Truth in IT
    • Sign In
    • Register
        • Videos
        • Channels
        • Pages
        • Galleries
        • News
        • Events
        • All
Truth in IT Truth in IT
  • Data Management ▼
    • Converged Infrastructure
    • DevOps
    • Networking
    • Storage
    • Virtualization
  • Cybersecurity ▼
    • Application Security
    • Backup & Recovery
    • Data Security
    • Identity & Access Management (IAM)
    • Zero Trust
    • Compliance & GRC
    • Endpoint Security
  • Cloud ▼
    • Hybrid Cloud
    • Private Cloud
    • Public Cloud
  • Webinar Library
  • TiPs
  • DRAW

Palo Alto Networks: Coveo's SOC Transformation with Cortex XSIAM

Palo Alto Networks
07/12/2026
0 (0%)
Share
  • Comments
  • Download
  • Transcript
Report Like Favorite
  • Share/Embed
  • Email
Link
Embed

Transcript


developers to really push the limit as far as they can. Our main focus is on AI search. Coveo is one of AWS's biggest customers in Canada specifically, so we have a lot of cloud assets to cover. We always had to hop from one system to another, which puts a lot of burden on our analysts because they're always context switching. So we decided to have an approach where we're going to spend a bit more on great tooling that is efficient, low and false positive, and that gives us great insight into our assets rather than just trying to hire a ton of people with kind of worse tools. Typically, it would take us almost a year to teach them every single different tool that we had in us, and we're able to cut this down to almost three months. Thanks to XIM, we've managed to get a roughly 99% close rate on our tickets, which essentially means that our analysts have the time to treat all the tickets. We have actually moved on from ingesting 20 gigs of data a day, which is pretty small, to ingesting over 600 gigs of data a day, and still keeping a fairly low amount of noise. One of the things that excites us the most about Cortex Cloud is just the fact that it meshes natively into XIM. We get the full picture from cloud to the workstation, and on top of that, we've managed to do a bit of cost saving too. I see a genetic change how our team operates. We go from scripting to essentially building playbooks just through natural language rather than having to understand all of the underlying bits and pieces. The partnership between Palo Alto Networks and Caveo is very sweet to me because we can do stuff that's a bit more fun in general than just triaging alerts and going through a grind.

TL;DR

  • Coveo consolidated fragmented security tools into Cortex XSIAM, eliminating analyst context switching and achieving 99% ticket close rate with zero backlog
  • Data ingestion scaled 3,000% from 20GB to 600GB daily while maintaining low false positive rates and reducing analyst onboarding from 12 months to 3 months
  • Agentic AI enables natural language playbook creation, shifting analysts from manual scripting to strategic work and delivering cost savings through unified cloud-to-workstation visibility

Summary

Coveo, a major AWS customer in Canada focused on AI search innovation, faced significant security operations challenges due to massive cloud asset sprawl and a fragmented security tooling environment. The company's security analysts struggled with constant context switching across multiple systems, creating operational inefficiencies and extended onboarding timelines. By consolidating their security stack into Palo Alto Networks Cortex XSIAM, Coveo achieved dramatic operational improvements including a 3,000% increase in data ingestion (from 20GB to 600GB daily) while maintaining low false positive rates, reduced analyst training time from 12 months to 3 months, and achieved a 99% ticket close rate that eliminated their backlog. The integration of Cortex Cloud provides unified visibility from cloud infrastructure to workstations, delivering both operational efficiency and cost savings. The platform's Agentic AI capabilities enable analysts to build playbooks using natural language rather than manual scripting, fundamentally transforming how the security team operates and allowing them to focus on higher-value work beyond routine alert triage.

Chapters

0:00 - Coveo's Innovation Challenge
0:20 - Context Switching Problem
0:42 - Operational Improvements
1:10 - Agentic AI Transformation

Key Quotes

0:28 "So we decided to have an approach where we're going to spend a bit more on great tooling that is efficient, low and false positive, and that gives us great insight into our assets rather than just trying to hire a ton of people with kind of worse tools."
0:59 "We have actually moved on from ingesting 20 gigs of data a day, which is pretty small, to ingesting over 600 gigs of data a day, and still keeping a fairly low amount of noise."
1:25 "We go from scripting to essentially building playbooks just through natural language rather than having to understand all of the underlying bits and pieces."

FAQ

How did Cortex XSIAM help Coveo reduce analyst onboarding time?

By consolidating multiple security tools into a single unified platform, Coveo reduced the learning curve for new analysts from 12 months to 3 months, eliminating the need to train on numerous disparate systems.

What operational improvements did Coveo achieve with Cortex XSIAM?

Coveo achieved a 99% ticket close rate eliminating their backlog, scaled data ingestion from 20GB to 600GB daily (3,000% increase) while maintaining low false positives, and gained unified visibility from cloud to workstation with cost savings.


Categories:
  • » Cybersecurity » Cloud Security
  • » Data Protection
Channels:
News:
Events:
Tags:
  • Security Operations
  • Cloud Security
  • AI & Machine Learning
  • Customer Story
  • Best Practices
  • SOC automation
  • security operations efficiency
  • cloud security visibility
  • XSIAM platform
  • AI-driven security
  • analyst productivity
  • security tool consolidation
Show more Show less

Browse videos

  • Related
  • Featured
  • By date
  • Most viewed
  • Top rated
  •  

              Video's comments: Palo Alto Networks: Coveo's SOC Transformation with Cortex XSIAM

              Upcoming Webinar Calendar

              • 07/14/2026
                01:00 PM
                07/14/2026
                Crafting a Championship-Worthy Security Team for Unmatched Defense
                https://www.truthinit.com/index.php/channel/2025/crafting-a-championship-worthy-security-team-for-unmatched-defense/
              • 07/14/2026
                02:00 PM
                07/14/2026
                Understanding the Crucial Role of Context in Safeguarding AI-Accessible Data
                https://www.truthinit.com/index.php/channel/2037/understanding-the-crucial-role-of-context-in-safeguarding-ai-accessible-data/
              • 07/21/2026
                04:00 AM
                07/21/2026
                Strategies for Managing AI Governance and Securing App-to-LLM API Traffic
                https://www.truthinit.com/index.php/channel/1967/strategies-for-managing-ai-governance-and-securing-app-to-llm-api-traffic/
              • 07/22/2026
                06:30 AM
                07/22/2026
                Insights and Strategies in Data Protection and Privacy Management
                https://www.truthinit.com/index.php/channel/2000/insights-and-strategies-in-data-protection-and-privacy-management/
              • 07/22/2026
                01:00 PM
                07/22/2026
                Insights from Attackers During the FIFA World Cup: A HUMAN Dialogue
                https://www.truthinit.com/index.php/channel/2029/insights-from-attackers-during-the-fifa-world-cup-a-human-dialogue/
              • 07/28/2026
                01:00 PM
                07/28/2026
                Illumio + Netskope: Zero Trust in the Age of AI Autonomy
                https://www.truthinit.com/index.php/channel/2031/illumio-netskope-zero-trust-in-the-age-of-ai-autonomy/
              • 07/29/2026
                04:00 AM
                07/29/2026
                Real-Time Strategies for Safeguarding Against Prompt Injections
                https://www.truthinit.com/index.php/channel/1968/real-time-strategies-for-safeguarding-against-prompt-injections/
              • 07/29/2026
                12:00 PM
                07/29/2026
                Unified Data Security in Action: Uncover, Analyze, and Resolve Threats
                https://www.truthinit.com/index.php/channel/2045/unified-data-security-in-action-uncover-analyze-and-resolve-threats/
              • 07/29/2026
                01:00 PM
                07/29/2026
                Ask Your Cloud Anything: Unlocking Governance Silos in your Environments
                https://www.truthinit.com/index.php/channel/2048/ask-your-cloud-anything-unlocking-governance-silos-in-your-environments/
              • 08/19/2026
                12:00 PM
                08/19/2026
                Becoming Agent Ready: Insights from Cyera's Expertise
                https://www.truthinit.com/index.php/channel/2036/becoming-agent-ready-insights-from-cyeras-expertise/
              • 09/30/2026
                04:00 AM
                09/30/2026
                AI Command Center: Optimizing Visibility and Control in Your Operations
                https://www.truthinit.com/index.php/channel/2024/ai-command-center-optimizing-visibility-and-control-in-your-operations/

              Upcoming Events

              • Jul
                14

                Crafting a Championship-Worthy Security Team for Unmatched Defense

                07/14/202601:00 PM ET
                • Jul
                  14

                  Understanding the Crucial Role of Context in Safeguarding AI-Accessible Data

                  07/14/202602:00 PM ET
                  • Jul
                    21

                    Strategies for Managing AI Governance and Securing App-to-LLM API Traffic

                    07/21/202604:00 AM ET
                    • Jul
                      22

                      Insights and Strategies in Data Protection and Privacy Management

                      07/22/202606:30 AM ET
                      • Jul
                        22

                        Insights from Attackers During the FIFA World Cup: A HUMAN Dialogue

                        07/22/202601:00 PM ET
                        More events
                        Truth in IT
                        • Sponsor
                        • About Us
                        • Terms of Service
                        • Privacy Policy
                        • Contact Us
                        • Preference Management
                        Desktop version
                        Standard version