What should a Cortex XSOAR team migrate to, now that Palo Alto Networks has named XSOAR’s successor? Palo Alto named Cortex AgentiX “the next generation of Cortex XSOAR” on October 28, 2025. XSOAR is still supported and XSOAR 8 still ships. New capability ships in AgentiX, though, and moving there means a new tenant, a new data model and a new licence. For most XSOAR teams, a migration is coming either way. This research compares the three paths open to an XSOAR team. It then sets out the path D3 Security delivers through the XSOAR Exit Program: playbooks converted like-for-like in 60 days, a parallel run on live alerts, cutover on the customer’s sign-off, and a move from deterministic playbooks to governed agentic operations one alert type at a time. Buyers should apply the evaluation questions in this paper to every option, including D3.
Key Findings
- Cortex XSOAR is not end-of-life. Three dated events changed its direction: Palo Alto named Cortex AgentiX the next generation of XSOAR (October 28, 2025), the XSOAR professional-services SKUs reached end-of-sale (February 1, 2026), and XSOAR 6.12 and 6.13 on-prem reached end-of-life (June 30, 2026). XSOAR 6.14 and XSOAR 8 remain supported.
- Moving to Cortex AgentiX is a re-platform. Palo Alto’s documentation describes a new tenant, a cases-and-issues data model, a per-user licence with compute units consumed by XQL queries, and six months of default retention. As of August 27, 2026, it contained no XSOAR-to-AgentiX migration guide.
- The cost that outlasts any migration is playbook maintenance. Integration upkeep, branch sprawl and schema drift follow a playbook library to whatever platform it is rebuilt on.
- A migration can also be the step from deterministic automation to agentic operations, when the destination runs both on one engine. Morpheus converts XSOAR playbooks like-for-like, embeds gated investigation, decision and action steps inside them, and lets teams raise autonomy per alert type through four modes.
- The financial risk of switching sits in the overlap and in the unknowns. The XSOAR Exit Program addresses both: billing starts when the XSOAR contract ends, year one is priced at or under the current XSOAR line, and XSOAR stays live until the customer signs the cutover.
Recommendations
Security operations leaders running Cortex XSOAR should:
- Treat the next renewal as a migration decision. Whether you renew, re-platform or switch, choose the destination before the renewal quote chooses it for you.
- Get written answers before you sign. Ask Palo Alto, in writing, whether your incident types, fields, layouts, classifiers and mappers carry over to AgentiX, and what the compute-unit and retention terms cost over the full contract.
- Inventory before you commit. Tag every playbook migrate, simplify, retire or agentic. Most mature estates carry playbooks that are no longer worth keeping.
- Separate the migration from the autonomy decision. Convert first, prove parity on recorded and live incidents, then raise autonomy one alert type at a time. A destination that forces both changes at once concentrates the risk in one cutover.
- Hold every vendor to parity evidence. Require a diff per playbook, a replay of closed incidents, a parallel run on live alerts and cutover on your written acceptance criteria. Hold D3 to the same standard.
Market Context
Many enterprise SOCs and service providers run large playbook libraries on Cortex XSOAR. Those libraries hold years of integrations, exception branches, incident types and reports. Over the past year, Palo Alto Networks has made three moves that change where that work goes next.
- October 28, 2025. Palo Alto named Cortex AgentiX “the next generation of Cortex XSOAR”.
- February 1, 2026. The XSOAR professional-services SKUs reached end-of-sale.
- June 30, 2026. XSOAR 6.12 and 6.13 on-prem reached end-of-life. XSOAR 6.14 remains supported.
None of these events switches XSOAR off. Together, they move Palo Alto’s roadmap and new capability to a different product. For an XSOAR team, that turns the next renewal into a decision about where the playbooks will live for the next several years.
Analysis
Is Cortex XSOAR end-of-life?
No. Cortex XSOAR has no product-wide end-of-life notice, and XSOAR 8 continues to ship. This paper makes no claim that XSOAR is end-of-life. What has changed is direction. New capability ships in the successor product, older 6.x releases have retired on schedule, and Palo Alto no longer sells the XSOAR professional-services SKUs.
What does moving to Cortex AgentiX involve?
Palo Alto’s own documentation, as of August 27, 2026, describes the move as a new deployment:
- A new tenant. AgentiX is activated as a new SaaS tenant through Cortex Gateway, and engines are reinstalled.
- A new data model. Cases and issues, with XQL as the query language. The documentation contains no statement that XSOAR incident types, fields, layouts or classifiers work unchanged.
- A new licence. A yearly licence per user, with compute units consumed by XQL query APIs. Queries called without enough quota fail.
- A retention limit. Six months by default, extended in 31-day add-ons.
- Playbook content. Marketplace content packs carry over. Custom playbooks, scripts and configuration are re-imported. The only documented migration path is XSOAR 6 to XSOAR 8.
AgentiX is a capable platform. For a team consolidating on a single Palo Alto stack, it is a legitimate destination. For an XSOAR team that must migrate either way, it means rebuilding on a new data model while keeping the maintenance model the playbooks already carry. A requirement-by-requirement comparison is on the Cortex AgentiX vs D3 Morpheus page.
Why does playbook maintenance matter more than the migration deadline?
The licence is the visible cost of a SOAR platform. The larger cost is the engineering time spent keeping playbooks working as the stack changes underneath them. Every vendor API change, detection schema change and new alert variant breaks a path somewhere in the library. That is playbook drift, and it recurs every quarter.
Vendor API changes silently break playbook steps. Engineers spend their hours chasing failures across the integration estate.
Every new alert variant adds another conditional. Playbooks grow into decision trees only their author can read.
SIEM field renames and parser changes cascade into every playbook that consumes them. One change produces many breaks.
A re-platform resets the library and keeps the drift. Morpheus repairs integration drift automatically through 800+ self-healing integrations, with a production median of 18 minutes to repair against an industry baseline of 4 to 6 weeks. Attack Path Discovery performs L2 investigation natively, which retires many of the hand-built investigation branches a migration would otherwise carry across.
What is the path from deterministic playbooks to agentic operations?
An XSOAR library encodes deterministic logic. Morpheus was built as a SOAR first, so XSOAR playbooks convert onto it like-for-like. Your engineers can read the result, and each playbook arrives with a side-by-side diff for sign-off.
The agentic layer sits inside those converted playbooks as three independent steps. Each one is gated at delivery and switched on per alert type.
Investigate
Read-only Attack Path Discovery investigates the alert across identities, endpoints, cloud and email, correlating signals, validating indicators and reconstructing the attack timeline.
Decide
AI Tasks add decision steps inside the playbook. Every verdict is graded Confirmed, Inferred or Gap by the evidence behind it.
Act
Bounded Agentic Tasks act within the scope and approval gates you set. Response still runs on deterministic playbooks with hard guardrails.
Autonomy is then set per alert type through four autonomy modes:
- Deterministic. Rule-based automation only, with no AI judgment in execution. Converted playbooks are delivered in this mode.
- AI-Assisted. Morpheus investigates and recommends. A human approves each response action.
- AI-Led. Morpheus executes within gates. A human approves the consequential and high command-risk actions.
- Autonomous. Morpheus investigates and responds end to end within pre-set command-risk gates, with human override available at any stage.
Most teams start in Deterministic and raise AI-Assisted on their noisiest alert types first. Any alert type can drop back to Deterministic at any time without a second migration. Every mode writes to one audit trail per incident.
Migrate once, then raise autonomy by configuration. The agentic step becomes a setting per alert type, reversible in minutes, on the same engine and the same audit trail.
On the investigation side, up to 95% of alerts are triaged and investigated to L2 depth in under two minutes, per customer-reported production data, July 2026. When Morpheus is uncertain, it defers to a human.
How do the three paths compare?
Judge each path by what it leaves you running in three years: the maintenance load, the route to autonomy and who carries the migration work. AgentiX details reflect Palo Alto documentation as of August 27, 2026.
| Path | Migration work | Ongoing maintenance | Route to autonomy |
|---|---|---|---|
| Stay on Cortex XSOAR | None now | Full playbook maintenance continues | Deterministic playbooks; new capability ships in AgentiX |
| Re-platform to Cortex AgentiX | Re-import, rebuild | Full playbook maintenance moves to the new tenant | AI prompt tasks and a separate agent layer, on a per-user licence with compute units |
| Migrate to D3 Morpheus | Converted by D3 | Integration drift repaired automatically, 18-minute production median | Four autonomy modes per alert type, on one engine, reversible |
What does the XSOAR Exit Program include?
The XSOAR Exit Program is D3 Security’s fixed offer for Cortex XSOAR customers. It takes on the migration work and the overlap cost that make a switch hard to approve.
- Playbook conversion by D3. Migration architects export your XSOAR content, inventory every playbook, script, integration, incident type, field, layout and report, and convert what you keep. You get a side-by-side diff per playbook and sign off on each one.
- Agentic-ready delivery. For the playbooks you choose, D3 embeds read-only Attack Path Discovery investigation, AI Tasks and bounded Agentic Tasks, delivered in Deterministic mode with the agentic steps gated. Playbooks you keep deterministic are converted like-for-like.
- Replay and parallel run. D3 replays your closed XSOAR incidents through the converted playbooks and hands you a parity report. Morpheus then runs beside XSOAR on live alerts. XSOAR stays on until you switch it off.
- No double payment. Your Morpheus subscription starts at signature. Billing starts on your XSOAR contract end date, up to the program’s six-month bridge limit. The migration happens inside that window at no charge.
- Contract match. Year one is priced at or under your current XSOAR line, as one capped annual number. Seats, alert capacity and an allocation of full investigations are included.
- Your stack stays put. Keep your SIEM, EDR, email security, identity provider and ticketing. Morpheus connects to all of it through 800+ self-healing integrations.
- A written plan. The 60-day phase plan, acceptance criteria and agentic-ready scope are attached to the order form.
Eligibility covers current Cortex XSOAR customers on 6.x or 8.x, SaaS or on-prem, single- or multi-tenant, with a renewal within 12 months of enrolment. Orders must be signed by June 30, 2027, on a 36-month minimum term. Custom integrations outside the D3 library, incident history beyond the agreed scope and custom development are scoped in discovery. Service providers can enrol MSSP XSOAR estates and cut over client by client through XSOAR migration for MSSPs.
What happens in the 60 days?
- Weeks 1 to 2, discovery. Inventory and readiness report. Every playbook is tagged migrate, simplify, retire or agentic, and you pick the agentic set.
- Weeks 3 to 4, conversion. Converted playbooks with diffs. Incident types, fields and layouts mapped like-for-like. Reports rebuilt to the KPIs your leadership already sees.
- Weeks 5 to 6, replay and parallel run. A parity report on your recorded incidents, then live alerts on both platforms.
- Week 7, validation. Parity confirmed against your criteria. Autonomy set per alert type.
- Week 8, cutover. Production shifts by incident type on your written sign-off. Billing begins at your XSOAR end date.
If the acceptance criteria are not met, XSOAR keeps running and nothing has changed.
Evaluation Questions for Any XSOAR Migration
- Will our XSOAR incident types, fields, layouts, classifiers and mappers run unchanged on the new platform? If not, who converts them, and at what price?
- Is there a documented migration path from XSOAR, and what carries over?
- Is the destination available on-premises?
- What does the licence meter, and could AI or LLM usage be metered in future?
- What does retaining incident history beyond the default period cost per year?
- Does this migration reduce our playbook-maintenance load, or move it to a new platform?
- What is your production time to repair when a vendor changes an integration API?
- Can we move from deterministic playbooks to autonomous response per alert type without a second migration?
- Will we pay for two platforms during the migration?
- What happens if the migration fails our acceptance criteria?
Evidence and Assumptions
Palo Alto facts are dated to the source. Competitor documentation changes, so confirm current terms with Palo Alto before a renewal decision.
Frequently Asked Questions
Is Cortex XSOAR end-of-life?
No. Cortex XSOAR has no product-wide end-of-life notice, and XSOAR 8 still ships. Palo Alto named Cortex AgentiX the next generation of XSOAR on October 28, 2025, ended sale of the XSOAR professional-services SKUs on February 1, 2026, and retired XSOAR 6.12 and 6.13 on-prem on June 30, 2026. XSOAR 6.14 remains supported.
What is Cortex AgentiX?
Cortex AgentiX is Palo Alto Networks’ agentic security automation platform, named “the next generation of Cortex XSOAR.” It ships standalone and inside Cortex XSIAM, XDR and Cortex Cloud. Per Palo Alto documentation retrieved August 27, 2026, it is licensed per user, with compute units consumed by XQL queries and six months of default retention.
Do XSOAR playbooks work in Cortex AgentiX?
As of August 27, 2026, Palo Alto’s documentation contained no XSOAR-to-AgentiX migration guide and no statement that XSOAR incident types, fields, layouts or classifiers work unchanged. Marketplace content packs carry over, and custom content is re-imported. Ask Palo Alto for a written compatibility statement before you renew.
How does D3 migrate XSOAR playbooks to Morpheus?
D3 migration architects export your XSOAR content, convert playbooks, incident configuration and reports like-for-like with a side-by-side diff per playbook, replay your closed incidents for a parity report, run Morpheus beside XSOAR on live alerts, and cut over on your written sign-off. The plan runs 60 days.
What does agentic-ready mean in the XSOAR Exit Program?
For the playbooks you choose, D3 embeds read-only investigation, AI decision steps and bounded agents inside the playbook, delivered in Deterministic mode with those steps gated. You raise autonomy per alert type through four modes (Deterministic, AI-Assisted, AI-Led and Autonomous) and can drop back to Deterministic at any time without re-migrating.
Will we pay for XSOAR and Morpheus at the same time?
No. Under the XSOAR Exit Program, your Morpheus subscription starts at signature, and billing starts on your XSOAR contract end date, up to the program’s six-month bridge limit. The migration and parallel run happen inside that window at no charge.
Do we have to replace our SIEM, EDR or ticketing to leave XSOAR?
No. Morpheus works with the stack you run today, including Splunk, Microsoft Sentinel, QRadar, Elastic and Google SecOps; CrowdStrike, Microsoft Defender, SentinelOne and Cortex XDR; and Jira and ServiceNow. It connects through 800+ self-healing integrations.
Find out what your XSOAR migration looks like
Send us your XSOAR version and renewal quarter. We return the inventory and the migrate, simplify, retire and agentic map, with no commitment and no meeting required.
Get the free XSOAR Readiness Report Book a Demo
