Alto Networks is a stable solution.

How are customer service and technical support?

We used to talk to Palo Alto support extensively, and we always had a pleasant experience and never had a problem with them.

How was the initial setup?

Cortex XDR is quite easy to install. The time it takes to deploy depends on the infrastructure. We have had cases that lasted a few days and other cases where it took two to four months for a proof of concept.

What's my experience with pricing, setup cost, and licensing?

Every customer has to pay for a license because it doesn't work with what you get from a managed services provider. It's quite expensive, and they can't sell it for less than 200 euros a license. It's the lowest license price we can get from them.

What other advice do I have?

I would recommend Cortex XDR by Palo Alto Networks to potential users.

On a scale from one to ten, I would give Cortex XDR by Palo Alto Networks a nine.

Which deployment model are you using for this solution?

Public Cloud
Disclosure: My company has a business relationship with this vendor other than being a customer: Integrator
Flag as inappropriate
MG
Assistant Superintendent with 51-200 employees
Real User
Top 20
Straightforward to set up and the support is highly-rated

Pros and Cons

  • "The interface is easy to use and it is more up to date than our previous solution."
  • "Although I would say this product is highly-rated, it could probably do more because nothing does everything that you want."

What is our primary use case?

This product is part of a package that makes up our security solution.

What is most valuable?

The interface is easy to use and it is more up to date than our previous solution.

What needs improvement?

Although I would say this product is highly-rated, it could probably do more because nothing does everything that you want.

For how long have I used the solution?

We have been using this product for about four months.

What do I think about the scalability of the solution?

We think that this product will help us grow. We think that it meets our needs currently, and we can grow with it over time. There 12 people in the IT department who currently manage it. 

How are customer service and technical support?

The support is excellent. We had a couple of issues that we had to call for and I would say that they are highly rated.

Which solution did I use previously and why did I switch?

Our older solution was from Fortinet. It was out of date and more difficult to use. The IT staff say that the Palo Alto product is better.

How was the initial setup?

The initial setup was straightforward.

What about the implementation team?

We worked with a reseller. They came in, we told them what we wanted to do and they set it up to our spec. The person who came in and helped support us was highly skilled and it worked seamlessly.

What's my experience with pricing, setup cost, and licensing?

We pay about $50,000 USD per year for a bundle that includes Cortex XDR.

Which other solutions did I evaluate?

We evaluated Palo Alto and Trend Micro, and we opted for the Palo Alto Cortex XDR.

What other advice do I have?

I don't use this product on a daily basis but we like what we have so far and I would definitely recommend it to other users.

My advice is to make sure that you have a good implementor and that the reseller you're purchasing from gives you a highly-qualified engineer.

Overall, we are happy with this product but that said, nothing does everything that you want.

I would rate this solution a nine out of ten.

Which deployment model are you using for this solution?

On-premises
Disclosure: I am a real user, and this review is based on my own experience and opinions.
MuhammadZubair
Digital Business Solutions Manager at Bahrain Telecommunication Company BSC (Batelco)
Real User
Top 20
A stable and scalable extended detection and response platform, but it would be better if they educated their customers more

Pros and Cons

  • "It's a nice product that's stable and scalable."
  • "It would be better if they could educate the customers more. Some sort of seminars and roadshows will help educate the customers and show what the product can do. The price could be better. It would also help if they had a team for deployment and support."

What is our primary use case?

We don't have many customers moving to Cortex XDR by Palo Alto Networks. But recently, we started offering them both pro and basic options. 

What is most valuable?

It's a nice product that's stable and scalable.

What needs improvement?

It would be better if they could educate the customers more. Some sort of seminars and roadshows will help educate the customers and show what the product can do. The price could be better. It would also help if they had a team for deployment and support.

What do I think about the stability of the solution?

The product is stable. Palo Alto only works on security, and the product by default is stable. They are releasing new features, OS, and an ML-based thing on the firewall itself, which is quite impressive. Palo Alto is quite stable compared to other competitors in the market.

What do I think about the scalability of the solution?

It's scalable. I see whatever is written on their datasheets, and all it's real. If I talk to some other vendor and they say that they currently provide 20 Gbps reports, but when you activate it, IPSec and all, it goes to 2 Gbps. With Palo Alto, whatever is there is working, and it's scalable.

How are customer service and technical support?

Technical support is quite good. When compared to others, I feel it's quite impressive.

What's my experience with pricing, setup cost, and licensing?

The price is on the higher side, but it's okay.

What other advice do I have?

I would tell potential users that it's a complete solution from Palo Alto with firewalls and all to give you more precise logs and information. Product-wise, it's top of the line. If you have investment, always go for that and go for the best solution. 

Palo Alto is one of the tech vendors that always provides top-of-the-line products. Price-wise it will be on the higher side, but it depends on how you deal with the backend support or the account manager of Palo Alto to get that discount. 

On a scale from one to ten, I would give Cortex XDR by Palo Alto Networks a seven.

Disclosure: My company has a business relationship with this vendor other than being a customer: partner
Flag as inappropriate
Mantu Shaw
Sr. Technology Architect at Incedo Inc.
Real User
Top 5
A stable part of our security solution that correlates logs from relevant sources

Pros and Cons

  • "The most valuable for us is the correlation feature."
  • "There are some third-party solutions that are difficult to integrate with, which is something that can be improved."

What is our primary use case?

We use Cortex XDR as part of our security solution.

What is most valuable?

The most valuable for us is the correlation feature. You are able to correlate data that is coming from the firewall, network, server, and endpoints. This is one of our main requirements and makes for a good product.

It works with the data lake in an agent-based or agentless manner.

It is easy to integrate most with network devices, including firewalls, and Active Directory. We use firewalls from different vendors including Palo Alto and Check Point, and it supports them.

What needs improvement?

There are some third-party solutions that are difficult to integrate with, which is something that can be improved.

What do I think about the stability of the solution?

We have not experienced any issues with respect to stability at this point.

What do I think about the scalability of the solution?

Scalability has not been a problem.

How are customer service and technical support?

We have been in contact with technical support and are satisfied with them.

What about the implementation team?

We have an in-house team for deployment and maintenance.

Which other solutions did I evaluate?

I have run a PoC with both CrowdStrike and Cortex XDR, and from my observation, I felt that Cortex was much better at meeting our requirements. It is also easier to use.

CrowdStrike was difficult when it came to integrating with other products and it does not work on mobile devices.

What other advice do I have?

My advice for anybody who is considering Cortex XDR is that it is a complete solution, and has very good features. From my experience, it is one of the better ones in the market. That said, no product is 100%.

I would rate this solution a nine out of ten.

Disclosure: I am a real user, and this review is based on my own experience and opinions.
PV
Sales Engineer at a security firm with 51-200 employees
Real User
Reliable with good support, but the installation should be simplified

Pros and Cons

  • "Stability is one of the features we like the most."
  • "The installation should be easier and the Palo Alto pre-sales and sales teams should have more information on the product because they don't know what they are selling."

What is our primary use case?

We use this solution to secure endpoints and to have more visibility on what is happening on the endpoints.

We have two customers who are using this solution currently.

What needs improvement?

The installation should be easier and the Palo Alto pre-sales and sales should teams have more information on the product because they don't know what they are selling.

They don't know the features of the products they sell.

For example, Cortex XDR includes Cortex XDR Prevent, Cortex XDR Pro, and Cortex XDR Pro per TB. They don't know the real differences between Cortex XDR Pro and Cortex XDR Pro per TB.

Sometimes, they will tell you about features for one edition that belong to another edition. They don't seem to know what features belong to what edition.

For how long have I used the solution?

I have been working with this solution for one month.

We are familiar with Cortex XDR Prevent and Cortex XDR Pro.

What do I think about the stability of the solution?

It's a stable product.

What do I think about the scalability of the solution?

It's a scalable solution.

How are customer service and technical support?

Technical support is okay.

How was the initial setup?

The initial setup is complex. It is not easy to install.

We have been deploying this solution for a month, but we are not finished yet.

We only need one engineer for the deployment and maintenance.

What other advice do I have?

I would recommend this solution to anyone who is interested in using it.

I would rate Cortex XDR a seven out of ten.

Which deployment model are you using for this solution?

Public Cloud
Disclosure: My company has a business relationship with this vendor other than being a customer: Partner
Flag as inappropriate
Buyer's Guide
Download our free Cortex XDR by Palo Alto Networks Report and get advice and tips from experienced pros sharing their opinions.