Palo Alto Networks' enterprise SOAR platform (formerly Demisto) that centralizes incident response with automated playbooks, war room collaboration, and 750+ integrations. It's the connective tissue for Palo Alto's broader Cortex ecosystem.
What is Cortex XSOAR?
Cortex XSOAR, formerly known as Demisto, is Palo Alto Networks' enterprise-grade SOAR platform. It centralizes security incident response by providing a collaborative war room environment where analysts can work together on live incidents, automated playbooks that execute response actions across integrated tools, and a case management layer that tracks every action taken during an investigation. With over 750 content packs and integrations, XSOAR serves as the orchestration hub for security operations teams that need to coordinate responses across dozens of different security products. Its playbooks can be fully automated, semi-automated with analyst checkpoints, or manually triggered, giving teams fine-grained control over how much autonomy they delegate to the platform.
How does Cortex XSOAR work with Qevlar?
Qevlar can operate alongside Cortex XSOAR, either receiving cases from XSOAR playbooks for automated investigation or pushing enriched investigation results back into XSOAR for case management and audit tracking. This allows teams already invested in the Palo Alto ecosystem to extend their automation coverage without replacing existing workflows.
Want to help your analysts focus on the most critical alerts?
Frequently asked questions
What is Cortex XSOAR?
Cortex XSOAR (formerly Demisto) is Palo Alto Networks' enterprise SOAR platform. It centralizes incident response with automated playbooks, a collaborative war room and case management across hundreds of integrations.
What can you do with Cortex XSOAR in Qevlar?
Qevlar can work alongside XSOAR — receiving cases from playbooks for automated investigation, or pushing enriched investigation results back into XSOAR for case management and audit tracking.
Does Qevlar replace my XSOAR playbooks?
No. Qevlar slots into existing workflows as the autonomous investigation step, so teams keep their orchestration and response playbooks while removing the manual analysis in the middle.
How does Qevlar reduce playbook maintenance?
Because Qevlar investigates dynamically rather than following fixed branches, it handles the variability of real alerts that static playbooks struggle with — less brittle automation, less tuning.
Other integrations
