To support accelerated application release schedules and expanding infrastructure, Palo Alto Networks IT set out to resolve four key operational challenges:
- Automate manual troubleshooting to keep pace with AI-driven software development.
- Control telemetry spend as infrastructure expands without creating operational blind spots.
- Eliminate proprietary data lock-in to share telemetry across security and analytics platforms.
- Prune legacy asset sprawl to reduce technical debt and operational noise across engineering teams.
“By enabling us to standardize on OpenTelemetry, Cortex XCOR made operational data available across the entire organization. A single metric or log stream now simultaneously feeds observability, threat analysis in Cortex XSIAM, and automated reasoning in our AISM.”
— Shivneet Singh
VP, Infrastructure & First Customer Experience, Palo Alto Networks
Palo Alto Networks acquired Chronosphere — now Cortex XCOR — to provide AI-driven observability for enterprise customers. The company’s IT team independently selects internal tools based on technical merit. The team chose Cortex XCOR to support expanding AI use cases and control telemetry costs.
After selecting Cortex XCOR, the IT team needed to deploy the platform across 20 global engineering teams. Because these teams were actively delivering core product releases and AI initiatives, IT needed a migration strategy that would not interrupt ongoing development cycles.
To execute the transition without creating developer friction, IT used Cortex XCOR AI-driven migration tooling. The tooling programmatically converted dashboards, queries and alerts from the previous provider into native Cortex XCOR formats and validated success. During conversion, the tooling audited 25,000 legacy assets, identifying unused dashboards, orphaned alerts and duplicate monitors. This automated cleanup eliminated 15,000 stale items while migrating 9,511 active assets, allowing the team to consolidate 23 legacy instances into 10 tenants within four months.
Following the migration, IT set out to reduce observability spend without creating operational blind spots. To strike this balance, the IT team used usage analytics native to Cortex XCOR to understand which data their teams relied on and which was unused. By inspecting incoming telemetry against active queries, alerts and dashboards, IT gained direct visibility into data utility. Using these insights, IT optimized telemetry volumes by 85%. This cut total observability spend by 60%, even while overall telemetry grew 1.5x.
Rather than confining telemetry within a single monitoring tool, IT sought to make operational data broadly accessible across security, analytics and AIOps platforms. To achieve this, the team standardized all internal data collection on open standards.
Because Cortex XCOR is 100% OTel compatible, the team could feed the same telemetry stream out of Cortex into other internal systems. Operational metrics flow into Cortex XCOR for monitoring while feeding Cortex XSIAM® and Cortex AgentiX for threat analysis. The same pipeline also populates the company’s internal context graph to map system dependencies and power automated root cause analysis and remediation.
“Cortex XCOR’s AI SRE has potential to transform our incident response and we are already seeing its impact. By starting investigations the second an alert fires, troubleshooting that once took hours now takes minutes.”
— Bright Renold
Senior Director, Compute Infrastructure, Palo Alto Networks
Future Outlook
Palo Alto Networks IT will continue expanding Cortex XCOR across the company. The team is deploying Cortex XCOR's AI SRE to transition operational workflows further toward automated incident response.
Looking ahead, being part of Palo Alto Networks accelerates Cortex XCOR's ability to adopt enterprise security postures that stay ahead of operational gaps, embedding advanced protections and governance directly into the telemetry pipeline and platform.
share this story
