Included
Video Recordings
Video recordings are included as a standard student benefit, so you can revisit demos and complex topics after the class.
Palo Alto NetworksCortex XSIAMXSIAM-A
Cortex XSIAM: Investigation and Analysis
Investigate and analyse security incidents in Cortex XSIAM: alert triage, incident investigation, XQL queries, threat hunting, and analyst workflows on the unified SOC platform.
- Duration
- 2 Days
- Delivery
- Live instructor-led
- Format
- Online or classroom
- Learner rating
- 4.54/5149 Course reviews
What you will be ready to do
Get hands-on with the official Palo Alto Networks curriculum.
- Work through guided, hands-on labs on your own dedicated instance.
- Apply configuration best practices from real projects.
- Understand how the platform components work together.
- Troubleshoot common issues with a structured approach.
Who it’s for
Is XSIAM-A the right course?
Designed for
SOC analysts who triage, investigate, and respond to incidents in Cortex XSIAM.
Prerequisites
Ask for course advice Basic networking knowledge is recommended. No prior Palo Alto Networks experience is required unless stated for advanced courses.
Included
Lab Access for 3 month
You work in your own dedicated lab during the training week. FireWall courses include 3-month extended lab access after the class.
Course authority
Official curriculum
Official Palo Alto Networks curriculum
Course content
Verify the curriculum before you choose a class.
Learn by doing in a dedicated lab. Every module pairs theory with lab time, so you practise each step the way you would on the job. The pace suits engineers who are new to the platform as well as administrators who want to close gaps and adopt best practices across their deployment.
Best Practices & real Life Experience
Your instructor brings years of real-world Palo Alto Networks project experience into the classroom and shares field-proven best practices throughout the course.
Certification
This course supports the matching Palo Alto Networks certification path. Ask our training team which exam and preparation route fits your goals.
Scope
The course follows the official Palo Alto Networks curriculum for the version listed in the schedule.
FAQ
Questions about formats, time zones, payment options, or team training? Contact the training team at training@consigas.com.
Genuine learner feedback
Students Love Our Instructors
Based on 149 course reviews
Featured learner reviews Reviews collected via Reviews.io ↗
View the complete Consigas profile on Reviews.io (opens in a new tab).
Anonymous
Verified via Reviews.io
The class goes into a very detailed explanation of the query language “XQL” and the various uses with Cortex XSIAM.
Dale Johnson at US Internal Revenue Service (IRS)
Verified via Reviews.io
A solid introduction for security analysts to perform investigations and remediations.
Humberto Olivet at Red8
Verified via Reviews.io
The Cortex XSIAM for Investigation and Analysis training is a well-structured and highly practical course. It clearly explains how to investigate incidents, analyze alerts, and leverage automation within the XSIAM platform using real-world scenarios. The hands-on approach and clear explanations make complex concepts easy to understand and apply. Overall, it’s a valuable course for anyone looking to strengthen their security operations skills with tools from Palo Alto Networks.
Josh Holmes at US Internal Revenue Service (IRS)
Verified via Reviews.io
The lab assessment was frustrating as it kept freezing, but the labs and guides were easy to follow
Belle Nikamhoua at Deloitte Touche Tohmatsu India Llp
Verified via Reviews.io
I like to fact that everything is bundled into one tool.
Leonard Cruz at Corebridge Financial
Verified via Reviews.io
The videos were good
Page 1 of 2
Course agenda
Explore the complete Cortex XSIAM: Investigation and Analysis agenda.
The “Cortex XSIAM: Investigation and Analysis” course covers the following content.
Select a module to see its topics and lab activities.
Course Introduction
- Welcome and introductions
- Intended audience and course focus
- Course objectives and agenda
- Learning Center tasks
Introduction to Cortex XSIAM
- Overview of XSIAM
- Features and Functionalities
- Problems XSIAM Solves
Endpoints
- Using XSIAM for Endpoint Detection and Response
- Endpoint Security
- Investigating Endpoints
XQL
- Introduction and Overview of XQL
- XQL Components
- Understanding Data Models
Alerting and Detection
- Using Alert Correlation Features
- Alert Causality
- Incident Prioritization
- Incident Statuses
Threat Intel Management
- Threat Intel Management
- Indicator Configuration
- Indicator Investigation
Automation
- Automation Overview
- Work Plan and Playbook Tasks
- Context Data
- Creating and Managing Jobs
- Using OOTB Content
Attack Surface Management
- Attack Surface Management
- Asset Inventory
- ASM Investigation
Incident Handling
- Introduction to Incident Handling
- Incident Investigation and Response
- Managing Incidents
- Alert Investigation
- Cortex Copilot
Dashboards and Reports
- Customizing Dashboards
- Generating and Scheduling Custom Reports
Your next step
Choose the XSIAM-A class that fits your schedule.
Compare dates and prices first. If you are still confirming timing, you can reserve this course for free or ask the training team for advice.