Skip to main content


Download With Dependencies

Penfield.AI Incident Assignment for XSOAR

Penfield.AI uses Human-Machine Intelligence (HMI) to automate Incident Assignment within the Security Operations Center, to the most appropriate analyst qualified to resolve an incident based on their Skillset, alert queue, as well as speed and accuracy.
An XSOAR command and a script are available as part of this integration.

This Content Pack is used to integrate Penfield.AI Incident Assignment for XSOAR. You will need a production license to get the full value of this Content Pack

Why Penfield.AI

Penfield.AI is the industry’s first Human-Machine Intelligence (HMI) platform to model cybersecurity analysts' actions and processes in real-time. Penfield automatically assigns incidents within the SOC to the most appropriate analyst, as result of modelling leveraging reinforcement learning and Human- Computer Interaction data. This will improve the overall speed and accuracy of the incident resolution process withing the SOC. Penfield.AI uses the incident data ingested from Cortex XSOAR, as well as the analysts’ interaction data collected from the supporting data sources to drive the intelligent alert assignment. Penfield.AI’s advanced AI model provides an output to Cortex XSOAR with the recommendation of the best analyst for a given incident. And the result is an improvement in both Mean Time to Resolve (MTTR) and in the accuracy of the resolved incidents.

To obtain access to Penfield.AI Incident Assignment via Cortex XSOAR, please contact Penfield at




Cortex XSOARCortex XSIAM


CertificationRead more
Supported ByPartner
CreatedNovember 30, 2021
Last ReleaseMarch 12, 2023

Content packs are licensed by the Publisher identified above and subject to the Publisher’s own licensing terms. Palo Alto Networks is not liable for and does not warrant or support any content pack produced by a third-party Publisher, whether or not such packs are designated as “Palo Alto Networks-certified” or otherwise. For more information, see the Marketplace documentation.