Orchestrate. Automate. Innovate.

The industry’s most comprehensive security orchestration, automation and response platform with native threat intelligence management and a built-in marketplace.

  • 90% faster response
  • 500+ product integrations
  • 16,000 DFIR members

Security operations automation
Virtual Summit

The Premier Summit for Security Operations

Join us in April

SOAR done right

One platform connecting people, process and technology.
Gartner SOAR Market Guide
Unified SOAR platform

Automate across your security stack

Cortex XSOAR ingests alerts across sources and executes automated workflows/playbooks to speed up incident response.

Speed incident investigations

Cortex XSOAR case management facilitates standardized response for high-quantity attacks while helping your teams adapt to sophisticated one-off attacks.

Break down team silos

Cortex XSOAR playbooks are complemented by real-time collaboration capabilities that let security teams rapidly iterate to solve emergent threats.

Act on threat intelligence with confidence

Cortex XSOAR offers a new approach to threat intelligence management that unifies threat intelligence aggregation, scoring and sharing with proven playbook-driven automation.

Manage incidents on the go

Track and respond to security incidents with a mobile-first experience for iOS and Android®.

Innovate with the best

Cortex XSOAR Marketplace

Discover, consume and share orchestration innovations contributed by experts in the world’s largest SOAR ecosystem.

Optimize your operations

Save time, streamline operations and increase SOC productivity.

Watch Now
  • Faster response time
  • Reduction in alert volume
  • Product integrations
  • Faster response time
  • Reduction in alert volume
  • Product integrations

Explore Our SOC

Customize and deploy quickly

Respond smarter, faster

ML-powered to learn from each incident

The perfect ally for security analysts, our machine learning-powered platform provides guidance based on past incidents and analyst actions.

Learn more
  • Increase analyst productivity

    Cortex XSOAR recommends the best analysts for the job based on actions and workload. It also correlates and shows related incidents for each case.

  • Accelerate playbook development

    Cortex XSOAR studies the most commonly used arguments and recommends these inputs during playbook creation.

  • Train incident models

    Our phishing email classifier model is trained on thousands of emails to help organizations detect malicious messages with a high degree of accuracy.

Learn more

Flexible deployment

Cortex XSOAR supports on-premises, private cloud or fully hosted deployments .
See the benefits of a hosted solution

Industry-leading Customer Success

Dedicated to helping you get the most of your Cortex XSOAR deployment

Onboarding Assistance

  • Customer journey kickoff
  • Onboarding assistance
  • Service configuration
  • Use case assistance
  • Training, documentation & workshops

Technical Support

  • Support community
  • Support portal
  • Telephone support
  • Response time (S1)
  • Slack DFIR private channel

Optimized Experience

  • Annual health check
  • Customized success plans
  • Periodic operations reviews
  • Executive business reviews
  • Prioritized integration development
Case Study

Navigating Rough Seas


Alerts in excess of 10,000 per week caused significant fatigue among the team of five security analysts. Detecting false positives and duplicate incidents was a specific concern that wasn’t being addressed.


“The automation infused into our security infrastructure by Cortex XSOAR complements our existing SIEM, allowing our SOC team to realize greater efficiencies. Automating these mundane tasks allows our analysts to focus on decision-making.”

– Sean Kohlmeier, Incident Response Lead, Esri

  • Cortex XSOAR
Read full case study
Case Study
Electric Utility Company

Keeping the SOC Lights On


The SOC team used a mix of tools, ranging from security products and open source platforms to in-house tools. While they had a SIEM to aggregate logs, analysts were frustrated as they still spent a great deal of time investigating duplicate alerts.


“We are very aggressive in prioritizing alerts. A shortfall of SIEMs is, when you get too granular with alerting, you also get the volume that is too taxing to handle manually. With this platform, we were able to gain value for being aggressive ... because it helps you manage it.”

– Senior SOC Manager

  • Cortex XSOAR
Read full case study
Case Study
The Pokémon Company International

Cortex XSOAR Catches ‘Em All


The Pokémon Company International needed a solution to help them navigate a fast-moving security environment and improve their ability to observe, evaluate and act upon incidents such as phishing attacks and credential theft.


“The value we have seen from Cortex XSOAR is we get stronger overall security because the response is instantaneous. We can provide better customer service for whomever reported the incident because they’re actually getting a message back confirming the action that was taken.”

– Sean Hastings, Senior Security Architect, The Pokémon Company International

  • Cortex XSOAR
Read full case study

Features and specifications

  • Delivery Model

    On-premises, private cloud, or fully hosted
  • On-premises specs (minimum)

    8 CPU cores
    16 GB RAM
    500 GB SSD
    Operating system: macOS, Windows, Linux
  • Case Management

    Custom layouts for incidents and indicators
    Indicator and incident correlation
    Flexible, customizable reports and dashboards
    On-the-go incident monitoring
    Automated mapping across integrations
  • Collaboration

    Real-time investigation and collaboration
    Machine learning assistance
    Continuous learning
    Streamlined, automated reporting
  • Threat Intelligence Management

    Automated multi-source feed aggregation
    Granular indicator scoring and management
    Best-in-class operational efficiency
    Powerful native threat intelligence
    Hands-free, automated playbooks with extensible integrations
  • Use cases

    Analytics and SIEM
    Threat intelligence
    Malware analysis
    Network security
    Email gateway
    and hundreds more

See Cortex in action

See firsthand how you can automate and streamline your security operations.

Talk to a Specialist