At a glance
- Deployment
- saas, hybrid
- Licence
- proprietary
- Categories
- observability platform, metrics backend, telemetry pipeline, log management, tracing backend
- Ownership
- Acquired by Palo Alto Networks, closed 2026-01-29 · s_calyptia, s_embrace, s_founding, s_panw_10k, s_panw_10q, s_panw_announce, s_panw_close, s_xcor_blog
- Estimate
- Quote only: no usable list price for the standard workload
What it charges for
Every line item recorded for Chronosphere (now Palo Alto Networks Cortex XCOR). "Not stated" means the vendor's own page gives no number; it is never treated as zero.
| Line item | Unit | Commitment | List price | Sources |
|---|---|---|---|---|
| Chronosphere SaaS (AWS Marketplace public offer) | custom | 12-month contract, prepaid via AWS bill, no refunds | $180,000 | s_aws_saas |
| Telemetry Pipeline Unit (AWS Marketplace) | custom | 12-month contract per Unit; 24/36-month terms listed without prices | $670 | s_aws_pipeline, s_faq |
| Metrics persisted series (consumption) | custom | contract; consumption or credits | Not stated | s_defs, s_licensing |
| Metrics persisted datapoints (consumption) | million-metric-samples | contract; consumption or credits | Not stated | s_defs, s_licensing |
| Metrics matched datapoints (consumption) | million-metric-samples | contract; consumption or credits | Not stated | s_defs, s_licensing |
| Metrics persisted histogram datapoint buckets | custom | contract; consumption or credits | Not stated | s_licensing |
| Metrics matched histogram datapoint buckets | custom | contract; consumption or credits | Not stated | s_licensing |
| Logs persisted bytes | gb-indexed | contract; capacity, consumption or credits | Not stated | s_defs, s_licensing |
| Logs processed bytes | gb-processed | contract; capacity, consumption or credits | Not stated | s_defs, s_licensing |
| Traces persisted bytes | gb-indexed | contract; capacity, consumption or credits | Not stated | s_licensing |
| Traces processed bytes | gb-processed | contract; capacity, consumption or credits | Not stated | s_licensing |
| Change events persisted capacity | custom | contract; capacity | Not stated | s_defs, s_licensing |
| Metrics capacity license: persisted writes per second | custom | contract; capacity model | Not stated | s_defs, s_quotas |
| Metrics capacity license: persisted cardinality | custom-metric-series-month | contract; capacity model | Not stated | s_defs |
| Metrics capacity license: matched writes per second | custom | contract; capacity model | Not stated | s_defs |
| XCOR credits | credit | pool purchased for a contract period; usage beyond the pool billed per contract terms | Not stated | s_licensing, s_xcor_page |
How the estimate is built
Chronosphere (now Palo Alto Networks Cortex XCOR) is listed as quote only. It publishes nothing priceable for this workload, so it has no estimate here. That is not the same as cheap or free.
Capabilities
What Chronosphere (now Palo Alto Networks Cortex XCOR) offers, by the definitions in the dataset. Add-on means a separately priced product.
| Capability | Level | Sources |
|---|---|---|
| Ai assistant nl query Natural-language query or chat assistant | Partial | s_genai |
| Ai root cause AI-assisted root-cause analysis or investigation agent | Yes | s_docidx, s_xcor_blog |
| Alerting Alert rules with routing/notification | Yes | s_docidx |
| Audit logs Audit log of user/admin actions | Yes | s_docidx |
| Data reduction Drop, aggregate, dedupe, or convert logs-to-metrics before billing | Yes | s_docidx, s_logshape, s_xcor_blog |
| High cardinality Designed for high-cardinality attributes without pre-aggregation penalties | Yes | s_datastores, s_faq |
| Incident response Native on-call/incident workflow | No | s_docidx |
| Logs Log management | Yes | s_docidx, s_licensing |
| Mcp server Exposes an MCP server for agents | Yes | s_mcp |
| Metrics Metrics | Yes | s_docidx, s_licensing |
| Multi destination routing Route one stream to several third-party destinations | Yes | s_aws_pipeline, s_docidx |
| Observability as code Terraform provider / dashboards-and-alerts as code | Yes | s_docidx |
| Otel collector distro Ships or supports its own OpenTelemetry Collector distribution | Yes | s_cxdot |
| Otlp ingest Accepts OTLP (gRPC or HTTP) natively, without a proprietary agent in the path | Yes | s_otel |
| Persistent queue Disk-backed buffering and retry under backpressure | Partial | s_backpressure |
| Pii redaction Mask/redact sensitive data in the pipeline | Yes | s_docidx |
| Pipeline processing Parse, enrich, transform in flight before storage | Yes | s_aws_pipeline, s_docidx, s_logshape |
| Prometheus remote write Accepts Prometheus remote_write | Partial | s_docidx |
| Promql Query with PromQL (or a compatible dialect) | Yes | s_docidx |
| Proprietary agent required Full functionality needs the vendor's own agent (yes = lock-in signal) | No | s_otel |
| Rbac Role-based access control | Yes | s_docidx |
| Rum Real-user monitoring (browser/mobile) | Partial | s_docidx, s_embrace, s_panw_10k, s_xcor_blog |
| Saas Vendor-hosted SaaS | Yes | s_datastores, s_faq |
| Sampling tail Tail-based trace sampling | Yes | s_docidx |
| Self hosted Customer can run it on its own infrastructure | Partial | s_faq, s_pipeline_arch |
| Service map Auto-discovered service/topology map | Yes | s_docidx |
| Slo management First-class SLO/error-budget objects | Yes | s_docidx, s_genai |
| Sso saml SSO via SAML/OIDC | Yes | s_docidx |
| Synthetics Synthetic monitoring | Partial | s_docidx, s_xcor_blog |
| Tiered storage Hot/warm/cold or archive tiers priced differently | Partial | s_defs, s_licensing |
| Traces Distributed tracing | Yes | s_docidx, s_licensing |
| Usage cost controls Quotas, budgets, usage attribution to teams | Yes | s_consumption, s_docidx, s_licensing |
Sources
Every page cited above, with the date it was read. Third-party pages are marked; a price stated only by a third party is shown as not stated.
Spotted a wrong price? A way to report one is not set up yet.