Demisto

Demisto is a security orchestration, automation and response platform, now sold by Palo Alto Networks as Cortex XSOAR. It links the separate tools in a security operations centre so that responses to incidents follow the same steps each time.

Main features

• Workflow automation: builds and runs incident response playbooks across security operations, network security and cloud security.
• Integrations: hundreds of ready-made connections and content packs, shared through a marketplace.
• Case management: one place for all security incidents, with ticket mirroring to tools such as ServiceNow, Jira and Slack.
• Threat intelligence management: ties outside threat data to incidents and passes it to enforcement points.
• Machine learning guidance: suggests actions from past incidents, including a phishing email classifier.

Clients

Security operations teams, including providers that manage many client environments.

Key facts

• Deployment: on-premises, hosted or multitenant
• Maintained by: Palo Alto Networks
• Customer help: training, documentation, workshops and a community chat channel