Palo Alto Networks on Wednesday announced the general availability of its Cortex Extended Security Intelligence and Automation Management (XSIAM) platform, which leverages automation to unify cloud and on-premises security monitoring, analytics, and operations.
The promise of better tools for security operations center (SOC) analysts has been longstanding, and Palo Alto claims that on average, a Cortex-powered SOC detects threats in 10 seconds and responds to high-priority threats in one minute, with an 80% reduction in alerts that SOC analysts need to review.
Cortext XSIAM has been already made available to a number of top organizations spanning healthcare, design and manufacturing, technology, the public sector and entertainment industries. Many of these organizations are overwhelmed by alert volumes and false positive, as well as lack of visibility across all parts of the organization, including on-premises and the cloud.
“We want to give our customers a new approach to SOC operations with a focus on results, efficiency and productivity," said Lee Klarich, chief product officer, Palo Alto Networks. "Cortex XSIAM establishes an autonomous SOC where organizations can respond to threats in a fraction of the time it takes today, and analysts can focus on the highest priority incidents. The SOC of the future will be built on AI and automation — any other approach is destined for failure."
Jon Oltsik, a senior principal analyst and ESG Fellow, said XSIAM creates a central data model for what have been traditionally different data sets: logs, EDR and NDR data, and threat intelligence data. It integrates SOC components like XDR, SOAR, SIEM, and TIP to unify the analyst experience, and also ramps up the use case for advanced analytics, said Oltsik
“Basically, Palo Alto Networks looked at all the demands for SOC modernization and designed an integrated architecture for this purpose,” Oltsik said. “It’s not complete yet but it is a step in the right direction.”
Frank Dickson, who covers security and trust at IDC, said that automation has become a “nonnegotiable” as it can enable conviction at scale. With its Cortex XSIAM, Dickson said Palo Alto looks to apply an autonomous security operations platform approach to its eXtended detection and response solution set to reduce the burden on security professionals. “The offering is actual product Palo Alto has been able to demonstrate in its own SOC,” added Dickson.
