Cortex XDR - How We Distinguish Ourselves From a SIEM Solution

Showing results for 
Show  only  | Search instead for 
Did you mean: 

Cortex XDR - How We Distinguish Ourselves From a SIEM Solution

L4 Transporter



When running a SIEM, you need to have a huge team of many Analysts Level 1, Level 2, Level 3… Escalations to lateral teams (sometimes to take actions such as isolating endpoints/servers, gathering/deleting suspicious files, etc). It is laborious and time consuming to perform simple actions, like creating an alert. 


Read Cortex XDR - How We Distinguish Ourselves From a SIEM Solution to learn more on this topic from our experts!


Palo Alto Networks Contributors:

Luis Escobar, Cortex Customer Success Architect 

Maor Hojberg, Technical Marketing Engineer 


Cortex XDR 


L0 Member

Cortex XDR lacks a unified data model which impedes the ability to rapidly perform useful searches across disparate datasets.  Are there plans to address that gap?

L4 Transporter

Hi SStonebraker, 

if you mean that Cortex XDR doesn't have a dataset that holds all the datasets, that is correct. But so far we dont need that because in Cortex XDR, you can query and search with XQL any dataset and a combination of them in a very good response time. Creating a dataset of datasets will screw the searches response and so far there is no point to do so.

On top of that we have Cortex XDR Collectors that can collect data/logs from a miriad of sources ftp, linux system logs, windows, webservers of many flavors (IIS, apache, nginx), Fw, you name it. Once that those logs are uploaded in our Cortex management console in the cloud you can perform XQL queries on them. 

Additionally you can save the XQL queries in a public area so you and all your work mates can reuse them without reinventing the wheel. 

You can also save the queries as correlation rules and set the timing to launch them... 

As a source for XQL query center documentation, please visit the link:

From there you can also jump to other very good XQL documentation sources.

Hope this helped.

Kind Regards, 



L2 Linker

PAN Cortex XDR isn't a SIEM!


Also PAN check out Cortex XDR 3.0 now with correlation searches and the ability to ingest data from anywhere!!! 


Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!