Sample Agent Pack · Read-only preview

Sample · XSIAM Premium renewal

This is what the Clarify agent team looks like after you run a real SOW. Five specialists, each tuned to your document and grounded in the official Palo Alto Networks XSIAM and Cortex XDR docs. Click any agent to read a sample exchange. To talk to your own team, run your own SOW.

What we read in this sample SOW

Three-year commit on Palo Alto Networks Cortex XSIAM Premium delivered by an authorized partner. Includes platform license, 30-day data retention, an 8-week professional services deployment, an ongoing content engineering retainer, and a 3-year Unit 42 threat intelligence subscription.

Type · security implementation

Your specialists

Sample exchange

Translator

Decodes vendor language line by line into plain English a non-technical buyer can defend to their CFO and board.

Read-only

You

Translate this SOW line by line into plain English. For each line: what work is actually being done, what business outcome it produces, and what the deliverable looks like when it's done.

Translator

Here's the SOW in plain English. Each line: what's being done, what you get, what the deliverable looks like. | # | SOW line | What it actually means | Deliverable | |---|---|---|---| | 1 | XSIAM Premium License (36 mo) | The platform itself. Three-year commit to Palo's SIEM + XDR + automation suite. | License keys, tenant provisioned, retention configured. | | 2 | XSOAR Automation Engine | The playbook engine bundled inside XSIAM Premium. Already in line 1. | (Nothing new — it's already in your license.) | | 3 | XSIAM AI Module | The ML/AI features inside the platform. Already in Premium tier. | (Nothing new — also already in your license.) | | 4 | Data Retention, 30 days | How long raw logs are kept hot for search. | A configuration toggle, not a service. | | 5 | XSIAM Professional Services Deployment, 8 weeks | Partner installs and configures the platform: tenant setup, log source onboarding, baseline content packs. | Working tenant, ~5–10 log sources connected, default content live. | | 6 | Content Engineering Retainer | Ongoing block of hours to build and tune detection content. | Custom detections, response playbooks, periodic tuning. | | 7 | Unit 42 Threat Intelligence | Palo's threat-intel feed, 3-year subscription. | A data feed, not a service. | **Bottom line in plain English:** You're paying for the platform (line 1), eight weeks of partner setup (line 5), and an ongoing retainer for custom content (line 6). Lines 2, 3, 4, and 7 are either already inside what you bought or are subscriptions that don't require any work. Ask the **OOTB Auditor** for the full coverage list, and the **Estimator** for hour-by-hour reality on lines 5 and 6.

Ready to do this with your own SOW?

Run yours →