Palo Alto Networks Cortex XSOAR vs. Proofpoint Threat Response Auto-Pull

XSOAR is well suited for phishing detection and response. Phishing alerts are as much of a
problem today as they were decades ago. This is because: ●Attackers Can leverage automation to launch high-quantity phishing attacks with the click
of a button.
●Spear Phishing attacks are sophisticated and sometimes indistinguishable from real
emails, resulting in compromise through human error.
●Security Teams aren’t able to follow set processes while responding to phishing alerts.
They must coordinate across email inboxes, threat intel, NGFW, ticketing, and
other tools. Each tool has different consoles, data conventions, and contexts,
making it difficult for security teams to fill in the gaps while minimizing
errors. XSOAR is less suited for analyzing traffic.

Incentivized

It is very well suited for any organization, though the pricing is more for larger organizations. Having auto pull available means you have fewer worries that phishing emails end up in users' mailboxes.

Incentivized

• Automation with immediate security responses.
• Comprehensive phishing protection and increased email protection.
• Analysis and reporting feature.
• Intuitive and easy-to-view panels.
• Alerts by email and sms of incidents for the administration.
• Centralized monitoring.

Incentivized

• Finds malicious messages in users mailboxes that were not previously detected.
• Gives good data about messages post-detection.
• Integrates with AD.

Incentivized

• SAML is not stable, it gives a lot of issues.
• Pre-defined playbooks need a lot of fine tuning
• Lacks proper documentation

Incentivized

• Would like an Azure virtual machine version of it. Currently, it's only supported on VMware and AWS.
• Configuring authentication certificates on it is not easy.
• It does not work with RSASSA-PSS signed certificates.

Incentivized

It has proven to be far to valuable and effective to consider getting rid of it. Until something better comes along, this is staying in our product stack.

Incentivized

It's easy to use and requires very little administrator hands on.

Incentivized

They are quick to respond and have talented support personnel.

Incentivized

It was much easier than we all anticipated.

Incentivized

The quantity of integrations with security solutions is highest in Palo Alto Solution. The capacity to identify anomalous events is much better in Palo Alto Networks Cortex XSOAR. The flexibility of increased storage area is better as well. The dashboard is very intuitive about showing the most important incidents and how to resolve them.

Incentivized

TRAP had fewer false positives and caught more malicious emails. With the host of companion products, it was more complete package. It gives us the ability to pull emails using an admin-submitted CVS file of emails to pull. EOP does not have this capability.

Incentivized

• Reduces man-hours spent on handling false-positive repetitive alerts, daily 40% of analysts' time saved during a 24 hour period. In the initial stage, it was 75% of analysts' time saved due to the new environment, less maturity, and a lot of un-finetuned alerts.
• Single pane for notification, collaboration, and action (to some extent) which is a major time saver compared to the conventional method of meeting invites and emails back-and-forth.
• Secure documentation of business-critical incidents with a need-to-know basis of access according to each role.

• Helped mitigate the email portion of our penetration test entirely.
• Made us aware of the amount of suspicious emails being delivered.
• Prevented malware spreading through mail.

Incentivized