> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.8/learn-about-cortex-xsoar/get-started-with-cortex-xsoar/what-is-cortex-xsoar.md).

# What is Cortex XSOAR?

Cortex XSOAR is the industry’s first extended security orchestration and automation platform that simplifies security operations by unifying automation, case management, real-time collaboration, and threat intel management.

Cortex XSOAR ingests aggregated alerts and indicators of compromise (IOCs) from detection sources, such as security information and event management (SIEM) solutions, network security tools, threat intelligence feeds, and mailboxes, before executing automatable, process-driven playbooks to enrich and respond to these incidents. These playbooks coordinate across technologies, security teams, and external users for centralized data visibility and action.

With a Threat Intel Management license, Cortex XSOAR provides a Threat Intelligence Platform with actionable threat data from Unit 42. You can identify and discover new Malware families or campaigns and create and disseminate strategic intelligence reports.

For existing Cortex users, XSOAR is easily integrated into other Cortex solutions and is delivered from the same platform.

{% tabs %}
{% tab title="Why Cortex XSOAR?" %}

* Improve SOC Efficiency by Automating Incident Response

  Automate incident response workflows and repetitive tasks to free up analysts to focus on the most critical incidents with Cortex XSOAR. Use predefined playbooks or easily customize your own to automate SOC use cases such as indicator enrichment, alert deduplication, phishing response, ransomware response, threat intelligence feed management, malware investigation, and even IT operations such as employee onboarding and offboarding.
* Experience Better Performance, Reliability, and Scalability

  Cortex XSOAR supports future growth, with rapid deployment to accelerate ROI. Fully integrated into the Cortex platform, Cortex XSOAR is delivered through a unified user interface for ease of use and consistency in workflow management.
* Ingest, Search, and Query All Security Alerts

  When complex, real-time investigations require analyst intervention, ensure analysts have quick access to investigation data. Cortex XSOAR accelerates incident response by unifying incident and indicator data from multiple sources on a single easy-to-search platform.
* Improve Investigation Quality by Working Together

  Collaborative investigation features provide a powerful toolkit to help analysts assist each other, run real-time security commands, and learn from each incident with auto-documentation of all actions. An ML-driven assistant learns from actions taken in the platform and offers guidance on analyst assignments and commands to execute actions.
* Act on Threat intelligence with Agility and Confidence

  Unify aggregation, scoring, and sharing threat intelligence with playbook-driven automation with native threat intelligence management. The built-in, high-fidelity threat intelligence can be boosted by layering additional third-party threat intel to better reveal and prioritize critical threats.
  {% endtab %}

{% tab title="How Cortex XSOAR Works" %}
Cortex XSOAR ingests aggregated alerts and indicators of compromise (IoCs) from detection sources such as security information and event management (SIEM) solutions, network security tools, threat intelligence feeds, and mailboxes, before executing automatable, process-driven playbooks to enrich and respond to these incidents. These playbooks coordinate across technologies, security teams, and external users for centralized data visibility and action.

For existing Cortex users, XSOAR is easily integrated into other Cortex solutions and is delivered from the same platform. Cortex XSOAR ingests alerts from third-party products and Threat intel feeds and by installing content packs, you can automate the investigation and response process.

![xsoar-overview.png](/files/F5p9eNTCbRbd67i4FQW1)
{% endtab %}
{% endtabs %}


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.8/learn-about-cortex-xsoar/get-started-with-cortex-xsoar/what-is-cortex-xsoar.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.