An alert fires. Someone has to find what broke, pull the right logs and traces, and decide what to try next. That work takes time. Palo Alto Networks says its Cortex XCOR AI SRE agent starts the investigation the moment the alert arrives and usually finishes in under three minutes. The company reports a 75 percent success rate on root-cause analysis in complex production environments, and another 19 percent of cases where the analysis was still useful. Manual work can take about 20 minutes just to locate the relevant data and find the right person.
The platform extends Chronosphere with agents that investigate.
Cortex XCOR sits on the Chronosphere platform Palo Alto Networks acquired earlier in 2026. Chronosphere already handled large volumes of telemetry and cut the amount of data customers store. The new piece is the set of agents. An XCOR Operator acts as the conversational front end. Specialized agents run behind it for queries, alerts, dashboards, and investigations. The AI SRE is the one that takes an incident from alert to recommended action.
The agent uses a knowledge graph and past incidents for context.
The agent needs context to reason. Palo Alto Networks calls the supporting layer XCOR Fabric. It draws from a knowledge graph of infrastructure and applications, memory of past incidents, the queries and dashboards senior engineers actually use, and documents such as runbooks. The company is also adding front-end visibility through its acquisition of Embrace. That brings real user monitoring that stores full web and mobile sessions without sampling, plus synthetic checks that test paths before users hit them.
Elastic pursued a similar capability through acquisitions in 2025 and 2026.
Elastic took a similar route through two acquisitions. It completed its purchase of Keep Alerting in May 2025 and announced the completion of its Deductive AI acquisition in August 2026. In July, I wrote about how Keep’s alert correlation and remediation capabilities could complement Deductive’s root-cause investigation technology. Those two deals assembled most of an AI site reliability engineer from outside the company. Palo Alto Networks is extending a platform it already owns and adding the front-end layer through Embrace. Both approaches try to move the first investigation off the human on-call.
Data volume drops by an average of 89 percent.
In its launch announcement, Palo Alto Networks says customers reduce telemetry data volume by an average of 89% while preserving visibility. The platform uses consumption-based pricing with budgets that can shed lower-priority data during spikes.
Faster releases increase the number of alerts that need diagnosis.
As AI-assisted development accelerates releases, operations teams may face more changes to investigate when something breaks. An agent that starts the diagnosis and hands back a short list of likely causes and next steps reduces the time a person spends assembling context. That is the operational gain. The open question for a team evaluating it is how often the recommended action is the one an experienced engineer would have chosen, and how the system behaves when the success rate falls short of the published figure.
Ask your observability provider how the AI SRE grounds its answers in your specific systems and past incidents. Check whether the root-cause success rate holds on your traffic mix, and what the handoff looks like when the agent cannot finish the investigation. Confirm that the data reduction still leaves the traces you need for the cases the agent misses.
Works cited
Palo Alto Networks. “Observability’s AI Moment: Introducing Cortex XCOR.” 1 Oct. 2026, www.paloaltonetworks.com/blog/2026/10/observabilitys-ai-moment-introducing-cortex-xcor-ai-driven-observability-for-autonomous-response-with-ai-sre/.
Palo Alto Networks. “Cortex XCOR.” www.paloaltonetworks.com/cortex/xcor. Accessed 17 Oct. 2026.
Bellamkonda, Shashi. “Elastic’s Roadmap for AI Incident Response Is Now Two Acquisitions Deep.” shashi.co, 23 July 2026, www.shashi.co/2026/07/elastics-roadmap-for-ai-incident.html.
