Hey everyone, new to the forum and diving into the SOAR/security orchestration space for a project at work. We're currently evaluating Chronicle and Demisto (now Cortex XSOAR) side-by-side, and I keep hitting this one point of confusion.
I've been going through the available playbooks and content for both platforms. Chronicle's built-in playbook library feels... leaner? Especially when you look at the community-driven aspect. Demisto's marketplace seems to have a huge volume of integrations and pre-built playbooks for so many specific vendors and use cases.
Is this a known gap, or am I just looking in the wrong place within Chronicle? Our team is small, so having that out-of-the-box breadth of content is a big factor. I'm curious about practical experience: if you've used both, did you find you had to build a lot more from scratch in Chronicle? Or does Chronicle's approach with its native detection engine and YARA-L mean you need fewer "glue" playbooks anyway?
Also, how's the quality and maintenance of the playbooks that *are* there? A huge library is one thing, but if they're outdated, it's not much help. Any insights on the comparison would be super helpful as we try to make a decision. Thanks!