What it does
Cortex XCOR is Palo Alto Networks' SaaS observability platform for cloud-native applications and infrastructure. It brings metrics, traces, logs, change events, service-level objectives, and dashboards into shared service views. Its current product site also presents chat-guided incident investigation and telemetry cost optimization.
Investigating service health
Cortex XCOR works with telemetry from a customer tenant. Its documentation describes service pages that automatically discover services and present their health, telemetry, monitors, and SLOs. A documented workflow is to select Services, find a trend or incident, inspect the queries behind a visualization, and turn useful queries into dashboard panels. SLOs and monitors can help detect reliability problems, while change events add deployment or configuration context to dashboards.
For a wider investigation, the docs describe notebooks for collecting panels, links, and notes in one place. The product site presents Cortex XCOR Operator as a chat interface for AI-assisted investigation; that is a vendor-described capability, not a tested result.
APIs and pricing
The platform has a documented HTTP/JSON API authenticated with an API token. The API guide says only publicly documented endpoints are supported and that many requests require an unrestricted service account. This matters to teams automating configuration or building GitOps workflows.
Licensing documentation describes consumption and capacity pricing; the tenant contract determines which applies. The reviewed official docs do not publish standard rates, so prospective buyers should confirm pricing and terms with Palo Alto Networks.
Strengths
- Combines metrics, traces, logs, and change events with service views, dashboards, monitors, and SLOs.
- Automatically discovers services and links service-level views to telemetry and queries.
- Provides documented HTTP/JSON APIs for observability data and configuration workflows.
- Offers consumption pricing that can allocate credits across telemetry types, alongside a capacity model.
Watch out for
- API use requires a token, and many API requests require an unrestricted service account; undocumented endpoints are not promised to remain stable.
Best for
- Cloud-native SRE and engineering teams that need service-level views across metrics, traces, logs, and changes.
- Organizations that want to manage telemetry utility and cost alongside monitoring workflows.
- Teams that need documented APIs for configuration or GitOps automation.
Sources
- Cortex® XCOR™ - Palo Alto Networks (Oct 25, 2026)
- Cortex XCOR documentation - Cortex XCOR Documentation (Oct 25, 2026)
- Observe your telemetry data - Cortex XCOR Documentation (Oct 25, 2026)
- Licensing concepts - Cortex XCOR Documentation (Oct 25, 2026)
- Get started with the Cortex XCOR API - Cortex XCOR Documentation (Oct 25, 2026)
- Real User Monitoring for Web & Mobile (Oct 25, 2026)