For Cortex XSOAR customers
Your XSOAR renewal is a migration either way. Choose the one you control.
Palo Alto has named Cortex AgentiX the next generation of XSOAR: a new tenant, a new data model, a per-user licence with metered compute units, and no published XSOAR-to-AgentiX migration guide as of October 5, 2026. D3 moves SOC teams off XSOAR every week. Playbooks converted like-for-like, parallel run on live alerts, cutover on your criteria, billing starts when your XSOAR contract ends.
Send us your exported XSOAR content. We return every playbook tagged migrate, simplify, retire or agentic. No meeting required.
You’re on XSOAR. It works. Nobody wants a migration.
You’ve built years of playbooks, your analysts know every screen, and the renewal quote is already in someone’s inbox. Staying feels like the safe choice.
The point of this page is simple: you’re already in a migration. The only question is whether Palo Alto runs it, or you do.
What Palo Alto has said, with dates.
Oct 28, 2025
Palo Alto names Cortex AgentiX “the next generation of Cortex XSOAR”.
Feb 1, 2026
XSOAR professional-services SKUs reach end-of-sale.
Jun 30, 2026
XSOAR 6.12 and 6.13 reach end-of-life. 6.14 is supported.
Sep 30, 2029
Palo Alto lists this date as end-of-life for all XSOAR 8.x on-prem customers. XSOAR SaaS has no end-of-life date.
XSOAR still ships and it isn’t end-of-life. But new capability ships in AgentiX, and moving to it means a new SaaS tenant, a cases-and-issues data model, a per-user licence with metered compute units, six months of default retention, and, as of October 5, 2026, no published migration guide and no written statement that your incident types, fields, layouts or classifiers carry over.
Isn’t staying the safe choice?
Only if three things you haven’t been promised in writing turn out to be true.
01 · Migration path
Your content carries over
A migration guide arrives before your renewal, and your custom playbooks, scripts, incident types, layouts and classifiers carry over without a rebuild.
02 · Compute-unit meter
The meter stays off your playbooks
The meter stays off for the life of the contract. Today it meters XQL queries. Agent and LLM usage “does not consume compute units at this time.”
03 · Product roadmap
What you renew is what you run
The product you renew is the product you’ll be running in eighteen months.
Six questions to put to your Palo Alto account team before you renew
Will our XSOAR incident types, fields, layouts, classifiers and mappers run unchanged in AgentiX? If not, who converts them, and at what price?
Is there an XSOAR-to-AgentiX migration wizard? What carries over?
Is AgentiX available on-premises?
What is our compute-unit allocation, what consumes it, and will LLM usage be metered in future?
What does retaining incident history beyond six months cost per year?
Which models are available in our region, and can we use our own?
If you get six written answers you like, renew. If you don’t, keep reading.
We do this every week.
Moving SOC teams off Cortex XSOAR is the largest part of D3’s business, with a dedicated program and a dedicated team.
80%+
of D3’s new business in recent years came from teams moving off legacy SOAR.
1,000+
customer tenants moved to D3 by one global MDR provider after XSOAR failed under their query load.
60 days
from exported content bundle to cutover, on a written plan attached to the order form.
D3’s migration architects have converted hundreds of XSOAR playbooks for enterprises and service providers. They know which playbook patterns convert cleanly, which ones should be simplified, and which ones were never worth keeping. That’s why the readiness report exists: you hand us the export, and we hand you the map before you’ve committed to anything.
The XSOAR Exit Program, in six promises.
We convert your playbooks.
Playbooks, incident types, fields, layouts and reports converted like-for-like. A side-by-side diff per playbook. Your sign-off on each one.
No risk of a failed migration.
We replay your closed incidents for a parity report, then run beside XSOAR on live alerts. Cutover happens only when it passes your acceptance criteria.
No double payment.
Billing starts the day your XSOAR contract ends. The migration runs inside that window at no charge.
One number, at or under your XSOAR line.
Annual subscription sized to your alert volume envelope, with the AI in the platform price. No tokens, no compute units, no query quota.
Your stack stays put.
Splunk, Sentinel, QRadar, CrowdStrike, Defender, Okta, Entra ID, ServiceNow and Jira. 800+ integrations that repair themselves when a vendor changes an API.
Agentic on your terms.
The playbooks you choose arrive agentic-ready in Deterministic mode with the AI steps gated. Raise autonomy one alert type at a time. Every verdict graded by its evidence.
Billing begins at your XSOAR end date. Full program terms and eligibility.
What you land on.
A platform with the same deterministic lineage as XSOAR, plus an agentic layer you can check: every alert investigated to L2 depth, every verdict graded Confirmed, Inferred or Gap, one audit trail per incident.
Morpheus was built as a SOAR before it was anything else, which is why XSOAR playbooks convert onto it rather than getting rewritten. The difference is what runs on top. Attack Path Discovery, D3’s investigation engine, investigates every alert across identities, endpoints, cloud, and email infrastructure before an analyst opens it, correlating signals across tools, validating IOCs, and reconstructing attack timelines. Up to 95% are triaged and investigated to L2 depth in under two minutes, per customer-reported production data, July 2026. When Morpheus is uncertain, it defers to a human. Response still runs on deterministic playbooks with hard guardrails. Your team recognises the engine and gains the analyst.
Read more about the Morpheus platform and the four autonomy modes.
Where to next.
Start with the readiness report
Free. Five business days. No meeting required.
Compare AgentiX and Morpheus
Requirement by requirement, with Palo Alto sources.
Read the program terms
Eligibility, contract match, the 60-day plan.
Running a service on XSOAR?
Client-by-client cutover and per-tenant autonomy.
On Splunk SOAR, Swimlane, Torq or Tines? The Legacy SOAR Migration Program covers those too. Same conversion, same parallel run, same sign-off.
Looking for the generic comparison? See Morpheus as an XSOAR alternative.
faqs
Questions XSOAR teams ask us
Is Cortex XSOAR being discontinued?
No. XSOAR has no product-wide end-of-life notice, and XSOAR SaaS has no end-of-life date. Palo Alto has named Cortex AgentiX as XSOAR’s next generation (Oct 28, 2025), ended sale of the XSOAR professional-services SKUs (Feb 1, 2026), retired XSOAR 6.12 and 6.13 (Jun 30, 2026), and lists Sep 30, 2029 as end-of-life for XSOAR 8.x on-prem. New capability ships in AgentiX.
Do our XSOAR playbooks come with us?
Yes. D3 exports your XSOAR content, converts playbooks, incident types, fields, layouts and reports like-for-like, and gives you a side-by-side diff per playbook to sign off. Marketplace content is mapped to D3’s integration library. Custom integrations outside the library are scoped in the readiness report.
Will we pay for XSOAR and Morpheus at the same time?
No. Your Morpheus subscription starts at signature, but billing starts on your XSOAR contract end date, up to the program’s bridge limit. The migration and parallel run happen inside that window at no charge.
What if the migration doesn’t meet our criteria?
XSOAR stays live through the parallel run, and cutover happens only on your written sign-off against acceptance criteria you set in discovery. If they aren’t met, you keep running XSOAR and nothing has changed.
How long does it take?
Sixty days on a written plan: readiness report in weeks one and two, conversion in three and four, replay and parallel run in five and six, validation in week seven, cutover in week eight. The plan, acceptance criteria and agentic-ready scope are attached to the order form.
Do we have to change our SIEM, EDR or ticketing?
No. Morpheus works with the stack you run today through 800+ self-healing integrations, including Splunk, Sentinel, QRadar, Elastic, Google SecOps, CrowdStrike, Defender, SentinelOne, Cortex XDR, Okta, Entra ID, ServiceNow and Jira.
How is Morpheus priced compared with XSOAR or AgentiX?
Annual subscription sized to your alert volume envelope, with the AI in the platform price rather than on a usage meter: no token costs, no compute units, no query quota. Under the Exit Program, year one lands at or under your current XSOAR line. Overage per alert is published in advance.
What does agentic-ready mean?
For the playbooks you choose, D3 embeds read-only investigation, AI decision steps and bounded agents inside the playbook, delivered in Deterministic mode with those steps gated. You raise autonomy per alert type through four modes (Deterministic, AI-Assisted, AI-Led, Autonomous) and can drop back at any time without re-migrating. Every verdict is graded Confirmed, Inferred or Gap. When Morpheus is uncertain, it defers to a human.
Find out what your migration actually looks like.
Export your XSOAR content bundle and send it over. Within five business days you get the full inventory with every playbook tagged migrate, simplify, retire or agentic, and a plan you can take into your renewal call. No commitment, no meeting required.
Prefer to talk first? Book a 30-minute walkthrough.
D3 Security builds Morpheus, the accountable agentic SOC platform. Vancouver, Canada. 100% Canadian company and hosting. Cortex, XSOAR, XSIAM and AgentiX are trademarks of Palo Alto Networks, Inc. D3 Security is not affiliated with Palo Alto Networks. Competitor information reflects public documentation retrieved October 5, 2026 and may change.