# Elastic Security vs Palo Alto Cortex XSIAM

| Attribute | Elastic Security | Palo Alto Cortex XSIAM |
|---|---|---|
| **Vioscale score** | 54.1 (76% (high)) | 61 (13% (low)) |
| activity.commits_last_30d | 100 | - |
| adoption.dependent_repos | 18,551 | - |
| adoption.github_stars | 77,862 | - |
| deployment.options | `{"cloud":true,"hybrid":true,"on_prem":true,"self_hosted":true}` | `{"cloud":true}` |
| description.long | A security operations platform combining SIEM and XDR capabilities with built-in AI-driven automation and threat analysis. Autonomous agents handle detection and investigation workflows, while analysts focus on verification and decision-making. | A cloud-delivered platform that unifies security operations through AI-driven automation and machine learning, consolidating multiple SOC tools into one system to reduce manual processes, cut through noise, and accelerate threat investigation and response. |
| features.capabilities | `{"siem":true,"soar":true,"ueba":true,"deployment":"hybrid","ml_detection":true,"threat_intel":true,"pricing_basis":"ingest_gb","case_management":true,"connector_breadth":"26+ integrations including security tools (Slack, Jira, PagerDuty, ServiceNow), ","open_core_available":true,"mitre_attack_mapping":false}` | `{"siem":true,"soar":true,"deployment":"cloud","ml_detection":true,"threat_intel":true,"case_management":true,"mitre_attack_mapping":true}` |
| integrations.count | 26 | - |
| integrations.list | `[{"name":"Slack"},{"name":"Jira"},{"name":"Microsoft Teams"},{"name":"PagerDuty"},{"name":"ServiceNow"},{"name":"IBM Resilient"},{"name":"xMatters"},{"name":"OpenAI"},{"name":"Anthropic"},{"name":"Amazon Bedrock"},{"name":"Google Vertex AI"},{"name":"Microsoft Azure AI"},{"name":"Cohere"},{"name":"Mistral"},{"name":"Hugging Face"},{"name":"LangChain"},{"name":"LlamaIndex"},{"name":"Jina AI"},{"name":"IBM watsonx"},{"name":"NVIDIA"},{"name":"Aryn"},{"name":"Tableau"},{"name":"Apache Spark"},{"name":"Elasticsearch-Hadoop"},{"name":"Unstructured.io"},{"name":"Alibaba Cloud"}]` | - |
| language.primary | Java | - |
| market.availability | `{"primaryMarkets":[],"availabilityScope":"global","availableCountries":[],"notAvailableCountries":[]}` | `{"hqCountry":"US","primaryMarkets":["US","GB"],"availabilityScope":"global","availableCountries":["US","AU","BR","CA","CN","FR","DE","IN","IT","JP","KR","MX","SG","ES","TW","GB"],"notAvailableCountries":[]}` |
| platform.support | `{"cli":true,"web":true}` | `{"web":true}` |
| pricing | `{"freeTier":true,"sourceUrl":"https://www.elastic.co/pricing/faq/licensing","retrievedAt":"2026-08-14T11:06:59.285Z","freeTrialDays":14}` | - |
| pricing.free_tier | yes | - |
| pricing.model | commercial | commercial |
| pricing.price_level | low | - |
| pricing.transparent | no | - |
| release.history | `[{"url":"https://github.com/elastic/elasticsearch/releases/tag/v9.5.2","date":"2026-08-20T16:44:04Z","type":"stable","version":"v9.5.2"},{"url":"https://github.com/elastic/elasticsearch/releases/tag/v9.5.1","date":"2026-08-11T17:58:01Z","type":"stable","version":"v9.5.1"},{"url":"https://github.com/elastic/elasticsearch/releases/tag/v9.4.5","date":"2026-08-11T17:57:54Z","type":"stable","version":"v9.4.5"},{"url":"https://github.com/elastic/elasticsearch/releases/tag/v8.19.20","date":"2026-08-11T18:24:43Z","type":"stable","version":"v8.19.20"},{"url":"https://github.com/elastic/elasticsearch/releases/tag/v9.5.0","date":"2026-08-04T11:46:37Z","type":"stable","version":"v9.5.0"},{"url":"https://github.com/elastic/elasticsearch/releases/tag/v9.4.4","date":"2026-07-21T12:56:20Z","type":"stable","version":"v9.4.4"},{"url":"https://github.com/elastic/elasticsearch/releases/tag/v9.3.8","date":"2026-07-21T12:56:46Z","type":"stable","version":"v9.3.8"},{"url":"https://github.com/elastic/elasticsearch/releases/tag/v8.19.19","date":"2026-07-21T13:28:17Z","type":"stable","version":"v8.19.19"},{"url":"https://github.com/elastic/elasticsearch/releases/tag/v8.19.18","date":"2026-06-30T16:43:41Z","type":"stable","version":"v8.19.18"},{"url":"https://github.com/elastic/elasticsearch/releases/tag/v9.3.7","date":"2026-06-30T16:47:02Z","type":"stable","version":"v9.3.7"},{"url":"https://github.com/elastic/elasticsearch/releases/tag/v9.4.3","date":"2026-06-30T14:30:13Z","type":"stable","version":"v9.4.3"},{"url":"https://github.com/elastic/elasticsearch/releases/tag/v8.19.17","date":"2026-06-23T13:59:04Z","type":"stable","version":"v8.19.17"},{"url":"https://github.com/elastic/elasticsearch/releases/tag/v9.3.6","date":"2026-06-23T14:09:56Z","type":"stable","version":"v9.3.6"},{"url":"https://github.com/elastic/elasticsearch/releases/tag/v9.4.2","date":"2026-05-28T14:59:44Z","type":"stable","version":"v9.4.2"},{"url":"https://github.com/elastic/elasticsearch/releases/tag/v9.3.5","date":"2026-05-28T14:59:30Z","type":"stable","version":"v9.3.5"},{"url":"https://github.com/elastic/elasticsearch/releases/tag/v8.19.16","date":"2026-05-28T14:59:08Z","type":"stable","version":"v8.19.16"},{"url":"https://github.com/elastic/elasticsearch/releases/tag/v9.4.1","date":"2026-05-12T18:02:29Z","type":"stable","version":"v9.4.1"},{"url":"https://github.com/elastic/elasticsearch/releases/tag/v9.4.0","date":"2026-05-05T15:15:40Z","type":"stable","version":"v9.4.0"},{"url":"https://github.com/elastic/elasticsearch/releases/tag/v8.19.15","date":"2026-04-30T15:24:27Z","type":"stable","version":"v8.19.15"},{"url":"https://github.com/elastic/elasticsearch/releases/tag/v9.3.4","date":"2026-04-30T15:24:33Z","type":"stable","version":"v9.3.4"}]` | - |
| reliability.status_page | yes | yes |
| security.disclosure_policy | yes | - |
| security.gdpr | yes | yes |
| security.iso27001 | yes | - |
| security.scorecard | 6.9 | - |
| security.vulnerabilities | `{"count":45,"source":"https://advisories.ecosyste.ms/api/v1/advisories?ecosystem=maven&package_name=org.elasticsearch%3Aelasticsearch&per_page=100","last_12m":2,"max_severity":"HIGH"}` | - |

## Capabilities (SIEM & SOAR Software)

| Capability | Elastic Security | Palo Alto Cortex XSIAM |
|---|:--:|:--:|
| **Core** |  |  |
| SIEM (log correlation & detection) | ✓ | ✓ |
| SOAR (playbooks / automated response) | ✓ | ✓ |
| **Detection** |  |  |
| UEBA (behavioural analytics) | ✓ | - |
| Built-in threat intelligence | ✓ | ✓ |
| ML / anomaly detection | ✓ | ✓ |
| MITRE ATT&CK detection mapping | ✗ | ✓ |
| **Ops** |  |  |
| Case / incident management | ✓ | ✓ |
| **Pricing** |  |  |
| Pricing basis | Ingest GB/day | - |
| **Deployment** |  |  |
| Deployment | Hybrid | Cloud |
| **Integration** |  |  |
| Connector / content-pack breadth | 26+ integrations including security tools (Slack, Jira, PagerDuty, ServiceNow), | - |
| **Licensing** |  |  |
| Open-core available | ✓ | - |

*Source: Vioscale. Generated 2026-09-01T15:15:08.064Z. "-" = undocumented, not absent.*