Cortex XCOR: AI observability that investigates and recommends

Palo Alto Networks has introduced Cortex XCOR, a new AI-powered observability platform that promises to transform the way operations teams manage incidents. Instead of just displaying dashboards, XCOR uses AI agents that automatically investigate the root cause and recommend mitigation actions. The news, published in The New Stack, highlights that this technology could free engineers from repetitive tasks and allow them to focus on strategic work.

The platform stems from Palo Alto Networks' acquisition of Chronosphere in January and has been developed by the Chronosphere team within the company. According to Martin Mao, SVP and GM of observability at Palo Alto Networks, the goal is clear: "We don't want to keep waking engineers in the middle of the night to interpret dashboards; in fact, we don't want to wake them at all." XCOR opts for a human-in-the-loop model but allows autonomy permissions to be expanded over time.

The end of monotonous dashboard work

If tools like XCOR become widespread, the role of the site reliability engineer (SRE) will evolve beyond manual monitoring. Mao compares SREs to airplane pilots: they can rely on autopilot under normal conditions, but they need an experienced pilot when something goes wrong. By automating problem resolution, SREs gain time to devote to more strategic architectural work instead of putting out fires.

A BairesDev analysis cited in the news indicates that 42% of developers say AI writes at least half of their code, compared to 12% the previous year. This increase in code creation speed demands security-focused oversight. XCOR Operator, an AI assistant included in the offering, helps operations teams keep up with that pace through contextual relevance.

From predefined specifications to reasoning models

Mao was surprised by XCOR Operator's ability to solve complex problems beyond his initial expectations. This led him to rethink product design: instead of defining rigid specifications, the focus is now on giving reasoning models the access and capabilities they need to discover solution paths on their own.

Today, a typical user of an observability platform plays multiple roles: investigating incidents, tuning alerts and dashboards, optimizing data volumes, etc. With Cortex XCOR, each of these roles is reflected in specialized AI agents that complete workflows from start to finish.

Results and challenges

According to Mao's blog, the AI SRE agent is automatically triggered when an alert fires and reasons autonomously about the underlying problems, recommending actions and mitigations in less than three minutes on average, with a 75% success rate in root cause analysis in complex production environments. In addition, in an additional 19% of incidents, the analysis was considered useful. By comparison, a manual response can take 20 minutes just to locate the relevant problems, gather the initial context, and find the right on-call engineer.

"We don't want to keep waking engineers in the middle of the night to interpret dashboards; in fact, we don't want to wake them at all."

Mao confirms that the current response time of less than three minutes is satisfactory while customers become familiar with the experience. For now, when an incident occurs, the engineer is notified and, while they access the platform, XCOR has already completed the investigation. As users gain confidence and automate remediation, Palo Alto Networks will focus on further reducing response time. Mao notes that cost is an important factor, along with the declining price of tokens.

The executive also explains that automated reasoning is not possible without complete end-to-end visibility and context. The platform relies on integration with Chronosphere to achieve that visibility.

Implications for SMBs and IT teams

For an SMB or an IT team with limited resources, XCOR's promise is attractive: fewer nighttime interruptions, faster investigations, and the possibility for engineers to focus on higher-value tasks. However, adopting this type of solution requires considering several aspects:

• Cost and complexity: Although prices are not mentioned, the platform is designed for complex cloud-native environments. SMBs should evaluate whether their infrastructure justifies the investment and whether they have the staff to integrate it.
• Trust and autonomy: XCOR starts with a human-in-the-loop model. It is crucial to establish clear policies on when and how autonomy permissions are expanded.
• Data and context: The effectiveness of AI depends on complete visibility. Without adequate telemetry, agents will not be able to perform accurate analyses.
• Training: Teams will need to adapt to a new workflow where AI proposes and humans validate. This requires trust in the recommendations and skills to oversee them.

At ForgeNEX we recommend that SMBs approach AI observability gradually. Start by ensuring complete instrumentation of your applications and services, because without quality data no AI can help. Then, evaluate tools that automate repetitive tasks, such as alert correlation or initial incident analysis. The key is to free up time for the team to focus on improving architecture and security, areas where human expertise remains irreplaceable.

The emergence of agents like XCOR does not mean engineers are superfluous, but rather that their role shifts toward oversight and strategy. As in the pilot example, there will always be unforeseen situations that require a human mind. The difference is that, with the right tools, those situations will be less frequent and less stressful.

Source: The New Stack. Analysis and adaptation: ForgeNEX.