Included
Video Recordings
Video recordings are included as a standard student benefit, so you can revisit demos and complex topics after the class.
Palo Alto NetworksCortex XDRXDR-A
Cortex XDR: Investigation and Analysis
Investigate incidents with Cortex XDR: alert analysis, causality chains, response actions, and hunting across endpoint and network telemetry.
- Duration
- 2 Days
- Delivery
- Live instructor-led
- Format
- Online or classroom
- Learner rating
- 4.67/5525 Course reviews
What you will be ready to do
Get hands-on with the official Palo Alto Networks curriculum.
- Work through guided, hands-on labs on your own dedicated instance.
- Apply configuration best practices from real projects.
- Understand how the platform components work together.
- Troubleshoot common issues with a structured approach.
Who it’s for
Is XDR-A the right course?
Designed for
SOC analysts who investigate and respond to incidents surfaced by Cortex XDR.
Prerequisites
Ask for course advice Basic networking knowledge is recommended. No prior Palo Alto Networks experience is required unless stated for advanced courses.
Included
Lab Access for 3 month
You work in your own dedicated lab during the training week. FireWall courses include 3-month extended lab access after the class.
Course authority
Official curriculum
Official Palo Alto Networks curriculum
Course content
Verify the curriculum before you choose a class.
Learn by doing in a dedicated lab. Every module pairs theory with lab time, so you practise each step the way you would on the job. The pace suits engineers who are new to the platform as well as administrators who want to close gaps and adopt best practices across their deployment.
Best Practices & real Life Experience
Your instructor brings years of real-world Palo Alto Networks project experience into the classroom and shares field-proven best practices throughout the course.
Certification
This course supports the matching Palo Alto Networks certification path. Ask our training team which exam and preparation route fits your goals.
Scope
The course follows the official Palo Alto Networks curriculum for the version listed in the schedule.
FAQ
Questions about formats, time zones, payment options, or team training? Contact the training team at training@consigas.com.
Genuine learner feedback
Students Love Our Instructors
Based on 525 course reviews
Featured learner reviews Reviews collected via Reviews.io ↗
View the complete Consigas profile on Reviews.io (opens in a new tab).
Artur Grygoruk at NTT Data
Verified via Reviews.io
Very important content, which discussed how to use Query Builder to filter logs and alerts. It was mainly focus on lab exercises. I enjoyed especially the part about blocking specific files and investigation process related mapping specific alerts to incident. Kenan explained this part very well and I will review for sure uploaded videos from EDU-262 training in order to get prepared to PCDRA exam soon in center.
Anonymous
Verified via Reviews.io
The Instructor has profound knowledge of the subject matter. His explanation was clear and organized. Hands-on practice on the lab reinforced what's learned during the course. The questions and concerns raised by the participants were addressed perfectly by the instructor.
Anonymous
Verified via Reviews.io
I have taken EDU-260 AND EDU -262 will Alin Budisan. He is a fantastic trainer and really cares about his students. He explains the material well and provides additional information, not in the training document. He also gives real-world examples from other known breaches and his real-world experiences.
I highly recommend him for all training
Ryan Aspinwall at Cypfer
Verified via Reviews.io
The lab work for this course is worth is weight in gold!
Daniel Zannoth at Indevis GmbH
Verified via Reviews.io
We've learned how to work with Incidents and Alerts, make use of the causality chain information, execute scripts remotely on an endpoint, how to use the query builder, create our own custom prevention rules and how to use them in addition to the IOC and BIOX Rules, using the network mapper and how to use create XQL Queries and visualize the results.
Michael Kujawa at Yakima Valley Farm Workers Clinic (YVFWC)
Verified via Reviews.io
It would be great if the section detailing XQL was expanded upon further, but the rest of the course was fine.
Page 1 of 2
Course agenda
Explore the complete Cortex XDR: Investigation and Analysis agenda.
The “Cortex XDR: Investigation and Analysis” course covers the following content.
Select a module to see its topics and lab activities.
Course Introduction
- Welcome and introductions
- Intended audience and course focus
- Course objectives and modules
- Learning Center tasks
Cortex XDR Incidents
- INTELLIGENTLY GROUPING AND DISPATCHING ALERTS TO THE INCIDENTS
- Cortex XDR Incidents
- Working with Incidents
- Advanced View Tabs
- Incident Scoring Rules
- Lab: Working with Enhanced Endpoint Data
- Analyze Alerts Stitched with Enhanced Endpoint Data
- Manage Enhanced Endpoint Data Monitoring from Endpoints
Causality and Analytics Concepts
- DETECTING ATTACKS using normal and abnormal behaviors
- Causality Analysis Engine: Log Stitching
- Causality Analysis Engine: Causality Chains
- Analytics Engine
- Lab: Working with Incidents
- Work with the Advanced Incident View
- Score Your Incidents
- Investigate Files Using Hash View
Causality Analysis of Alerts
- CAUSALITY AND TIMELINE ANALYSIS OF ALERTS AND SUSPICIOUS ACTIVITIES
- Causality View
- Causality Instance Graph
- Timeline View
- Lab: Causality Analysis of Alerts
- Analyze Alerts in Causality View
Advanced Response Actions
- ADVANCED RESPONSE ACTIONS IN CORTEX XDR PRO
- Remediation Suggestions
- Remote Script Executions
- Enabling Cortex XDR EDL Service
- Lab: Advanced Response Actions
- Execute Scripts on Endpoints
Building Search Queries
- Investigating leads using Cortex XDR tools
- Building Simple Queries
- Managing Queries
- Lab: Building Search Queries
- Build and Manage Search Queries
Building XDR Rules
- Using user-defined indicators of compromises
- IOC Rules
- BIOC Rules
- Custom Prevention Rules
- IOC/BIOC Suppression Rules
- Correlation Rules
- Lab: Working with Cortex XDR Rules
- Managing IOC Rules
- Managing BIOC Rules
- Custom Prevention Rules
Cortex XDR Assets
- DISCOVERY, INVENTORY, AND MANAGEMENT OF NETWORK ASSETS
- Asset Inventory
- Network Configuration
- Vulnerability Assessment
- Lab: Working with Network Assets
- Activate and Register a Broker VM
- Scan IP Ranges with Network Mapper
- Investigate IP Addresses Using IP View
Introduction to XQL
- XDR Query Language (XQL)
- XQL Search Basics
- XQL Stages
- XQL Functions
- Result Set Visualization
- Lab: Getting Started with XQL Queries
- Get Started with XQL Search Page
- Create XQL Queries with Multiple Stages
- Visualize Query Results
External Data Collection
- COLLECTING EXTERNAL ALERTS AND LOGS
- External Data Collection
- Dataset Management
- External Alerts by Cortex XDR API
- Lab: Working with External Data
- Create and Manage Datasets
- Insert External Alerts Using XDR API
Your next step
Choose the XDR-A class that fits your schedule.
Compare dates and prices first. If you are still confirming timing, you can reserve this course for free or ask the training team for advice.