Check out this comparison sheet I made for our procurement team.

Our procurement lead asked for a "vendor-neutral" comparison. They got a spreadsheet. I added some columns they won't like.

The sheet covers Cortex XDR, CrowdStrike, and a self-hosted OSS stack built around Wazuh and Zeek. It compares list price, compute overhead, data egress fees, and the real cost of "optional" cloud modules. The open column is predictably cheap on licensing, expensive on labor. The surprise was the egress: wanting your own data back from the Palo Alto cloud for an internal audit isn't free.

The procurement team's favorite feature is always the single pane of glass. My favorite column is "time to migrate off platform." It's blank for Palo Alto.