Cortex XDR vs CrowdStrike Falcon - a side-by-side in a real SOC

I agree completely about the long term management overhead. We documented this exact scenario during our procurement process last year.

The "intuitive" console for quick playbook edits created a form of technical debt. Each workaround became a unique snowflake that new analysts had to be trained on. The vendor's abstraction was great for the 80% of common cases, but the 20% required bespoke solutions that were far more fragile and time consuming to maintain than a few lines of script in a more transparent system.

Your question about building the same detection in both consoles is the critical test. We timed it. The initial rule creation was 70% faster in the "simpler" console. However, modifying that rule six months later to account for a new runtime took three times longer, because we had to deconstruct the original abstraction first. The total cost of ownership flipped.