Palo Alto's XCOR brings AI agents to root-cause incidents in minutes, not hours

Palo Alto Networks has unveiled Cortex XCOR, an AI-driven observability platform that moves beyond dashboard-heavy incident response to autonomous AI agents that investigate issues and propose fixes in real time. Rather than waking engineers to interpret monitoring data, the system diagnoses problems and recommends remediation actions on its own.

The shift reflects a recognition that cloud-native architectures at scale make manual troubleshooting inefficient and expensive. By acquiring Chronosphere in January and building XCOR from that team's expertise, Palo Alto Networks is repositioning observability from a reactive, human-intensive process to an AI-first workflow that handles both routine and complex investigations.

How XCOR Changes Incident Response#

When an alert fires, XCOR deploys a specialized AI agent to reason through root causes autonomously. According to Martin Mao, SVP and GM of observability at Palo Alto Networks, the system completes analysis in under three minutes on average, achieving a 75% success rate for root-cause identification in complex production environments, with another 19% of cases rated as useful by teams even when full resolution isn't reached.

For context: manual investigation typically consumes at least 20 minutes just to gather context and locate the right on-call engineer. Mao notes that because XCOR finishes its diagnosis before engineers even log in, "three minutes fulfills our current needs." The platform defaults to human-in-the-loop operation—still paging engineers—but gives teams the option to expand autonomous remediation permissions over time as confidence builds.

From Dashboards to Specialized Agents#

The platform reshapes how operations teams approach troubleshooting. Rather than forcing users into multiple roles (investigating incidents, tuning alerts, optimizing data volumes), XCOR deploys task-specific agents tailored to each workflow. An AI SRE agent handles incident response; others manage alert tuning and telemetry optimization.

Mao describes XCOR Operator as a conversational interface that "understands user intent" and coordinates these specialized agents behind the scenes. This architecture reflects a fundamental rethink: instead of building products with fixed specifications, the team now gives reasoning models the access and capabilities to discover multiple paths to solutions.

Bridging the AI Coding Velocity Gap#

As developers increasingly rely on AI for code generation—42% now report AI writes at least half their code—observability must keep pace with faster release cycles. Burnout looms if teams spend 100% of their time firefighting instead of innovating. Automating troubleshooting frees SREs for strategic architectural work, much as autopilot lets airline pilots focus on complex situations rather than routine flight management.