Truth in IT
    • Sign In
    • Register
        • Videos
        • Channels
        • Pages
        • Galleries
        • News
        • Events
        • All
Truth in IT Truth in IT
  • Data Management ▼
    • Converged Infrastructure
    • DevOps
    • Networking
    • Storage
    • Virtualization
  • Cybersecurity ▼
    • Application Security
    • Backup & Recovery
    • Data Security
    • Identity & Access Management (IAM)
    • Zero Trust
    • Compliance & GRC
    • Endpoint Security
  • Cloud ▼
    • Hybrid Cloud
    • Private Cloud
    • Public Cloud
  • Webinar Library
  • TiPs
  • DRAW

Palo Alto Networks: Coveo's SOC Transformation with Cortex XSIAM

Palo Alto Networks
07/12/2026
0 (0%)
Share
  • Comments
  • Download
  • Transcript
Report Like Favorite
  • Share/Embed
  • Email
Link
Embed

Transcript


developers to really push the limit as far as they can. Our main focus is on AI search. Coveo is one of AWS's biggest customers in Canada specifically, so we have a lot of cloud assets to cover. We always had to hop from one system to another, which puts a lot of burden on our analysts because they're always context switching. So we decided to have an approach where we're going to spend a bit more on great tooling that is efficient, low and false positive, and that gives us great insight into our assets rather than just trying to hire a ton of people with kind of worse tools. Typically, it would take us almost a year to teach them every single different tool that we had in us, and we're able to cut this down to almost three months. Thanks to XIM, we've managed to get a roughly 99% close rate on our tickets, which essentially means that our analysts have the time to treat all the tickets. We have actually moved on from ingesting 20 gigs of data a day, which is pretty small, to ingesting over 600 gigs of data a day, and still keeping a fairly low amount of noise. One of the things that excites us the most about Cortex Cloud is just the fact that it meshes natively into XIM. We get the full picture from cloud to the workstation, and on top of that, we've managed to do a bit of cost saving too. I see a genetic change how our team operates. We go from scripting to essentially building playbooks just through natural language rather than having to understand all of the underlying bits and pieces. The partnership between Palo Alto Networks and Caveo is very sweet to me because we can do stuff that's a bit more fun in general than just triaging alerts and going through a grind.

TL;DR

  • Coveo consolidated fragmented security tools into Cortex XSIAM, eliminating analyst context switching and achieving 99% ticket close rate with zero backlog
  • Data ingestion scaled 3,000% from 20GB to 600GB daily while maintaining low false positive rates and reducing analyst onboarding from 12 months to 3 months
  • Agentic AI enables natural language playbook creation, shifting analysts from manual scripting to strategic work and delivering cost savings through unified cloud-to-workstation visibility

Summary

Coveo, a major AWS customer in Canada focused on AI search innovation, faced significant security operations challenges due to massive cloud asset sprawl and a fragmented security tooling environment. The company's security analysts struggled with constant context switching across multiple systems, creating operational inefficiencies and extended onboarding timelines. By consolidating their security stack into Palo Alto Networks Cortex XSIAM, Coveo achieved dramatic operational improvements including a 3,000% increase in data ingestion (from 20GB to 600GB daily) while maintaining low false positive rates, reduced analyst training time from 12 months to 3 months, and achieved a 99% ticket close rate that eliminated their backlog. The integration of Cortex Cloud provides unified visibility from cloud infrastructure to workstations, delivering both operational efficiency and cost savings. The platform's Agentic AI capabilities enable analysts to build playbooks using natural language rather than manual scripting, fundamentally transforming how the security team operates and allowing them to focus on higher-value work beyond routine alert triage.

Chapters

0:00 - Coveo's Innovation Challenge
0:20 - Context Switching Problem
0:42 - Operational Improvements
1:10 - Agentic AI Transformation

Key Quotes

0:28 "So we decided to have an approach where we're going to spend a bit more on great tooling that is efficient, low and false positive, and that gives us great insight into our assets rather than just trying to hire a ton of people with kind of worse tools."
0:59 "We have actually moved on from ingesting 20 gigs of data a day, which is pretty small, to ingesting over 600 gigs of data a day, and still keeping a fairly low amount of noise."
1:25 "We go from scripting to essentially building playbooks just through natural language rather than having to understand all of the underlying bits and pieces."

FAQ

How did Cortex XSIAM help Coveo reduce analyst onboarding time?

By consolidating multiple security tools into a single unified platform, Coveo reduced the learning curve for new analysts from 12 months to 3 months, eliminating the need to train on numerous disparate systems.

What operational improvements did Coveo achieve with Cortex XSIAM?

Coveo achieved a 99% ticket close rate eliminating their backlog, scaled data ingestion from 20GB to 600GB daily (3,000% increase) while maintaining low false positives, and gained unified visibility from cloud to workstation with cost savings.


Categories:
  • » Cybersecurity » Cloud Security
  • » Data Protection
Channels:
News:
Events:
Tags:
  • Security Operations
  • Cloud Security
  • AI & Machine Learning
  • Customer Story
  • Best Practices
  • SOC automation
  • security operations efficiency
  • cloud security visibility
  • XSIAM platform
  • AI-driven security
  • analyst productivity
  • security tool consolidation
Show more Show less

Browse videos

  • Related
  • Featured
  • By date
  • Most viewed
  • Top rated
  •  

              Video's comments: Palo Alto Networks: Coveo's SOC Transformation with Cortex XSIAM

              Upcoming 360 View Events

              • Nov
                19

                360View: Govern, Secure & Recover Your Microsoft 365 Environment

                11/19/202601:00 PM ET
                More events

                XStreaminars (watch here)

                • Oct
                  28

                  EnvZero: Near-Zero Time to Resolution--Live Agentic Remediation for Failed and Drifted Infrastructure

                  10/28/202601:00 PM ET
                  More events

                  Industry Events (Sponsor Hosted)

                  • Oct
                    13

                    Transitioning from CJIS to FERPA: Essential Audit Evidence for Compliance

                    10/13/202601:00 PM ET
                    • Oct
                      15

                      Risk in Real Time Demo Series: Virtual Patching: Protection at the Speed of Exploitation

                      10/15/202611:00 AM ET
                      • Oct
                        20

                        Harnessing Data Governance for AI with Cyera and Snowflake

                        10/20/202611:00 AM ET
                        • Oct
                          27

                          Maximize Security, Value, and Returns on Your Microsoft Investment

                          10/27/202611:00 AM ET
                          • Oct
                            27

                            The HUMAN Experience: Real-Time Insights into Page Intelligence

                            10/27/202601:00 PM ET
                            More events

                            Upcoming Webinar Calendar

                            • 10/13/2026
                              01:00 PM
                              10/13/2026
                              Transitioning from CJIS to FERPA: Essential Audit Evidence for Compliance
                              https://www.truthinit.com/index.php/channel/2159/transitioning-from-cjis-to-ferpa-essential-audit-evidence-for-compliance/
                            • 10/15/2026
                              11:00 AM
                              10/15/2026
                              Risk in Real Time Demo Series: Virtual Patching: Protection at the Speed of Exploitation
                              https://www.truthinit.com/index.php/channel/1372/risk-in-real-time-demo-series-the-autonomous-era-orchestrating-a-resilient-enterprise/
                            • 10/20/2026
                              11:00 AM
                              10/20/2026
                              Harnessing Data Governance for AI with Cyera and Snowflake
                              https://www.truthinit.com/index.php/channel/2137/harnessing-data-governance-for-ai-with-cyera-and-snowflake/
                            • 10/27/2026
                              11:00 AM
                              10/27/2026
                              Maximize Security, Value, and Returns on Your Microsoft Investment
                              https://www.truthinit.com/index.php/channel/2178/maximize-security-value-and-returns-on-your-microsoft-investment/
                            • 10/27/2026
                              01:00 PM
                              10/27/2026
                              The HUMAN Experience: Real-Time Insights into Page Intelligence
                              https://www.truthinit.com/index.php/channel/2139/the-human-experience-real-time-insights-into-page-intelligence/
                            • 10/28/2026
                              01:00 AM
                              10/28/2026
                              [APAC:] Secure AI Everywhere: Visibility, governance and protection for the agentic era
                              https://www.truthinit.com/index.php/channel/2125/apac-ensuring-comprehensive-security-for-ai-applications/
                            • 10/28/2026
                              06:00 AM
                              10/28/2026
                              [EMEA:] Secure AI Everywhere: Visibility, governance and protection for the agentic era
                              https://www.truthinit.com/index.php/channel/2127/emea-ensuring-ai-security-across-all-platforms/
                            • 10/28/2026
                              01:00 PM
                              10/28/2026
                              [AMERICAS:] Secure AI Everywhere: Visibility, governance and protection for the agentic era
                              https://www.truthinit.com/index.php/channel/2126/securing-ai-across-the-americas-strategies-and-insights/
                            • 10/28/2026
                              01:00 PM
                              10/28/2026
                              EnvZero: Near-Zero Time to Resolution--Live Agentic Remediation for Failed and Drifted Infrastructure
                              https://www.truthinit.com/index.php/channel/2179/envzero-near-zero-time-to-resolution-live-agentic-remediation-for-failed-and-drifted-infrastructure/
                            • 11/04/2026
                              11:00 AM
                              11/04/2026
                              Leveraging CISA’s Zero Trust Maturity Model in an AI-Driven Landscape
                              https://www.truthinit.com/index.php/channel/2149/leveraging-cisas-zero-trust-maturity-model-in-an-ai-driven-landscape/
                            • 11/04/2026
                              11:00 AM
                              11/04/2026
                              Aligning Agentic Intent: Understanding Your Agents' Purpose vs. Their Actions
                              https://www.truthinit.com/index.php/channel/2158/aligning-agentic-intent-understanding-your-agents-purpose-vs-their-actions/
                            • 11/05/2026
                              02:00 PM
                              11/05/2026
                              HUMAN Dialogue: Embracing the Rise of the Agentic Consumer in AI
                              https://www.truthinit.com/index.php/channel/2160/human-dialogue-embracing-the-rise-of-the-agentic-consumer-in-ai/
                            • 11/05/2026
                              02:00 PM
                              11/05/2026
                              Reclaim Your Evenings: Leverage Data Intelligence to Minimize Risk and Boost AI Adoption
                              https://www.truthinit.com/index.php/channel/2172/reclaim-your-evenings-leverage-data-intelligence-to-minimize-risk-and-boost-ai-adoption/
                            • 11/19/2026
                              01:00 PM
                              11/19/2026
                              360View: Govern, Secure & Recover Your Microsoft 365 Environment
                              https://www.truthinit.com/index.php/channel/2076/360view-govern-secure-recover-your-microsoft-365-environment/
                            Truth in IT
                            • Sponsor
                            • About Us
                            • Terms of Service
                            • Privacy Policy
                            • Contact Us
                            • Preference Management
                            Desktop version
                            Standard version