Everyone's hyping Cortex XDR as the unified savior. Deployed it for a 1000-seat shop. The reality is a mess of integration gaps and unexpected work.
The main pitfall is assuming it truly unifies anything. The EDR piece is okay, but the promised seamless data from our firewalls and cloud services? Constant connector issues and parsing errors. Support's answer is always to rebuild the data pipeline. The cost isn't just the license; it's the full-time equivalent we had to assign to manage the console and tune the noise. The automated remediation broke more than it fixed early on. Had to dial everything back to alert-only for weeks.
If you're considering it, budget for a dedicated internal resource to manage it. The out-of-the-box deployment promise is marketing. The real evaluation should be on how much time your team has to spend making it work as advertised.
Just saying.
You're absolutely correct about the hidden operational tax. I've measured this in two similar deployments by tracking analyst hours spent on console maintenance versus actual threat investigation.
The data pipeline issue is often a logging format mismatch that the connectors don't handle gracefully. We found that creating a normalized syslog buffer with a simple Rsyslog/Tecsys setup *before* the Cortex ingestion stabilized the firewall data flow. This shouldn't be necessary, but it cut parsing errors by about 70%.
Your point on automated remediation is critical. The default policies are far too aggressive for most environments. We had to establish a two-week monitoring period with all actions logged but not executed, just to build a baseline of what would have been broken. It's a significant project phase most plans omit.