Premium Packs
Cortex XSOAR is the industry's only fully integrated marketplace for orchestration content!
Cortex XSOAR Marketplace is a digital storefront for discovering, exchanging and contributing security orchestration content centrally within the Cortex XSOAR platform. It enables users to install turnkey content packs to help solve any security use case with content contributed by SecOps experts and the world’s largest SOAR partner community, including you.
Additionally, Partners have the ability to monetize their content on the Marketplace. You decide the content, the price, how to best market it, and get a healthy share of the revenue. The customer gets premium content to solve their use case. It's a win-win. Partners who wish to contribute premium packs must follow a few additional onboarding steps and can now take advantage of Private Offers!
Packs#
All content on Marketplace is included in a Pack. (What can be in a pack?) When Partners create a pack, they specify the content that is included in that pack.
Packs on Marketplace can be free or premium. Our platform does full dependency checking too, so a pack can be dependent on, say, a command in another pack. This allows you to build a playbook addressing a full use case across products. Premium packs are held in your private repository. Free packs are held in our open source repository.
If you previously had a Demisto or Cortex XSOAR integration, it has been converted to a pack format and added to Marketplace for you.
What Can Be in a Premium Pack?#
All integrations must be free. We always want to encourage our mutual customers to connect our systems such that 1+1=3.
That said, premium packs generally fall into one of two types:
- Packs with premium content can consist of any other element(s) including complex playbooks, detailed automation scripts, dashboards that appeal to a specific user type, etc. This adds additional value on top of a free pack. For example, a UEBA partner may offer a free pack with the integration and a basic playbook, but offer the complex full playbook in a 2nd paid pack.
- Packs that resell 3rd party products essentially use XSOAR Marketplace as a transaction tier to enable delivery of a full SaaS product key. We have partners who sell access to intel feeds, phishing detection, etc. Anything that can be delivered via an API key can be listed on Marketplace. For example, a threat intel vendor may offer a free pack with the integration and a basic playbook. In order to access the actual threat feed, the customer must either contact the vendor, contract and procure directly, or... the customer simply clicks Subscribe in our marketplace and gets access to the data. Much easier.
Subscribing to Premium Packs#
The Marketplace transacts in points, rather than dollars, such that one point is valued at US$100. The Partner sets the price of the pack in points per month and customers purchase points via their Palo Alto Networks sales channel to subscribe to your content.
The XSOAR Marketplace supports two subscription models to give customers purchasing flexibility and you more options to help them address new use cases by integrating key SecOps solutions through their XSOAR deployment:
- Monthly - Customer subscribes to your premium pack and the subscription automatically renews on a monthly basis. We automatically pay you a revenue share, also on a monthly basis, with no invoice required!
- Private Offer: Customer subscribes to your premium content for a mutually agreed upon term length and price. We automatically pay you a revenue share, up front, for the full contracted term!
As a pack publisher, you can specify if monthly subscriptions are allowed or if all customers must use Private Offer to purchase. Learn more about Private Offer
For packs that resell 3rd party products, the following illustrates the subscription flow:
Show Your Pack#
With the new pack display model, Partners have much more real estate and flexibility to show their content within Marketplace including links, images, etc. You can even include a video in your listing to help convey the value of your pack.
Marketplace Listing Best Practices#
To get the most out of your investment in developing a premium pack for the largest SOAR digital storefront, we recommend following the Pack Documentation guidelines when creating XSOAR Marketplace content. Pack listings that clearly articulate the business benefits and SOAR value proposition have gotten the most Marketplace interest. Here are some recommendations to make your listing stand out:
- Well defined use cases
- Partner integration + XSOAR joint value proposition
- Images highlighting use cases, integration
- 2 minute integration overview video (image links to external video)
- Demo video of integration - (image links to external video)
- For partners reselling their product:
- 2 minute product overview video (image links to external video)
- Demo video of implementation and integration with XSOAR, inclusive of product activation (image links to external video)
Reporting and Notifications#
Marketplace provides robust reporting to Partners on their premium pack activity including both:
- Notifications are sent immediately via email whenever there is activity on the Pack including a new trial, trial end, a new subscription, etc. Each notification will include customer/human information when possible.
- Reports are sent on the first of each month where there was revenue-related activity in the prior month. The report details dollar roll-ups per pack, each revenue related transaction line item, etc.
Reporting is not currently available for free packs.
Program Details#
This page is meant as an overview to Marketplace. Please see the Palo Alto Networks Cortex XSOAR Partner Program Guide for details on the program.
More Information#
If you are interested in contributing a pack, please submit your application today. Contact the Partner Success Team with any questions.