From Palo Alto Cortex XDR to Wazuh

Cortex XDR is billed in a way that makes budgeting genuinely difficult: per endpoint, and separately for the data you ingest into the Cortex Data Lake, with credit-based consumption on top. Two meters that move independently means the invoice can grow because a network team enabled verbose logging, with no change in endpoint count at all. Wazuh replaces the detection, log-analysis, and compliance half for the cost of running it. It does not replace the prevention half, and this migration is built around that distinction.

Pull the ingestion lever before you migrate anything

There is a cost reduction available in week one that requires no migration at all, and it is worth taking regardless of what you eventually decide.

Audit the data sources feeding the Cortex Data Lake and check which have ever contributed to an alert a human actioned. In most estates several high-volume sources have not. Stop ingesting those and the data meter falls immediately.

This is not a delaying tactic. It shrinks the migration itself, because the telemetry you keep is the telemetry you have to reproduce in Wazuh. Doing the audit first means you are not rebuilding coverage for data you were about to discard anyway, and it gives the project an early, measurable win that buys patience for the longer work.

The mapping

• Cortex XDR agent → Wazuh agent for telemetry, plus a separate prevention layer for blocking.
• Cortex Data Lake → Wazuh indexer (OpenSearch), sized on your surviving volume.
• Custom BIOCs → Wazuh rules, rebuilt from the condition rather than converted.
• Correlation rules → Wazuh rules with frequency and timeframe for stateful logic.
• XQL queries → Wazuh dashboard queries, with the caveat that ad-hoc retrospective hunting is weaker.
• Incident and causality view → alerts plus an external case platform (TheHive or equivalent).
• Response actions (isolate, terminate, script execution) → Wazuh active response scripts.
• Exclusions and exceptions → Wazuh rule exclusions and decoder tuning.
• Host Insights / vulnerability assessment → Wazuh’s vulnerability detector, or a dedicated scanner.
• Compliance content → Wazuh SCA policies and regulatory templates.

Detection without prevention is the architectural decision

Say this out loud in the design review, because everything else follows from it.

The Cortex agent does two jobs on the endpoint. It collects rich telemetry, and it blocks: exploit prevention, behavioural threat protection, malware blocking at execution. Wazuh does the first job well and the second not at all. Wazuh’s active response can kill a process or block an IP when a rule fires, which is genuinely useful, but it is a reaction to a rule match, not a continuous prevention engine sitting in front of execution.

So the target architecture is layered by design: OS-native prevention on the endpoint (Defender Antivirus on Windows, hardening and allow-listing on Linux), with Wazuh as the detection, correlation, and response brain above it. Choose that prevention layer, deploy it, and confirm it is working and centrally managed before any Cortex agent is removed. Retrofitting prevention after the fact means running exposed, and it is the most common way this specific migration goes wrong.

Rebuilding the behavioural content that is actually yours

Cortex ships a large library of behavioural indicators produced by Palo Alto’s research team. That content is not yours and it is not coming with you, and there is no point pretending an open ruleset is equivalent to a vendor’s dedicated research operation.

What is yours are the custom BIOCs and correlation rules written for your environment, and those are worth real effort. Export them, read the conditions, and rebuild each as a Wazuh rule. The work splits in two: the decoder has to produce the fields the condition tests, and the rule expresses the condition. Get in the habit of validating both with wazuh-logtest against real production log samples, because a broken decoder and a broken rule look identical from the dashboard, and a rule that never fires is indistinguishable from a rule that is working.

For the general behavioural coverage you are losing, start from Wazuh’s bundled rulesets and the open Sigma and ATT&CK-mapped content, and prioritise by the techniques that appear in your own alert history rather than by rule count.

Rings, and the specific gotcha

Security migrations run in rings because there must be no coverage gap. The specific hazard here is agent coexistence: two agents with kernel-level components on one host can fight, and the symptoms (performance degradation, missing telemetry, one agent flagging the other) are exactly the kind that appear at scale rather than on one test machine.

So the pilot ring has to cover every operating system and build in the estate, not just a convenient sample, and it has to be measured rather than eyeballed. Check CPU and memory impact, confirm both agents are reporting, and set exclusions so Cortex does not treat the Wazuh agent as suspicious.

Then, ring by ring: deploy Wazuh, prove detections against a test suite, confirm active response fires, confirm the prevention layer is live and managed, and only then remove the Cortex agent from that ring. Never estate-wide, and never before the prevention layer is verified on those specific hosts.

Order of operations

1. Audit ingested sources and stop paying for the ones that never produce alerts.
2. Export custom BIOCs and correlation rules, and pull alert history to prioritise them.
3. Choose and deploy the prevention layer, centrally managed, ahead of everything else.
4. Build the Wazuh cluster sized on surviving telemetry volume, with retention policy set from day one.
5. Rebuild detections, validating decoders and rules against replayed production events.
6. Wire alerts into a case platform, because Wazuh has no incident workspace.
7. Pilot ring across every OS build, measuring agent coexistence and performance.
8. Roll out ring by ring, dual-running and tuning false positives at each step.
9. Remove the Cortex agent per validated ring, and reduce the endpoint licence as counts fall.

Clearing the bar before you cut over

Per ring: detections fire against your test suite (EICAR, atomic red-team, and the techniques from your own history), active response executes and is logged, the prevention layer is confirmed active and reporting centrally, agent performance impact is measured and acceptable, alerts reach the case platform, and compliance reports render. Only then does the Cortex agent come off those hosts.

The short version

Cortex XDR to Wazuh removes two meters at once and hands you a cluster, a decoder estate, and a prevention decision. Trim ingestion first for an immediate saving that also shrinks the project. Rebuild only the behavioural content that is genuinely yours, and be honest that a vendor research team is not replaced by an open ruleset. Above all, choose and deploy the prevention layer before the first Cortex agent comes off a host. Model the illustrative per-endpoint economics in the calculator above, and count the indexer, the case platform, and the detection-engineering time as part of the price.