SOAR playbooks that run themselves — Palo Alto Networks
June 2023 · from the workshop
As a Senior Customer Success Engineer on Cortex XSOAR at Palo Alto Networks, I carried a $7M ARR portfolio of enterprise security customers — SOCs whose alert volume no human team could keep up with by hand.
Enterprise incident response was manual at every step: an alert fires, an analyst enriches it across half a dozen consoles, opens a ticket, notifies the right people, and starts the response — twenty minutes of copy-paste per incident, thousands of incidents a month. The tooling existed; the system didn’t.