Cortex XSOAR vs Tracecat
Cortex XSOAR
paloaltonetworks.comTracecat
tracecat.comSide by side
| Figure | Cortex XSOAR | Tracecat |
|---|---|---|
| Price from | — | Free |
| Free plan | — | Yes |
| Free trial | — | — |
| Open source | — | — |
| Web | Yes | Yes |
| API | — | Yes |
| Self-hosted | — | Yes |
| Plans published | 0 | 2 |
| Spec score · Security Orchestration, Automation, and Response Software | 6.1 (#14) | 7.3 (#8) |
| Spec score · Runbook Automation Software | 6.0 (#19) | 7.3 (#13) |
| Spec score · SOAR Software | 6.2 (#18) | 7.4 (#10) |
| Founded | 2005 | 2024 |
| Headquarters | Santa Clara, California, USA | New York City, New York, United States |
Plans
In their own words
Cortex XSOAR
Cortex XSOAR has no write-up on Specifiction yet; its figures are above.
Tracecat
Tracecat is an open-source security automation platform for teams building AI-assisted cyber defense. Its product includes workflows, cases, tables, integrations, agent presets, skills, and a hosted MCP server catalog. Workflows can use loops, conditions, parallel subflows, and Python, Bash, or Ansible scripts. Tracecat advertises more than 500 integrations across areas including SIEM, EDR, MDM, and identity providers; its hosted MCP catalog lists 56 servers, including Elastic, Splunk, CrowdStrike Falcon, Wiz, Okta, Slack, Jira, GitHub, and AWS. Teams can use managed cloud or self-host. The Open Source edition can be deployed with Docker or AWS Fargate and is billed Free forever at free, with unlimited workflows, cases, and agents. Open Source includes case management, comments, attachments, and custom fields, but excludes human-in-the-loop tool approvals and advanced case features. Enterprise uses custom pricing and adds features including tool approvals, advanced cases, and 24/7 Slack and email support.