European Alternatives to Palo Alto Cortex XSOAR
Looking for a European alternative to Palo Alto Cortex XSOAR? XSOAR is sold by Palo Alto Networks, Inc. of Santa Clara, California, and its own site lists prebuilt integration and automation packs in a marketplace and a visual playbook editor, with pricing handled through sales contact. Teams that want a vendor outside US jurisdiction, an open source core or a SOAR bundled with their SIEM look at other options.
The European and Israeli tools below cover playbook automation, case management and AI-assisted triage, from open source Shuffle in Norway to TheHive in France and Tines in Ireland.
How we rank these tools — 4-step process
-
1
European ownership, verified
The company is headquartered and incorporated in the EU, EEA, the UK, Switzerland or Israel, and processes customer data in Europe or Israel. A US parent company disqualifies a tool from this page regardless of where its servers are.
-
2
Category fit and hands-on review
What the tool actually does, who it suits, and where it falls short — checked against the vendor’s own documentation, changelog and pricing page rather than its marketing copy.
-
3
Compliance and pricing check
GDPR posture, hosting location and the prices quoted on this page are verified against the vendor’s public pricing before publication, and re-checked when we revisit the category.
-
4
Position on this page
Placement on this page can be paid, and that can affect which tools appear here and the order they appear in. It never buys a good review: a tool that fails the checks above is not here at any price, and payment does not change the shortcomings we write about. A vendor can ask us to correct a factual error — not to remove a criticism.
Vendors can pay for visibility on this page. It never changes what an entry says about a product, including the criticism, and we earn nothing when you click through to a vendor. Vendors can pay for more visibility, higher up on the review pages; it never affects which tools are listed. Editorial policy
10 European Alternatives to Palo Alto Cortex XSOAR
Shuffle
Open source SOAR for security teams and MSSPs
SecureVisio
SIEM, SOAR and UEBA in one platform from Rzeszow
TheHive
Incident response case platform with native Flow automation
Tines
No-code workflow automation used by security and IT teams
Guardsix (formerly Logpoint)
SOAR that runs inside the same self-hosted sovereign platform
Sekoia
SOC platform with automated incident response playbooks
Torq
Tel Aviv company building an agentic AI SOC platform
Cynet
Endpoint and XDR platform with SOAR built in
Intezer
AI SOC that triages and investigates every alert
Hunters
Next-gen SIEM with automated triage and investigation
Key takeaways
- Cortex XSOAR is sold by Palo Alto Networks, Inc. of Santa Clara, California, and its product page offers a demo request instead of a price.
- The XSOAR product page claims more than 900 prebuilt integration and automation packs and a visual playbook editor, a catalogue none of the European tools on this page claims to match.
- TheHive from StrangeBee in France starts at €26,000 a year, and Tines in Dublin offers a free edition with three live workflows.
- Shuffle AS in Oslo publishes its core code under AGPL-3.0, so the execution layer can run on your own servers.
- Torq, Cynet, Intezer and Hunters are Israeli companies, which EP counts as European, and none of them states a data location on the pages we read.
Why people leave Palo Alto Cortex XSOAR
Cortex XSOAR is the security orchestration, automation and response product of Palo Alto Networks, Inc., a company that lists its mailing address as 3000 Tannery Way in Santa Clara, California.
Its own product page describes a visual playbook editor, a virtual war room for investigations, ChatOps and a command line, and a marketplace with more than 900 prebuilt integration and automation packs. A SOC analyst opens an incident, runs a playbook against it and works the case in the same screen.
People look elsewhere for reasons that have little to do with the feature list.
A SOAR platform holds API credentials for firewalls, identity providers and endpoint agents, and it keeps the record of every containment step, so the contracting entity and the legal system around it matter more than they do for a ticketing tool. The product page shows a demo request and no price, which means the commercial terms are settled in a sales cycle with a vendor whose headquarters are outside Europe.
The other pull is scope. XSOAR belongs to the Cortex family next to XDR and XSIAM, and the vendor's pages invite buyers toward the whole platform. A team that wants only orchestration, or wants it inside a European SIEM, or wants a workflow engine it can read and host itself, finds that the European and Israeli field offers each of those in a smaller package.
- A US-headquartered vendor holds your response credentials XSOAR stores the keys that let a playbook isolate a host or disable an account. Palo Alto Networks, Inc. is a Santa Clara company, and a request under US law can reach a US provider wherever its servers stand. A European vendor, or a tool you run on your own machines, keeps that credential store inside your legal area. For a public body or an operator in scope of NIS2, that is a procurement question before it is a technical one.
- Transfers rest on frameworks, not on location The vendor's privacy statement says personal information may be transferred to and stored in the United States, and names the EU-US Data Privacy Framework, the UK extension and the Swiss-US framework, with standard contractual clauses as the other route. That text covers its websites and accounts, not the XSOAR service, and the order-specific terms were not readable. Buyers still have to document the transfer basis, and keep it current if that basis moves.
- Price and terms arrive through sales The XSOAR page offers a demo and an ROI report, and shows no price list. Budgeting therefore starts with a conversation, and a pilot cannot begin on a free tier. Tines publishes a free edition with three live workflows, Shuffle publishes its code, and TheHive publishes a floor of €26,000 a year, so the European field gives you at least a number or a download before the first call.
- The platform is bigger than the job Most of the product page is about breadth: threat intelligence from Unit 42, indicator scoring, an MSSP programme and a multitenant platform. If your need is to route alerts and close the obvious ones, you pay attention to a lot of surface you may never open. Several tools below solve a narrower problem, and say so, which makes the scope of the purchase easier to defend.
What you have to replace, not just match
Replacing XSOAR means replacing three layers, and the first is the playbooks.
The vendor's NDIT customer story says 196 playbooks close over 60 percent of that organisation's incidents, a number that shows how much institutional logic ends up in the product. Export your own list, mark the ten that fire every day, and test those first in the new tool. Playbooks built on XSOAR's integration packs do not move as files, so each one is rebuilt against the new tool's connectors.
The second layer is case work. XSOAR gives analysts a war room, auto-documentation and reporting, and many European SOAR tools handle that differently. TheHive is built around cases and Cortex analysers, SecureVisio and Guardsix keep the case inside the SIEM, and Shuffle or Tines expect you to bring a ticketing system. Decide where the analyst writes down what happened before you choose where the playbook runs.
The third layer is everything the incident touches: threat intelligence feeds, the EDL push for firewalls, the ticketing and chat integrations, and the multitenant setup if you serve clients. A tool that cannot reach your firewall or your identity provider is not a replacement, however clean the editor looks. Count the systems your playbooks call today and ask each vendor for that exact list, not for a total.
The alternatives compared
| Position | Tool | Headquarters | Pricing | Jurisdiction |
|---|---|---|---|---|
| #1 | Shuffle | Oslo, Norway | Hosted plans and support are listed on the vendor site, whose pricing page loads client-side | EEA, not EU (Norway) |
| #2 | SecureVisio | Rzeszow, Poland (German office in Kakenstorf) | Quote-based; a site page outlines deployment, support and licensing | EU (Poland) |
| #3 | TheHive | France | Yearly subscription starting at EUR 26,000 across Gold, Platinum and ONE; a reduced Community Edition costs nothing for non-commercial work | EU (France) |
| #4 | Tines | Dublin, Ireland | Free tier (3 live workflows, unlimited users) / paid plans, pricing on request | EU (Ireland) |
| #5 | Guardsix (formerly Logpoint) | Copenhagen, Denmark | Per node or per device licence | EU (Denmark) |
| #6 | Sekoia | Paris, France | SaaS subscription | EU (France) |
| #7 | Torq | Tel Aviv, Israel (Americas HQ in Denver) | Not given on the vendor homepage | Israel (outside the EU/EEA) |
| #8 | Cynet | Israel (Tel Aviv-Yaffo courts) | Quote after a demo form | Israel (outside the EU/EEA) |
| #9 | Intezer | Israel (with a US affiliate) | Starter and Complete tiers are charged per endpoint, figures only via sales | Israel (outside the EU/EEA) |
| #10 | Hunters | Israel | Quoted individually | Israel (outside the EU/EEA) |
How each alternative compares to Palo Alto Cortex XSOAR
Best for: Security teams and MSSPs that want the orchestration layer on their own servers without a licence negotiation
Shuffle covers the workflow side of what XSOAR does: visual workflows, webhooks and app integrations, with the core published under AGPL-3.0. Against a closed product from Santa Clara, the difference is that you can read the code, deploy it on your own infrastructure and keep stored credentials on your own disks. The README also links guides for connecting it to TheHive and Cortex.
XSOAR's catalogue of curated content packs is the commercial strength we could not match against Shuffle on the pages read. The pricing page renders client-side, so hosted plan prices were not visible, and the hosted cloud's region is not stated. AGPL-3.0 also carries obligations if you modify the code and offer it as a network service, which an MSSP should check with counsel.
What Shuffle does better than Palo Alto Cortex XSOAR
- Running the engine on servers you control
- Reading and auditing the source code
- A Norwegian company inside the EEA instead of a US contracting entity
- Starting a trial without a sales call
Where Shuffle is a step down from Palo Alto Cortex XSOAR
- The size of a curated content marketplace
- Case management and war room features out of the box
- Vendor support depth for a large SOC
Standout against Palo Alto Cortex XSOAR. It is the only tool on this page whose core is open source and whose README is addressed to MSSPs.
Best for: Mid-sized SOC teams and public bodies that want detection and response tied to an asset inventory
SecureVisio puts the SOAR layer next to SIEM and UEBA, and adds a CMDB and a business impact analysis module, so an incident is scored by how critical the affected asset is. XSOAR approaches the same problem as an orchestrator that waits for alerts from whichever detection product you own. Here the alert and the context sit in one data model, which shortens the path from alert to decision.
The site lists actions such as querying a user in Active Directory or blocking traffic on a local firewall, and says an SVBot component learns from analyst decisions. Esecure Sp. z o.o. is named on the contact page in Rzeszow. The 99 percent automation figure and the 250 clients are vendor claims, hosting region and self-hosting are not stated, and its integration ecosystem is smaller than the one XSOAR advertises.
What SecureVisio does better than Palo Alto Cortex XSOAR
- Asset-based incident scoring included in the platform
- One vendor for SIEM, SOAR and UEBA
- An EU contracting entity with Polish and German offices
Where SecureVisio is a step down from Palo Alto Cortex XSOAR
- Number of third-party integrations
- Independence from one vendor's detection
- Published pricing and hosting details
Standout against Palo Alto Cortex XSOAR. It scores incidents from a built-in CMDB and business impact analysis, which XSOAR leaves to your own data.
Best for: CERTs, CSIRTs and SOC teams whose main work is structured case handling with automated analysis
TheHive matches XSOAR on the part analysts live in: alerts become cases, observables go to Cortex for analysis, and responders act on the result. StrangeBee says the platform serves more than 5,000 analysts in 50-plus countries, which is its own count. It is offered on-premises as well as on a dedicated AWS environment, so a CERT can keep cases in its own network.
Automation was long delegated to Cortex and external tools, and TheHive Flow, a native orchestration layer, sits only on the top ONE plan. Subscriptions start at €26,000 a year across Gold, Platinum and ONE, which is a visible floor but a high one for a small team. A free Community Edition is limited and for non-commercial use, and the AWS region of the SaaS is not stated.
What TheHive does better than Palo Alto Cortex XSOAR
- A published price floor
- An on-premises edition for isolated networks
- Case and collaboration model that CERTs already know
- A French contracting entity
Where TheHive is a step down from Palo Alto Cortex XSOAR
- Orchestration breadth below the ONE plan
- Entry cost for small teams
- A marketplace of ready playbooks
Standout against Palo Alto Cortex XSOAR. Its Cortex analysers and responders give it an automation layer that predates and sits beside any workflow engine.
Best for: Security and IT teams that want a no-code, auditable workflow tool and a free edition to test on
Tines builds workflows as a directed graph of actions, which suits the branching that incident response involves, and the free edition allows three live workflows with unlimited users. That gives a team a way to rebuild its top three XSOAR playbooks before any procurement step. The product is aimed at security and IT operations, not at sales or marketing automation.
Tines Limited in Dublin is the contracting entity for customers outside North America, and a European buyer should name that entity in the order. The vendor states SOC 2 Type II compliance, audited annually, and a Delaware company serves North America. Paid plans have no published price, the connector catalogue is narrower for general business tools than Make or n8n, and Tines is not a case management product to the depth of TheHive.
What Tines does better than Palo Alto Cortex XSOAR
- A free edition for building a first workflow
- A no-code canvas for non-developers
- An Irish contracting entity for customers outside North America
- Generic orchestration across mixed detection tools
Where Tines is a step down from Palo Alto Cortex XSOAR
- A war room and case reporting at XSOAR's depth
- Published paid pricing
- Threat intelligence content from the vendor
Standout against Palo Alto Cortex XSOAR. It is the one tool here that lets you rebuild real playbooks on a free edition with unlimited users.
Guardsix (formerly Logpoint)
Danish SIEM with playbooks that run locally and an air-gappable deployment
Best for: European enterprises and public bodies replacing a SIEM and a SOAR with one self-hosted platform
Guardsix, formerly Logpoint, is a Copenhagen SIEM that includes UEBA and SOAR playbooks. The vendor describes playbooks that execute locally inside the same platform and a deployment that can be air-gapped, which answers the question of where response code runs more directly than a cloud orchestrator does. It also advertises a record of actions for NIS2 and DORA reporting.
Licensing is by node or device rather than by data volume, and the platform comes as software, an appliance or SaaS. That suits an organisation replacing a volume-priced SIEM at the same time as XSOAR. The trade-offs are a smaller detection content library than Sekoia, node counting that needs care on large estates, an enterprise sales cycle, and fewer third-party integrations than the ecosystem around Palo Alto.
What Guardsix (formerly Logpoint) does better than Palo Alto Cortex XSOAR
- Running playbooks on your own platform
- Air-gapped deployment
- A Danish company under EU jurisdiction
- One licence covering SIEM and response
Where Guardsix (formerly Logpoint) is a step down from Palo Alto Cortex XSOAR
- Third-party integration breadth
- Standalone orchestration across other vendors' detections
- Public pricing
Standout against Palo Alto Cortex XSOAR. Its SOAR runs inside the same self-hosted platform as the SIEM, down to an air-gapped installation.
Best for: SOC teams and MSSPs that want detection content and threat intelligence maintained for them
Sekoia combines SIEM-style detection with its own cyber threat intelligence, and its response layer runs playbooks inside the same product. Where XSOAR draws on Unit 42 intelligence delivered through the Cortex family, Sekoia ties its detection rules, mapped to MITRE ATT&CK, to the actors its own team tracks. An alert leaves the platform already enriched.
The company is based in Paris and positions its French hosting as a sovereign option. Multi-tenancy suits MSSPs, much as XSOAR's multitenant platform does. The site moved to sekoia.com and we could read little beyond the homepage, the platform is described as SaaS, pricing is by assets or events and needs modelling, and the company is newer than the established SIEM vendors and strongest in the French market.
What Sekoia does better than Palo Alto Cortex XSOAR
- Detection rules and intelligence from one French vendor
- French sovereign hosting
- Multi-tenant operation for service providers
Where Sekoia is a step down from Palo Alto Cortex XSOAR
- Standalone orchestration of other vendors' alerts
- The size of XSOAR's integration catalogue
- Visibility outside France
Standout against Palo Alto Cortex XSOAR. It ships maintained detection rules and threat intelligence together with the response layer.
Best for: Mid-sized and large SOC teams moving from scripted playbooks to AI agents with human oversight
Torq describes itself as an AI SOC platform whose agents de-duplicate events, reach verdicts based on the team's past decisions, open cases and respond, autonomously or with a person overseeing. Products on its site include Auto Triage, HyperAgents and Hyperautomation, and the vendor mentions audit logs and a manual override. This is a different philosophy from XSOAR's playbook-first model.
Torq Technologies Ltd. of Tel Aviv is named as controller in its privacy policy, and its US subsidiary holds the Data Privacy Framework certification and serves the Americas from Denver. We could not read a customer agreement, so the signing entity is open, and the pages state no pricing, self-hosting or data location. Teams that want deterministic playbooks may find the agent emphasis a poor match.
What Torq does better than Palo Alto Cortex XSOAR
- AI-assisted triage described with audit logs
- Case management inside the platform
- A single platform from triage to reporting
Where Torq is a step down from Palo Alto Cortex XSOAR
- Self-hosting or data location statements
- Published pricing
- Clarity about which entity signs the contract
Standout against Palo Alto Cortex XSOAR. It is the only vendor here describing agents that decide with a human on the loop as the main interface.
Best for: Lean IT security teams that want detection and automated response from one vendor
Cynet states that its SOAR is built into the platform, so there is no third-party SOAR to license. Automated investigation starts when a detection fires and produces a timeline, root cause analysis and an audit trail. Playbooks come prebuilt or in a drag-and-drop editor, and the SOAR page shows a five-step phishing response from trigger to verification.
The consequence is that the SOAR is not available standalone: you adopt Cynet's endpoint and XDR platform to get it, where XSOAR can sit above any detection product. The terms name Cynet Security Ltd. under Israeli law. Pricing is on request, no data location is stated, the speed figures are the vendor's own, and the list of supported third-party products was not shown on the page we read.
What Cynet does better than Palo Alto Cortex XSOAR
- One vendor for detection and response
- A 24x7 managed detection option
- Automated root cause analysis out of the box
Where Cynet is a step down from Palo Alto Cortex XSOAR
- Neutral orchestration across other products
- A published integration list
- Pricing and data location transparency
Standout against Palo Alto Cortex XSOAR. It bundles SOAR into the endpoint platform, so there is no orchestration product to buy separately.
Best for: SOC teams that want to offload Tier 1 and Tier 2 alert investigation rather than build playbooks
Intezer replaces the enrichment and verdict steps of an XSOAR playbook with an AI-driven investigation of each alert, including low-severity ones, and resolves false positives automatically. Starter covers one alert source, either endpoint or user-reported phishing, while Complete covers SIEM, cloud, identity and network sources and adds custom response workflows and on-demand experts.
Both plans are priced by endpoints, with amounts on request. The company's blog describes the product plugging into SOAR tools, which says it often complements an orchestrator, and containment actions still need one. The terms name Intezer Labs Ltd. and Intezer Labs Inc. together under Israeli law, so the contracting entity must be confirmed, and no data location is stated.
What Intezer does better than Palo Alto Cortex XSOAR
- Triage of every alert, not only high-severity ones
- Not having to write investigation playbooks
- Plans priced by endpoints
Where Intezer is a step down from Palo Alto Cortex XSOAR
- General orchestration across arbitrary tools
- Case management
- Clarity on the US affiliate and data location
Standout against Palo Alto Cortex XSOAR. It targets the investigation step of the playbook, which is the step most XSOAR content packs spend their time on.
Best for: Small SecOps teams that want automated investigation without writing detections or playbooks
Hunters is the weakest like-for-like match on this page, which is why it sits last. It presents itself as a SIEM in which its Team Axon builds and tunes detections and where scoring, correlation and enrichment run automatically. The page says the platform covers ingestion through to response, so the work an XSOAR playbook does after an alert happens inside the SIEM.
The privacy policy names Cyber Hunters Ltd., and the website terms follow Israeli law. The navigation lists Hunters for Snowflake, Hunters for AWS and an MSSP solution, but those pages did not load for us, so product depth was judged from the homepage. There is no playbook editor, no published price and no data location, and a team that wants orchestration across tools will be better served elsewhere.
What Hunters does better than Palo Alto Cortex XSOAR
- Detections maintained by the vendor
- Not needing a separate orchestrator
Where Hunters is a step down from Palo Alto Cortex XSOAR
- Custom playbooks and tool-to-tool automation
Standout against Palo Alto Cortex XSOAR. It automates triage inside a SIEM whose detections are written and tuned by the vendor's own team.
What actually breaks when you switch
The first thing that breaks is the integration layer. XSOAR playbooks call marketplace packs, and no other tool reads those packs. Every system a playbook touches, from the firewall to the identity provider to the ticketing tool, needs a connector in the new tool, and a missing one means writing an API call by hand. Ask each vendor to confirm your exact list, and test the three highest-volume playbooks before you commit.
The second is contracts and people. Annual XSOAR subscriptions have their own renewal date, and a gap between the old and the new tool leaves alerts without automation. Analysts also lose the war room and ChatOps habits they have built, so training time belongs in the plan. Run both tools in parallel for a month, compare how many incidents each closes without a person, and only then switch off the old one.
How hard is it to move playbooks from Cortex XSOAR to a European tool?
Plan on rebuilding, not converting. XSOAR playbooks call integration packs from the vendor's marketplace, and the other tools use their own connectors and their own logic model. Tines and Torq work on a workflow canvas, Shuffle builds visual workflows with webhooks and app integrations, and Cynet offers a drag-and-drop editor inside its XDR platform. The step structure carries over as a design, the files do not.
The efficient route is to start from usage. List the playbooks that ran in the last quarter, rank them by volume, and rebuild the top handful in a trial of two tools. The remainder is usually a long tail that you either drop or move later. Keep XSOAR running read-only until the new tool has handled a full month of real alerts.
Do I need a separate SOAR if I already have a SIEM?
Not always. SecureVisio, Guardsix, Sekoia and Cynet include automated response in their own platforms, so alerts arrive with context and a playbook can act on them without a second product. That is simpler to run and to audit, but it ties response to that vendor's detection. If your detections come from several products, a separate orchestrator is the better fit.
Intezer and Hunters sit in between. According to its own site, Intezer investigates alerts and plugs into SOAR tools, and Hunters is a SIEM that automates triage and investigation inside the platform. Both take over part of what an XSOAR playbook does, and neither is a general-purpose orchestrator, so they are listed lower on the page.
Which one to pick
If you want the engine under your control, start with Shuffle for open source and self-hosting, or Guardsix if you also want to replace the SIEM and keep playbooks inside one air-gappable platform. If you want a no-code tool you can try without a contract, Tines is the practical first test. If your analysts live in cases, TheHive is the natural centre, with the €26,000 floor in mind.
If you would rather buy detection and response as one product, SecureVisio, Sekoia and Cynet each bundle them, with different strengths: asset context, threat intelligence, endpoint coverage. Torq suits a team ready to hand triage to agents. Intezer and Hunters make sense as ways to cut the investigation workload, not as replacements for XSOAR. Keep XSOAR if you depend on its integration packs and have no reason to change vendor.
Frequently Asked Questions
For a standalone orchestrator, Shuffle from Norway is the closest if you want to read and host the code yourself, and Tines from Ireland is the closest if you want a no-code canvas with a free edition to test on. TheHive from France fits teams whose main need is case handling. SecureVisio and Guardsix suit buyers who want SOAR inside a European SIEM instead of as a second product.
Several can. Shuffle publishes installation instructions for self-hosting, TheHive has an on-premises edition, and Guardsix describes playbooks that execute locally in an air-gappable deployment. Tines says hosting options are discussed with its team, and Torq, Cynet and Intezer state no self-hosting route on the pages we read. Ask for the deployment diagram in writing before a pilot, because a feature list does not show where playbooks run.
We cannot say, because the XSOAR page shows no price. What we can compare is how visible the numbers are. Tines has a free edition, Shuffle has an open source core, and TheHive starts at €26,000 a year. SecureVisio, Torq, Cynet, Intezer and Hunters ask you to request pricing, so ask for a quote against your alert volume and count the integrations you need before comparing totals.
EP counts Israel as European for this directory since 22 October 2026, so Torq, Cynet, Intezer and Hunters are listed. They are outside the EU and the EEA, which matters for GDPR transfers. Torq names a US subsidiary for the Americas and Intezer names a US affiliate in its terms, so confirm which entity signs your order and where your data sits.
Intezer and Hunters. Intezer concentrates on investigating alerts and resolving false positives, and its own materials place it next to SIEM and SOAR tools. Hunters presents itself as a next-generation SIEM with automated triage. Cynet's SOAR is part of its endpoint platform and is not sold on its own. These three can reduce the number of playbooks you maintain, but they do not replace XSOAR across an arbitrary tool stack.
Related comparisons
Buying guides
About the author
Explore More European Alternatives
Discover privacy-focused European alternatives to other popular US tech services.