Palo Alto Networks completed its acquisition of Chronosphere on January 29, 2026. Chronosphere is now a wholly owned subsidiary, and its cloud-native observability and telemetry-control technology is being aligned with Palo Alto’s Cortex AgentiX and Cortex XSIAM platforms. The deal was announced at a headline value of $3.35 billion in cash and replacement equity awards, while Palo Alto’s later SEC filing records approximately $3.0 billion of accounting purchase consideration. Chronosphere’s Telemetry Pipeline will remain available as a standalone product.
What exactly closed?
Palo Alto Networks announced the transaction on November 19, 2025, and reported completion on January 29, 2026. Chronosphere, a privately held observability company, became a wholly owned Palo Alto Networks subsidiary. Chronosphere co-founder and CEO Martin Mao joined Palo Alto as senior vice president and general manager of observability.
| # | Preview | Product | Price | |
|---|---|---|---|---|
| 1 |
|
MINISFORUM MS-02 Ultra Workstation Mini PC, Intel Core Ultra 9 285HX (24C/24T, up to 5.5GHz), PCIe... | $1,659.00 | Buy on Amazon |
| 2 |
|
GMKtec EVO-X2 AI Mini PC Ryzen Al Max+ 395 Superchip 128GB LPDDR5X 2TB SSD | $3,649.99 | Buy on Amazon |
| Item | Detail |
|---|---|
| Buyer | Palo Alto Networks |
| Target | Chronosphere |
| Announcement | November 19, 2025 |
| Closing | January 29, 2026 |
| Announced transaction value | $3.35 billion in cash and replacement equity awards, subject to adjustments |
| Accounting purchase consideration | Approximately $3.0 billion, including about $2.842 billion in cash and $109 million in replacement awards in Palo Alto’s filing |
| Post-close status | Chronosphere is a wholly owned subsidiary |
The announcement value and accounting figure are not necessarily contradictory. Headline transaction value can include deal adjustments and equity-award treatment, while purchase accounting allocates consideration under specific SEC and GAAP rules. Palo Alto’s filing also describes $525 million of replacement equity awards issued as part of the acquisition, with portions allocated to purchase consideration and future employee service.
Primary disclosures: acquisition announcement, completion announcement, Form 8-K, and subsequent SEC filing.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →#1 Best Overall
- High-Performance AI Processor：The MS-02 Ultra features an Intel Core Ultra 9 285HX (24C/24T, up to 5.5 GHz, 13 TOPS NPU), delivering fast and efficient performance for AI inference, algorithm development, and media workloads. A PCIe x16 expansion slot supports desktop-class GPU upgrades for advanced model training and accelerated computing tasks. It's ideal for creators, engineers, and teams handling intensive parallel workloads.
- 4 × M.2 PCIe 4.0 + 4 × DDR5 SODIMM slots:Four DDR5 SODIMM slots support up to 256 GB of memory, while ECC helps maintain data integrity in mission-critical environments. Four PCIe 4.0 M.2 slots support up to 24 TB of storage, supporting RAID 0/1/5/10, combining high-speed performance with data protection. It allows for the creation of independent scratch disks, media libraries, and project drives, providing high-throughput for production workflows.
- PCIe & USB 4.0 v2: Up to three PCIe slots can be equipped, including a dual-slot x16 GPU. The main slot supports PCIe 5.0, meeting the needs of high-bandwidth creative and computing workloads. USB 4.0 v2 (80Gbps) supports high-bandwidth external storage and displays.
- Ultra-fast Networking: Wi-Fi 7 further enhances wireless performance with next-generation speeds and low-latency stability. Intelligent bandwidth switching optimizes throughput in different network environments, ensuring optimal performance for enterprise or local networks. Dual 25GbE ports (providing up to approximately 3.125 GB/s bandwidth, about 25 times faster than traditional 1GbE), enabling seamless large-scale file transfers and parallel computing. 10GbE and 2.5GbE ports, with support for Intel vPro technology, ensure enterprise-grade remote management and deployment flexibility.
- Server-grade thermal architecture: Utilizing a dedicated CPU/GPU airflow design, equipped with a 6-pipe dual-fan cooler, it maintains stable performance even under sustained loads, delivering up to 140W Turbo power while maintaining a 100W TDP, and operating with noise levels as low as 36 dB. An integrated 350W power supply ensures stable and reliable output for demanding computing tasks and fully loaded extended configurations.
What Chronosphere brings to Palo Alto
Chronosphere is a cloud-native observability platform for large-scale infrastructure, applications, microservices, containers, metrics, logs and other telemetry. Its central proposition is not simply to display dashboards; it is to control what telemetry is collected, transformed, retained and routed before data reaches expensive storage or security systems.
Telemetry Pipeline
Chronosphere’s Telemetry Pipeline can collect, filter, transform, enrich, mask, compress and route data to destinations such as cloud object storage and Cortex XSIAM. Examples described by the companies include dropping low-value debug logs at the source, truncating bulky files and masking sensitive values such as email addresses or Social Security numbers. Documentation is available at Chronosphere’s pipeline documentation.
Scale and efficiency claims
Chronosphere says its M3DB-based architecture supports more than 13 billion active time series. It also claims 20-times-lower infrastructure requirements than leading alternatives and telemetry-volume reductions of 30% or more. These are vendor claims, not independently verified benchmarks; results depend on ingestion volume, sampling, retention, architecture and workload. See the company’s FAQ, Telemetry Pipeline page and platform overview.
Palo Alto said Chronosphere generated more than $160 million in annual recurring revenue as of September 2025 and had triple-digit year-over-year ARR growth. A later Chronosphere page said ARR had exceeded $300 million after the acquisition, but that post-close company claim has not been independently confirmed in Palo Alto’s financial filings.
Recommended Free Tools
Why Palo Alto wants observability
Palo Alto is positioning observability as a data foundation for security and AI operations. AI applications, models and agents generate rapidly changing signals across infrastructure, prompts, users, dependencies and performance. Palo Alto’s argument is that an AI-security system cannot investigate or remediate reliably without timely operational context. That is the company’s strategic framing, not a universally established industry rule.
The acquisition also advances Palo Alto’s platform strategy: connect more security and operations functions, reduce the number of separate vendors and use a shared data layer across products. Telemetry control matters economically as well as technically. Filtering data before ingestion can reduce storage, transfer and SIEM costs, although no universal customer savings are established.
Palo Alto explains the security rationale in its security-operations article and acquisition materials.
Rank #2
- EVOLUTION RYZEN AI MAX+ 395 MINI PC - GMKtec EVO-X2 is the next evolution in AI mini PC Ryzen Strix Halo series. Thanks to AMD Simultaneous Multithreading (SMT) the core-count is effectively doubled, to 32 threads. Ryzen AI Max+ 395 has 64 MB of L3 cache and can boost up to 5.1 GHz, depending on the workload. The Ryzen AI Max+ 395 is currently rated as the "most powerful x86 APU" on the market for AI computing.
- AI NPU with XDNA 2 ARCHITECTURE - Powered by 16 “Zen 5” CPU cores, 50+ peak AI TOPS XDNA 2 NPU and a truly massive integrated GPU driven by 40 AMD RDNA 3.5 CUs, the Ryzen AI MAX+ 395 is a transformative upgrade and delivers a significant performance boost over the competition. The Ryzen AI Max+ 395 excels in consumer AI workloads like the llama.cpp-powered application: LM Studio. Shaping up to be the must-have app for client LLM workloads, LM Studio allows users to locally run the latest language model without any technical knowledge required and unleash their creativity and productivity.
- AMD RADEON 8090S iGPU GAMING PC - The AMD Radeon RX 8060S offers all 40 CUs with up to 2.9 GHz graphics clock and uses the new RDNA 3.5 architecture. The powerful iGPU is positioned between an RTX 4060 and 4070 laptop GPU and therefore enables gaming in FHD at maximum details in most demanding games. The 8060S can also utilize the full 128GB pool, which is perfect for running LLMs such as Deepseek 70B Q8, which runs comfortably on this machine.
- EIGHT CHANNEL LPDDR5X - LPDDR5X is a new ground breaking memory small form factor installed on-board. With blazing speeds up to to 8000MT/s, it runs 1.5x faster than the DDR5 SODIMMs; 90% better performance over DDR5 SODIMMs in video conferencing and photo editing; 30% better performance in productivity apps; 12% better performance in digital content workloads.
- QUAD SCREEN 8K DISPLAY SUPPORT - EVO-X2 AI Mini PC support 4-screen 4K/8K output via HDMI 2.1 (8K@60Hz), DisplayPort 1.4 (4K@60Hz), and dual USB 4 40Gbps Transfer speed (supporting PD3.0/DP1.4/DATA). Ideal for gaming, video editing, and multitasking, it provides expansive and crisp multi-display support.
How Chronosphere is intended to fit Cortex AgentiX
The planned architecture links observability data to agentic security workflows:
- Collect: Chronosphere gathers telemetry from applications, infrastructure, models and agents.
- Control: Telemetry Pipeline filters low-value events, transforms formats, enriches context, masks sensitive fields and routes data.
- Analyze: Relevant signals can flow to Chronosphere observability views, Cortex XSIAM and other approved destinations.
- Act: Cortex AgentiX is intended to use that context to investigate incidents and recommend or automate remediation.
This is the intended product direction, not proof that every customer will receive fully autonomous remediation at closing. Safe automation still depends on complete data, accurate root-cause analysis, tightly scoped permissions, human approvals where appropriate and reliable rollback.
The combined data flow can be summarized as: applications, infrastructure, models and agents → Chronosphere Telemetry Pipeline → filtering, transformation and routing → observability and security destinations → Cortex AgentiX investigation and remediation.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What customers can expect—and what is still unknown
Confirmed today
- Telemetry Pipeline remains available as a standalone solution.
- Chronosphere is part of Palo Alto Networks and is led within Palo Alto by Martin Mao.
- The strategic integration targets Cortex AgentiX and Cortex XSIAM.
Questions buyers should ask
- Will Chronosphere remain multi-cloud and vendor-neutral, including for customers that do not use Palo Alto security products?
- Are Telemetry Pipeline, observability, Cortex XSIAM and Cortex AgentiX licensed separately or bundled?
- What happens to existing contracts, APIs, integrations, export rights and product road maps?
- How are data residency, retention, PII masking and cross-border processing handled?
- Which destinations remain supported, and can customers recover complete raw data for forensics?
- What permissions, human approvals and rollback controls govern agentic remediation?
The completion announcement does not establish new list prices, migration requirements, product renaming or long-term packaging. Chronosphere says Telemetry Pipeline pricing is based on data throughput, but it does not publish a public dollar price; enterprise buyers must request a quote through Chronosphere.
Strategic upside and risks
Potential upside
- Earlier telemetry filtering can improve data economics.
- Security analysts and AI agents may receive richer application and infrastructure context.
- Palo Alto provides larger enterprise distribution, support and financial resources.
- Chronosphere can remain useful to customers seeking a standalone telemetry-control layer.
Material risks
- Filtering or sampling may remove evidence later needed for incident response.
- Masking can fail or make logs unusable if policies are poorly designed.
- Routing can introduce delay during an active incident.
- Agents can act incorrectly when telemetry is incomplete or misleading.
- Bundled licensing could cost more than separate tools.
- Application-performance teams may be underserved if road maps prioritize SOC workflows.
- Customers may face greater dependence on Palo Alto and less observability neutrality.
How the combined offering compares with alternatives
The relevant question is not just which product has the best dashboards. It is which architecture supplies trustworthy operational context to security analytics and AI agents while controlling telemetry cost and preserving customer choice.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
| Alternative | Typical strength | Key distinction from Palo Alto/Chronosphere |
|---|---|---|
| Datadog | Broad SaaS observability and security | Mature all-in-one cloud platform; usage-linked telemetry economics require modeling. Pricing: Datadog pricing. |
| New Relic | Full-stack application and infrastructure observability | Often led by application teams; see pricing. |
| Grafana Labs | Open-source-oriented, composable metrics, logs and traces | More portability and control, with potentially greater platform-engineering ownership. See pricing. |
| Elastic Observability | Search, analytics, observability and security | Strong fit for Elasticsearch users and flexible deployment needs. See pricing. |
| Splunk | Enterprise SOC adoption and broad data analysis | Natural for established Splunk environments; licensing and migration economics need a quote. Observability: Splunk Observability. |
| Dynatrace | Application intelligence, dependency mapping and automation | Designed for complex enterprises; see pricing. |
| OpenTelemetry | Vendor-neutral instrumentation and collection | Improves portability but is not a complete backend, SIEM or remediation product. |
A telemetry pipeline can complement any of these backends or a SIEM; it does not automatically replace the system that stores, queries and presents observability data.
Due diligence checklist for an enterprise evaluation
- Request pricing based on raw ingestion, throughput, retention, hosts, users and queried data.
- Run a proof of concept using representative Kubernetes, cloud and on-premises workloads.
- Measure reduction assumptions rather than accepting 30% or 20-times claims as universal.
- Verify OpenTelemetry compatibility, supported destinations and export guarantees.
- Test PII redaction, audit trails, residency controls and retention tiers.
- Document separate licensing for Telemetry Pipeline, observability, Cortex XSIAM and Cortex AgentiX.
- Require human-approval, least-privilege and rollback controls before enabling automated remediation.
- Obtain written commitments on APIs, service levels, support coverage and treatment of existing Chronosphere contracts.
What the acquisition means for investors and the observability market
For Palo Alto, Chronosphere adds a recurring-revenue observability business and a data-control layer that can make its AI-security platform more differentiated. For observability buyers, it increases pressure to connect application telemetry, security analytics and automation without losing portability. The commercial outcome will depend less on the closing announcement than on integration quality, pricing, roadmap neutrality and whether customers can safely turn telemetry into action.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
