Open Source Alternatives to Palo Alto Cortex XSOAR

A security automation platform designed for security operations centers to automate incident response workflows. The software reduces alert noise and eliminates repetitive manual tasks through a visual playbook editor and over 900 prebuilt integration and automation packs. It provides a virtual war room for real time analyst collaboration, ChatOps, and a command line interface for investigations. The platform integrates incident data, indicators, and threat intelligence to accelerate remediation and automate indicator processing. It is used by security analysts to orchestrate response across a product stack and document knowledge for audit reporting.

Whether you want to cut software costs or escape vendor lock-in, these open source alternatives to Palo Alto Cortex XSOAR give you an option you fully own. You can self-host them, so your data stays on infrastructure you control. This page lists 1 open source alternative to Palo Alto Cortex XSOAR. The most popular is Tracecat. It uses the AGPL-3.0 license and ships an official Docker image.