Cortex XSOAR review: the incumbent SOAR, and whether AgentiX changes the case for replacing it

Palo Alto Networks' security orchestration, automation and response platform: visual playbooks, a war room for collaboration, case management, threat intelligence management with Unit 42 intelligence, and a Marketplace of 900+ prebuilt integrations and automation packs. Editions are Cortex XSOAR 8 SaaS, Cortex XSOAR 8 On-prem and Cortex XSOAR 6.

Playbooks triggered by incident type run enrichment and response steps; analysts work cases in the war room. With AgentiX, agents can reason, plan and execute workflows within existing roles and permissions, can be set to require approval for high-impact actions, and can be called from playbooks with prebuilt or custom natural-language prompts. Palo Alto says over 1,000 Cortex customers have enabled AgentiX.

• Investigation depth per alert · 20%

  6 / 10

  Playbooks and machine learning aid investigations, and AgentiX agents can reason and plan, but depth per alert still depends largely on the playbooks a team has built.

• Explainability of verdicts · 15%

  6 / 10

  War room, case records and playbook steps make actions traceable; explanation of agent reasoning is newer.

• Coverage of alert sources · 15%

  10 / 10

  900+ prebuilt integrations and automation packs and thousands of security actions in the Marketplace.

• Human-in-the-loop controls · 15%

  8 / 10

  AgentiX agents act within existing roles and permissions and can require approval for high-impact actions.

• Transition effort from an existing SOAR · 15%

  9 / 10

  No migration: existing playbooks keep running, and AgentiX lets teams add prebuilt or natural-language AI prompts into those playbooks.

• Deployment model options · 10%

  9 / 10

  Cortex XSOAR 8 SaaS, Cortex XSOAR 8 On-prem (end of life 30 September 2029, per Palo Alto documentation) and XSOAR 6.

• Pricing transparency · 10%

  2 / 10

  No pricing is published.

Weighted score: 7.25 / 10 (computed from the weights on /method#how-we-score)

• Depth per alert still depends on the playbooks you maintain.
• Plan for the XSOAR 8 On-prem end-of-life date if you run on-premises.
• No public pricing.

The largest cost is the playbook estate itself: inventory, re-validation of response actions and a parallel run. Before migrating, price AgentiX against a replacement, and check the end-of-life date for XSOAR 8 On-prem (30 September 2029) if you run on-premises. See Cortex XSOAR vs Mate Security.

Source: paloaltonetworks.com/cortex/cortex-xsoar · paloaltonetworks.com/cortex/agentix · cortex-docs.paloaltonetworks.com · Reviewed Sep 2026

• The largest integration and content marketplace in this guide.
• SaaS and on-premises editions.
• An in-place route to agents for teams that do not want to migrate.

Teams with stable, well-maintained playbooks, heavy use of Marketplace content, on-premises requirements or a broad Palo Alto footprint.