Log360 Cloud uses an infrastructure-based model, pricing log sources, domain controllers, file servers, cloud accounts, and endpoints separately, with search and archival storage available as add ons.
Cortex XSIAM bills keeping your SOC on edge? ManageEngine Log360 Cloud brings threat detection, investigation, and response together in one cloud SIEM—with flexible, infrastructure-based licensing to help lower your total cost of ownership (TCO).
Recognized by independent review platforms and analyst firms
| Particulars | Log360 Cloud | Cortex XSIAM |
|---|---|---|
| Dark web monitoring | Monitors the deep and dark web dedicatedly through its integration with Constella intelligence to surface exposed credentials, PII, financial information, and compromised accounts your organization might have. | Does not provide dedicated dark web monitoring within XSIAM's threat intelligence workflow. Its attack surface management capabilities focus on discovering and monitoring internet-facing assets and exposure. |
| Out-of-the-box compliance monitoring | Get 1,000+ out-of-the-box reports, including dedicated reports for popular regulatory frameworks such as PCI DSS, HIPAA, SOX, NIST, ISO 27001, and the GDPR. You can also customize compliance reports based on your organization's specific requirements. | Provides 19 compliance content packs through the Cortex Marketplace, with prebuilt dashboards and reports for standards such as PCI DSS, HIPAA, SOX, NIST, and the GDPR. |
| Long term evidence retention | Supports up to 10 years of archival retention. Archived logs can also be reloaded into Search Storage when they need to be investigated or reviewed. | Provides cold storage as an add-on for long-term compliance retention. The cold-storage retention add-on requires a minimum six-month purchase and offers limited search capabilities. |
| Storage allocation model | Uses component-based licensing, with separate Search and Archival Storage as Add-ons. Search Storage supports active analysis, while Archival Storage is designed for long-term retention. | Uses daily data-ingestion capacity with hot and cold storage managed through the applicable license and retention add-ons. |
| Particulars | Log360 Cloud | Cortex XSIAM |
|---|---|---|
| Log collection and data fidelity | ||
| Collection methods | Supports both agent-based and agentless collection, along with syslog, API-based collection, and native cloud integrations across a broad range of log sources. | Uses the Cortex XDR agent for endpoint telemetry, Broker VM collectors for on-premises sources, and HTTP, API, and native cloud integrations for other data sources. |
| Agent dependency | Agentless collection is available for many sources, while lightweight agents can be used where direct collection is impractical or sources sit behind restricted networks. | Uses the Cortex XDR agent for native endpoint telemetry and relies on Broker VM collectors for several on-premises log sources. Cloud and API-based sources can be collected without an endpoint agent. |
| Custom applications | Lets you collect custom application logs through supported syslog, file-based, and API-based methods, with custom parsing available when a dedicated integration is not available. | Lets you bring in custom data through HTTP, syslog, and other supported collection paths. Custom sources may require Parsing Rules and Data Model Rules before they can be used across XSIAM's normalized security model. |
| Collection filtering | Lets you filter events before they enter the platform and apply different storage and retention policies based on the data you need to keep. | Provides filtering and routing controls across its ingestion and data-management layers, with additional filtering available during investigation through XQL. |
| Identity context prerequisite | AD and Microsoft Entra ID can be monitored as part of the platform's identity and security workflows. | Cloud Identity Engine is required for XSIAM's Identity Analytics capability, which enriches investigations with user, group, role, host, login, and process context. |
| Threat detection and rule authoring | ||
| Detection content | More than 2,000+ predefined detection rules covering MITRE ATT&CK techniques, insider threats, malware, APTs, anomalies, correlation, and threat intelligence use cases. These rules are delivered through a cloud-managed library and will be updated regularly. | More than 10,000 built-in detectors, complemented by more than 2,600 ML models, covering analytics, behavioral detections, correlations, and other threat signals. |
| Rule authoring interface | Provides a visual rule builder for standard, anomaly, and advanced rules. Analysts can define conditions, thresholds, filters, sequences, exceptions, and MITRE ATT&CK mappings without having to write query syntax. | Custom correlation rules are authored using Cortex Query Language (XQL), with controls for execution mode, search windows, schedules, alert fields, MITRE mappings, and other rule settings. XSIAM also provides Query Builder capabilities to help construct XQL queries. |
| Tuning and suppression | Lets analysts tune rules, add filters and exclusions, scope detections to relevant users or entities, and adjust thresholds and anomaly models to reduce unnecessary alerts. | Lets analysts tune correlation rules with suppression fields, suppression windows, execution settings, and other rule-level controls. XSIAM also provides broader policy and exclusion controls for managing detection behavior. |
| Explore more | ||
| Threat intelligence | ||
| Built-in feeds | Provides a built-in repository with more than hundreds of millions of malicious IPs, domains, and URL. It supports integration from external threat feeds and integrations from sources such as Webroot, BrightCloud, AlienVault OTX, and VirusTotal. | Provides Palo Alto Networks threat intelligence, including Unit 42 intelligence, and supports additional third-party intelligence feeds through its integrations and Marketplace. |
| Threat intelligence management | Brings threat intelligence into detection and investigation, correlating indicators with security events to enrich alerts and help analysts validate threats without requiring a separate threat intelligence platform. | Provides dedicated threat intelligence management for aggregating, scoring, enriching, and distributing indicators. Analysts can manage indicators, create detection and prevention rules, and push selected indicators to security controls. TIM requires XSIAM Premium or an applicable TIM add-on. |
| Dark web monitoring | Monitors the deep and dark web dedicatedly through its integration with Constella intelligence to surface exposed credentials, PII, financial information, and compromised accounts your organization might have. | Does not provide dedicated dark web monitoring within XSIAM's threat intelligence workflow. Its attack surface management capabilities focus on discovering and monitoring internet-facing assets and exposure. |
| Explore more | ||
| UEBA and behavioral analytics | ||
| UEBA | Uses ML and behavioral analytics to establish baselines for users and entities and identify time, count, and pattern-based anomalies. | Uses its Analytics Engine to establish behavioral baselines across endpoint, network, and other supported data, while Identity Analytics adds user context to behavioral detections and investigations. |
| Risk scoring | Assigns risk scores to anomalous users and entities and shows their risk levels, trends, and contributing anomalies so analysts can prioritize investigations. | Provides user and host risk scores that are continuously updated as issues and cases contribute to their risk posture. |
| Insider threat use cases | Detects behavioral indicators associated with insider threats, compromised accounts, privilege misuse, and data exfiltration by identifying deviations from established user and entity behavior. | Addresses insider threats and compromised accounts through Identity Analytics, behavioral analytics, peer comparisons, and the Identity Threat Module, which adds dedicated user and host risk views and identity-focused investigation. |
| Explore more | ||
| Investigation and AI | ||
| Investigation workspace | Incident Workbench brings incident evidence into one view, with timelines, affected entities, threat intelligence, UEBA signals, and related security activity. | Cases group related issues and evidence into an investigation view, with AI-generated case summaries, timelines, causality and access to the underlying data for deeper analysis. |
| AI assistance | Zia brings AI into everyday security operations, helping analysts make sense of security data and act on it faster. It summarizes logs, alerts, and incidents, connects activity to MITRE ATT&CK, and uses the Alert Investigation Agent to piece together related events and attack timelines. | Cortex Agentic Assistant uses system and custom agents to investigate cases, hunt threats, create plans, and execute actions through playbooks, scripts, commands, and AI prompts. Agents Hub lets teams build and manage custom agents and actions, with permissions and approvals governing what they can execute. |
| AI commercial model | AI capabilities use a BYOK model. Customers configure either OpenAI or Azure OpenAI and provide their own API credentials. | Agentic AI capabilities are part of the Cortex platform, with usage and availability governed by the applicable license and platform entitlements. |
| Model and data control | AI processing uses the customer's configured OpenAI or Azure OpenAI service. The customer controls the provider account and API credentials used by Log360 Cloud. | Cortex XSIAM processes tenant data within the Palo Alto Networks environment. Customers can use BYOK for encryption keys to retain control over encryption of tenant data at rest. |
| MCP integration | Provides a native Zoho MCP Server that lets compatible AI clients query Log360 data, investigate alerts, search logs, and perform supported actions through natural-language prompts. | Provides a Cortex MCP Server that lets external MCP-compatible clients investigate and manage cases and issues using natural language. Cortex Agentic Assistant can also connect to third-party MCP servers, extending agents to external tools and data sources. |
| SOAR and automation | ||
| SOAR architecture | Native SOAR built into the SIEM, with a visual playbook builder for designing and managing response workflows in the same platform. | SOAR capabilities delivered within XSIAM, with playbooks, scripts, automation rules, and Quick Actions for orchestrating investigation and response. |
| Playbook library | Provides ready-to-use playbooks for common investigation and response tasks, which teams can customize and combine into larger workflows. | Provides a Playbook Catalog with Marketplace content covering a broad range of integrations and security use cases. Playbooks can be adopted, customized, and reused within the platform. |
| Workflow customization | Visual playbooks supporting branching, parallel execution, waiting, batching, and reusable sub-playbooks. Custom Python and Deluge functions can extend workflows with additional actions and integrations. | Playbooks can combine built-in tasks, sub-playbooks, scripts, commands, and third-party integrations. |
| Execution model | Playbooks can run automatically when associated alerts are generated or manually from alerts and incidents. Workflows can enrich alerts, investigate activity, notify teams, and perform remediation actions. | Playbooks can run automatically through automation rules, on a schedule, or manually from issues. XSIAM also supports autonomous playbooks that can respond to supported analytics issues with minimal user intervention. |
| Explore more | ||
| Compliance monitoring | ||
| Out-of-the-box compliance monitoring | Get 1,000+ out-of-the-box reports, including dedicated reports for popular regulatory frameworks such as PCI DSS, HIPAA, SOX, NIST, ISO 27001, and the GDPR. You can also customize compliance reports based on your organization's specific requirements. | Provides 19 compliance content packs through the Cortex Marketplace, with prebuilt dashboards and reports for standards such as PCI DSS, HIPAA, SOX, NIST, and the GDPR. |
| Long term evidence retention | Supports up to 10 years of archival retention. Archived logs can also be reloaded into Search Storage when they need to be investigated or reviewed. | Provides cold storage as an add-on for long-term compliance retention. The cold-storage retention add-on requires a minimum six-month purchase and offers limited search capabilities. |
| Explore more | ||
| Retention, storage, and data access | ||
| Storage allocation model | Uses component-based licensing, with separate Search and Archival Storage as Add-ons. Search Storage supports active analysis, while Archival Storage is designed for long-term retention. | Uses daily data-ingestion capacity with hot and cold storage managed through the applicable license and retention add-ons. |
| Searchable retention | Supports up to 90 days of search storage, with additional storage available when more capacity is required. | Includes 31 days of hot retention for ingested data and 186 days for Cases and Issues. Additional hot-retention options can extend searchable storage, including dataset-specific retention with a minimum 1,000GB allocation. |
| Long-term retention | Supports up to 10 years of archival storage. The archived logs can be reloaded and re-indexed into search storage when needed for investigation or audit. | Provides cold storage for long-term retention and compliance. Cold-storage retention requires a minimum six-month add-on and offers limited XQL-based search rather than requiring all data to be restored to hot storage first. |
| Data protection and key management | Encrypts data in transit and at rest and provides tamper protection to prevent logs from being modified or deleted by local administrators. | Encrypts tenant data at rest using AES-256 with a dedicated key-management system. BYOK lets customers generate and manage their own encryption keys through Cortex Gateway. |
| Deployment, multi-tenancy, and data residency | ||
| Deployment options | Available as a cloud SIEM, while you can also opt for on-premises deployment | Delivered as a SaaS platform through Palo Alto Networks' cloud infrastructure. |
| Multi-tenancy for MSSPs | Provides a dedicated MSSP edition to manage multiple customer environments from a centralized console. Customers are maintained as separate tenants, with client access and permissions managed independently. | Supports MSSP parent-and-child tenant architectures with centralized management, strict tenant separation, and two licensing models: centralized licensing, where the MSSP allocates resources across child tenants, and customer-owned licensing, where each customer maintains its own contract. |
| Data residency | Lets customers select a regional data center of their choice. Current options include the US, UK, Canada, EU, India, Australia, Japan, UAE, and Singapore. | Tenants are deployed in supported regional environments, including the US, EU, Canada, UK, Japan, Singapore, Australia, Germany, India, Switzerland, Poland, Taiwan, Qatar, Saudi Arabia, and other regions. |
We have received your request for a personalized demo and will contact you shortly.
Cortex XSIAM uses ingestion-based licensing, which can make data volumes an important factor in cost planning. Log360 Cloud takes a different approach: License the infrastructure you monitor, then add search and archival storage based on your requirements. This gives teams a more predictable way to plan SIEM costs as their environments grow.
Log360 Cloud lets you configure collection filters to control which events enter the platform, while separate search and archival storage options help you manage retention based on your needs. Collect logs from on-premises infrastructure and cloud environments, keep critical events searchable, and retain historical data without treating every log the same way.
Log360 Cloud combines AD auditing, file-server auditing, and security analytics to help your team investigate account changes, permission modifications, and access to critical resources. Trace who did what and when, and use that context to distinguish routine activity from potential threats.
Establishes behavioral baselines and identifies time, count, and pattern anomalies across users and entities, with dashboards showing risk levels, trends, and the activities contributing to the score.
Scan the deep and dark web to identify leaked PII and get notified of threats such as social engineering, account compromise, and third-party data exposures.
A library of ready-to-use playbooks covering integrations such as CrowdStrike Falcon, Bitdefender, Sophos Central, Cisco Duo, Okta, VirusTotal, Windows, and Linux, which can also be adapted and combined into larger workflows.
Zia Insights summarizes events and maps them to MITRE techniques, the Alert Investigation Agent runs autonomous multi-stage investigations, and the Zoho MCP Server lets AI clients such as Claude, Copilot, and Cursor query Log360 data.
More than 1,000 out-of-the-box reports covering security, operational, and compliance use cases, including HIPAA, SOX, FISMA, the PCI DSS, and the GDPR, with options to customize for specific requirements.
Available in both on-premises and cloud deployments. Log360 Cloud stores collected data in the regional data center associated with the selected location, helping you meet geographic and data residency requirements.
Discover how a SIEM solution helps your organization get on top of emerging threats and enhance operational resilience.
Choosing the right SIEM means finding a solution that supports your security goals without slowing you down or complicating your workflow.
Query security data from your preferred AI tools using the MCP. Bring Log360 Cloud insights into your existing AI workflows to investigate events, explore suspicious activity, and get answers using natural language.
Build, customize, and automate playbooks for incident response, integrating external tools and platforms to streamline security workflows.
Gain real-time visibility into user activity across sanctioned cloud apps like Dropbox and Microsoft 365, with actionable analytics on access, sharing, and risks.
"We gained complete visibility into our server and security logs. The solution’s threat detection, event monitoring, and log analysis features have significantly improved how the organization tracks and responds to security events."
Dhanaraj K, Chief Information Security Officer, Vibrant Screen
Get SIEM, UEBA, and SOAR in a single cloud solution built to eliminate complexity, accelerate response times, and secure your enterprise without hidden costs.
Log360 Cloud uses an infrastructure-based model, pricing log sources, domain controllers, file servers, cloud accounts, and endpoints separately, with search and archival storage available as add ons.
Log360 Cloud integrates with your existing EDR and other security tools, correlating their logs to detect threats without requiring replacement.
Log360 is available in both cloud and on-premises editions. Cortex XSIAM is SaaS only, delivered from a Palo Alto Networks cloud region of your choosing.
Log360 Cloud offers visual rule-building options with its intuitive interface that requires no specialized query languages. Cortex XSIAM uses XQL for custom correlation rules and query-based analytics.
Log360 Cloud supports up to 90 days of searchable logs and 10 years of archival retention on eligible paid plans. Archived logs can be reloaded for searching. Cortex XSIAM retention depends on your license and storage add-ons.
ManageEngine is a division of Zoho Corp.