Catch an AI SOC Analyst Bluffing · Sep 16

Save my Spot
Get a Demo

The XSOAR Exit Program: move from Cortex XSOAR to D3 Morpheus without paying twice

The XSOAR Exit Program is a fixed offer for Cortex XSOAR customers: D3 converts your playbooks, incident configuration and reports onto D3 Morpheus, delivers your SOC agentic-ready for the playbooks you choose, runs beside XSOAR until you sign the cutover, starts billing on the day your XSOAR contract ends, and prices year one at or under your current XSOAR line. Your SIEM, EDR, email security, identity provider, Jira and ServiceNow stay exactly where they are.

Why an exit program exists

Palo Alto Networks named Cortex AgentiX “the next generation of Cortex XSOAR” on October 28, 2025. On February 1, 2026 the XSOAR professional-services SKUs reached end-of-sale. XSOAR 6.12 and 6.13 hit end-of-life on June 30, 2026. XSOAR 8 still ships, and it isn’t end-of-life. But the product Palo Alto wants to sell you next is a different one, on a new tenant, with a per-user licence, metered compute units and six-month retention. You’re migrating either way. This program makes the migration ours to deliver and yours to control.

What you get

Element What it means
Playbook conversion by D3 D3 migration architects export your XSOAR content, inventory every playbook, script, integration, incident type, field, layout and report, and convert what you keep. You get a side-by-side diff per playbook and sign off on each one. Your engineers can read the result.
Agentic-ready delivery Choose which playbooks go agentic. Some or all. For those, D3 embeds read-only Attack Path Discovery investigation, AI Tasks and bounded Agentic Tasks inside the playbook, delivered in Deterministic mode with the agentic steps gated. You turn autonomy up one alert type at a time. Playbooks you keep deterministic are converted like-for-like.
Replay and parallel run We replay your closed XSOAR incidents through the converted playbooks and hand you a parity report. Then Morpheus runs beside XSOAR on live alerts. You set the acceptance criteria. You sign the cutover. XSOAR stays on until you switch it off.
No double payment Your Morpheus subscription starts at signature. Billing starts on your XSOAR contract end date up to 6 months. The migration happens inside that window at no charge.
Contract match Year one at or under your current XSOAR line, as one capped annual number. Seats, alert capacity and an allocation of full investigations are included. Overage is published: $0.97 per event above capacity, investigation overage from $2.25 to as low as $0.97. Renewal terms are in the order form.
Your whole tech stack, unchanged Keep Splunk, Sentinel, QRadar, Elastic or Google SecOps. Keep CrowdStrike, Defender, SentinelOne or Cortex XDR. Keep Proofpoint or Microsoft 365, Okta or Entra ID, Jira or ServiceNow. Morpheus connects to all of it through 800+ self-healing integrations with an 18-minute production MTTR on integration drift.
Written plan The 60-day phase plan, acceptance criteria and agentic-ready scope are attached to the order form.

The 60-day plan

  1. Weeks 1–2, discovery. Inventory and readiness report. Every playbook tagged migrate, simplify, retire or agentic. You pick the agentic set.
  2. Weeks 3–4, conversion. Converted playbooks with diffs. Incident types, fields and layouts mapped like-for-like. Reports rebuilt to the KPIs your leadership already sees.
  3. Weeks 5–6, replay and parallel run. Parity report on your recorded incidents, then live alerts on both platforms.
  4. Week 7, validation. Parity confirmed against your criteria. Autonomy set per alert type. Most teams start Deterministic and raise AI-Assisted on the noisiest alert types first.
  5. Week 8, cutover. Production shifts by incident type on your sign-off. Billing begins at your XSOAR end date.

Eligibility

  • Current Cortex XSOAR customer, 6.x or 8.x, SaaS or on-prem, single- or multi-tenant, with a renewal within 12 months of enrolment.
  • Orders signed by June 30, 2027. Enrolled customers keep their terms.
  • 36-month minimum term. It funds the billing bridge and the no-charge migration.
  • Custom integrations outside the D3 library, incident history beyond the agreed scope and custom development are scoped in discovery.

Start with the readiness report. No commitment.

Send us your exported XSOAR content bundle. We return the inventory and the migrate / simplify / retire / agentic map within five business days. Then run a two-day evaluation on your own alerts and grade the evidence yourself.

Book the evaluation · Legacy SOAR Migration Program · Cortex AgentiX vs D3 Morpheus

Frequently asked questions

What is the XSOAR Exit Program?

It’s D3 Security’s fixed offer for Cortex XSOAR customers: D3 converts your playbooks and reports to D3 Morpheus, delivers the playbooks you choose agentic-ready, runs beside XSOAR until you sign the cutover, starts billing when your XSOAR contract ends, and prices year one at or under your XSOAR line.

Do I have to change my SIEM, EDR or ticketing to move to Morpheus?

No. Morpheus works with the stack you run today: Splunk, Sentinel, QRadar, Elastic or Google SecOps; CrowdStrike, Defender, SentinelOne or Cortex XDR; your email security and identity provider; Jira and ServiceNow. It connects through 800+ self-healing integrations.

Will I pay for XSOAR and Morpheus at the same time?

No. Your Morpheus subscription starts at signature, but billing starts on your XSOAR contract end date, up to the program’s bridge limit. The migration and parallel run happen inside that window at no charge.

What does “agentic-ready” mean?

For the playbooks you elect, D3 embeds read-only investigation, AI decision steps and bounded agents inside the playbook, delivered in Deterministic mode with those steps gated. You raise autonomy per alert type through four modes, and can drop back to Deterministic at any time without re-migrating.

How is Morpheus priced compared with consumption pricing?

Morpheus is one capped annual price sized to daily alert volume, with seats and an allocation of full investigations included. Overage rates are published: $0.97 per event above capacity and investigation overage from $2.25 to as low as $0.97. There are no credits, tokens or query quotas.

What happens if the migration doesn’t meet our criteria?

XSOAR stays live through the parallel run and cutover happens only on your written sign-off against acceptance criteria you set in discovery. If the criteria aren’t met, you keep running XSOAR and nothing has changed.

Sources

  1. Palo Alto Networks press release, Oct 28, 2025: Cortex AgentiX unveiled as “the next generation of Cortex XSOAR.” paloaltonetworks.com
  2. Palo Alto Networks End-of-Sale announcements: legacy XSOAR professional-services SKUs, end-of-sale/end-of-life Feb 1, 2026. paloaltonetworks.com
  3. Palo Alto Networks End-of-Life summary: Cortex XSOAR 6.12/6.13, Jun 30, 2026. paloaltonetworks.com
  4. Cortex AgentiX documentation: “Understand Cortex AgentiX licenses,” “Manage compute units,” “Data retention policy” (retrieved Aug 27, 2026). licenses · data retention

Cortex, XSOAR, XSIAM and AgentiX are trademarks of Palo Alto Networks, Inc. All other marks belong to their owners. D3 Security is not affiliated with Palo Alto Networks.