Catch an AI SOC Analyst Bluffing · Sep 16

Save my Spot
Get a Demo

Cortex AgentiX vs D3 Morpheus: what an XSOAR customer actually has to migrate

Cortex AgentiX is Palo Alto Networks’ named successor to Cortex XSOAR. Moving to it means a new SaaS tenant, a per-user licence with metered compute units and six-month retention, a cases-and-issues data model, and no published XSOAR-to-AgentiX migration guide as of August 27, 2026. Moving to D3 Morpheus means D3 converts your playbooks like-for-like, prices one capped annual number, and leaves your SIEM, EDR, email security, identity and ticketing untouched.

Is Cortex XSOAR being discontinued?

No. There’s no product-wide end-of-life notice for XSOAR, and XSOAR 8.15 shipped in July 2026. What has happened: Palo Alto named Cortex AgentiX “the next generation of Cortex XSOAR” on October 28, 2025; the XSOAR professional-services SKUs reached end-of-sale and end-of-life on February 1, 2026; and XSOAR 6.12 and 6.13 on-prem reached end-of-life on June 30, 2026 (6.14 is still supported). New capability ships in AgentiX. That’s roadmap gravity, and it’s a fact even when end-of-life isn’t.

What moving to AgentiX requires

Everything below is from Palo Alto’s own documentation and release notes.

Requirement Cortex AgentiX (documented) D3 Morpheus
Tenant and deployment New tenant activated through Cortex Gateway, hosted in one of 11 regions. Engines reinstalled. No on-premises documentation. D3 sets up the tenant and registers integrations as part of the migration. Hosting options per deal.
Licence Per user per year. Base: 2 users, 400 compute units. Enterprise: 4 users, 800 compute units. Development tenant is a separate licence. One capped annual price by alert volume. Seats and an allocation of full investigations included.
Metering Compute units are consumed by XQL query APIs; “queries called without enough quota will fail.” Add-ons in blocks of 50 minimum; unused units don’t carry over. Agent and LLM usage “does not consume compute units at this time.” Published overage: $0.97 per event above capacity; investigation overage from $2.25 to as low as $0.97. No credits, tokens or query quota.
Retention Six months by default. Each add-on buys 31 more days. Incident history imported to the scope agreed in discovery. No monthly retention meter.
Data model Cases and issues. XQL as the query language. No documented statement that XSOAR incident types, fields, layouts or classifiers work unchanged. Incident-based. XSOAR incident types, fields and layouts map like-for-like.
Playbooks Marketplace content packs carry over. Custom playbooks, scripts and configuration are re-imported. No XSOAR-to-AgentiX migration guide found; only XSOAR 6-to-8 is documented. D3 converts your playbooks with a side-by-side diff per playbook, replays your closed incidents for a parity report, then runs beside XSOAR on live alerts.
AI in the playbook AI prompt tasks as single steps on Palo Alto-hosted models by region (Claude and Gemini menu). Agents are a separate layer. Agentic Response in preview; AI playbook builder in private preview. Read-only Attack Path Discovery, AI Tasks and bounded Agentic Tasks embedded in your own playbooks. Four autonomy modes, set per alert type, reversible. Provider choice for models.
Your other tools Standalone AgentiX keeps your SIEM. The AI-SOC investment and bundle economics centre on XSIAM. Works with your entire stack. Splunk, Sentinel, QRadar, Elastic, Google SecOps. CrowdStrike, Defender, SentinelOne, Cortex XDR. Proofpoint, Microsoft 365. Okta, Entra ID. Jira, ServiceNow. 800+ self-healing integrations.
Who does the work You or a partner. XSOAR professional-services SKUs are end-of-sale. D3 migration architects on a fixed 60-day plan, at no charge in the XSOAR Exit Program.

Why XSOAR customers switch to Morpheus

It’s 4:55 on a Friday and your renewal is 90 days out. Palo Alto has quoted AgentiX with four line items you can’t forecast, and nobody has put a playbook-compatibility statement in writing. Here is what moving to Morpheus looks like instead.

  • You migrate once, and you can read it. Your playbooks become Morpheus playbooks your engineers recognise. Each one comes with a diff. Each one gets your sign-off.
  • The agentic step is a switch, not a project. Investigate, decide, act. Three independent switches inside the playbook, turned on per alert type, turned off in minutes. No second framework.
  • One number. Seats and investigations included. Overage published. Renewal terms in the order form. Your CFO can put it in a three-year budget.
  • Nothing else changes. Keep the SIEM you tuned, the EDR you standardised on, the email gateway, the identity provider, the Jira and ServiceNow workflows. Morpheus connects to all of it.
  • No double payment. Billing starts when your XSOAR contract ends. The migration runs inside that window.
  • The worst case is nothing. XSOAR stays live through the parallel run. Cutover happens on your written sign-off, or it doesn’t happen.

Questions to ask Palo Alto before you renew

  1. Will our XSOAR incident types, fields, layouts, classifiers and mappers run unchanged in AgentiX? If not, who converts them, and at what price?
  2. Is there an XSOAR-to-AgentiX migration wizard? What carries over?
  3. Is AgentiX available on-premises?
  4. What is our compute-unit allocation, what consumes it, and will LLM usage be metered in future?
  5. What does retaining incident history beyond six months cost per year?
  6. Which models are available in our region, and can we use our own?

See the XSOAR Exit Program · Run a two-day evaluation on your own alerts · Legacy SOAR Migration Program

Frequently asked questions

Is Cortex XSOAR being discontinued?

No. XSOAR has no product-wide end-of-life notice and XSOAR 8 still ships. Palo Alto has named Cortex AgentiX as XSOAR’s next generation (Oct 28, 2025), ended sale of the XSOAR professional-services SKUs (Feb 1, 2026), and retired XSOAR 6.12 and 6.13 (Jun 30, 2026).

What is Cortex AgentiX?

Cortex AgentiX is Palo Alto Networks’ agentic security automation platform, named “the next generation of Cortex XSOAR.” It ships standalone and inside Cortex XSIAM, XDR and Cortex Cloud, and is licensed per user with compute units for XQL queries and six months of default retention.

How is AgentiX priced?

Per Palo Alto documentation, AgentiX requires a yearly licence per user. Base includes 2 users and 400 compute units; Enterprise includes 4 users and 800. Compute units are consumed by XQL query APIs and queries fail when the quota is exhausted. Retention beyond six months is sold in 31-day add-ons.

Do XSOAR playbooks work in AgentiX?

Palo Alto’s documentation, as of August 27, 2026, contains no XSOAR-to-AgentiX migration guide and no statement that XSOAR incident types, fields, layouts or classifiers work unchanged. Marketplace content packs carry over; custom content is re-imported. Ask Palo Alto for a written compatibility statement.

Does D3 Morpheus work with my existing SIEM, EDR and ticketing?

Yes. Morpheus connects to Splunk, Sentinel, QRadar, Elastic and Google SecOps; CrowdStrike, Defender, SentinelOne and Cortex XDR; email security and identity providers; and Jira and ServiceNow, through 800+ self-healing integrations. You don’t replace any of them to move off XSOAR.

How does D3 migrate XSOAR playbooks?

D3 exports your XSOAR content, converts playbooks, incident configuration and reports like-for-like with a side-by-side diff per playbook, replays your closed incidents for a parity report, runs Morpheus beside XSOAR on live alerts, and cuts over on your written sign-off. The plan is 60 days.

Sources

  1. Palo Alto Networks press release, Oct 28, 2025: Cortex AgentiX unveiled as “the next generation of Cortex XSOAR.” paloaltonetworks.com
  2. Palo Alto Networks End-of-Sale announcements (legacy XSOAR professional-services SKUs, Feb 1, 2026) and End-of-Life summary (XSOAR 6.12/6.13, Jun 30, 2026). end-of-sale · end-of-life summary
  3. Cortex AgentiX documentation: “Understand Cortex AgentiX licenses” (per-user licence, Base/Enterprise compute-unit quotas) and “Data retention policy” (six-month default, 31-day add-ons), retrieved Aug 27, 2026. licences · data retention
  4. Palo Alto Networks blog: “What’s New in Cortex (July ’26)” (frontier models by region, AI-driven playbook builder in private preview) and “The SOC Is Now Agentic” (Feb 2026). July ’26 · Feb 2026

Cortex, XSOAR, XSIAM and AgentiX are trademarks of Palo Alto Networks, Inc. All other marks belong to their owners. D3 Security is not affiliated with Palo Alto Networks. Competitor information reflects public documentation on the retrieval date and may change.