Included
Video Recordings
Video recordings are included as a standard student benefit, so you can revisit demos and complex topics after the class.
Palo Alto NetworksCortex XSOARXSOAR-E
Cortex XSOAR: Engineering Security Automation Solutions
Engineer security automation with Cortex XSOAR: playbook development, integrations, incident types and layouts, automation scripting, and orchestrating response across your security stack.
- Duration
- 4 Days
- Delivery
- Live instructor-led
- Format
- Online or classroom
- Learner rating
- 4.51/5469 Course reviews
What you will be ready to do
Get hands-on with the official Palo Alto Networks curriculum.
- Work through guided, hands-on labs on your own dedicated instance.
- Apply configuration best practices from real projects.
- Understand how the platform components work together.
- Troubleshoot common issues with a structured approach.
Who it’s for
Is XSOAR-E the right course?
Designed for
Security engineers and SOC automation developers building playbooks and integrations in Cortex XSOAR.
Prerequisites
Ask for course advice Basic networking knowledge is recommended. No prior Palo Alto Networks experience is required unless stated for advanced courses.
Included
Lab Access for 3 month
You work in your own dedicated lab during the training week. FireWall courses include 3-month extended lab access after the class.
Course authority
Official curriculum
Official Palo Alto Networks curriculum
Course content
Verify the curriculum before you choose a class.
Learn by doing in a dedicated lab. Every module pairs theory with lab time, so you practise each step the way you would on the job. The pace suits engineers who are new to the platform as well as administrators who want to close gaps and adopt best practices across their deployment.
Best Practices & real Life Experience
Your instructor brings years of real-world Palo Alto Networks project experience into the classroom and shares field-proven best practices throughout the course.
Certification
This course supports the matching Palo Alto Networks certification path. Ask our training team which exam and preparation route fits your goals.
Scope
The course follows the official Palo Alto Networks curriculum for the version listed in the schedule.
FAQ
Questions about formats, time zones, payment options, or team training? Contact the training team at training@consigas.com.
Genuine learner feedback
Students Love Our Instructors
Based on 469 course reviews
Featured learner reviews Reviews collected via Reviews.io ↗
View the complete Consigas profile on Reviews.io (opens in a new tab).
Paul Trivino at Rady Children’s Hospital
Verified via Reviews.io
This is a highly detailed course on both the theory and mechanics of building, tuning and using the facilities of Cortex XSOAR. The architecture of the system is well explained, as are the integrations available from Palo Alto Networks, partner enterprises such as threat intelligence and identity management providers, and the contributed content from other customers. It covers both the development of the workflows for use cases and the playbooks used to automate those activities, very well. The lab exercises used to build the skills and knowledge to effectively use XSOAR are excellent.
I would in fact change this to a 5 day class to allow a little more time for the labs.
Kevin Stahl at Verizon
Verified via Reviews.io
This Cortex XSOAR course is a great introduction for all regardless of experience level. There is a lot of good content and it explains the basics of the administrator function in XSOAR when assigning roles, creating playbooks, and creating the logic behind them. I feel more confident as an analyst within XSOAR now and learned functions I was not aware of before.
Sebastian Seyfarth at Consigas
Verified via Reviews.io
I fell in love with the War Room instantly and can't wait to get to work with it! The course is well structured and the completion of each course day with a lab was more than successful. It was one of the best courses I have attended in the field of DFIR, not least because of the lecturer
Corey Vigneux at The Boeing Company
Verified via Reviews.io
This is a great introductory course covering the basics of XSOAR development. I learned a lot from the labs and am excited to go back to the office to apply all ive learned.
Anonymous
Verified via Reviews.io
Very relevant for anyone looking to manage XSOAR instances,their users, manage incidents, set up playbooks. Instructor Alin Budisan was very knowledgeable and answered any questions that came up in detail, while keeping things engaging and lighthearted with personal anecdotes.
Anonymous
Verified via Reviews.io
The course covers a lot of very important aspects that will be required to know when working within Cortex XSOAR. I would have liked a bit of hands-on programming integrated into the course, but we learned where to review existing code in the system so that should be enough to get me started.
Page 1 of 2
Course agenda
Explore the complete Cortex XSOAR: Engineering Security Automation Solutions agenda.
The “Cortex XSOAR: Engineering Security Automation Solutions” course covers the following content.
Select a module to see its topics and lab activities.
Course Overview
- Welcome and introductions
- Intended audience and course focus
- Course objectives, modules, and exam
- Certification information and Beacon tasks
- Lab topology
Core Functionality and Feature Sets
- Extended security orchestration, automation, and response
- Product pillars
- High-level flow logic
- Use case development
- Cortex XSOAR Initial Discovery Lab
- Log in to the lab environment.
- Create two new user accounts.
- Explore the War Room.
- Explore the Marketplace and install content packs.
- Explore the web interface of Cortex XSOAR.
XSOAR Integrations
- Event sources, investigation resources, and response targets
- Integration concepts
- Types of integrations
- Installation and configuration
- Integration controls
- Integrations Lab
- Configure the basic integrations
- Configure the urlscan.io integration
- Configure the VirusTotal integration
- Configure custom integrations
- Test the integrations
- Review the indicators
- Prepare for the next lab
Playbooks
- Point-and-click scripting . . . and beyond
- Engineer resources
- Playbook functions
- Indicator extraction
- Incidents Investigation Lab
- Select an incident
- Case Info tab
- Investigation tab
- War Room tab
- Work Plan tab
- Mark as Evidence
- Collaboration
- Evidence Board tab
Classification & Mapping
- Apply an Incident Type.
- Write event data to XSOAR fields.
- Process flow
- Integration configuration and generation
- Classification
- Mapping
- Classification and Mapping Lab
- Create an Incident Classifier
- Create a new Incident Mapper
- Map data to the Detected IPs field
- Map data to the Detected User field
- Map data to the File MD5 field
- Test the Mapping Rule
Layout Builder
- Display data that analysts want to see in a format that’s easy to use.
- Layouts and system logic
- Access to the Layout Builder
- Using the Layout Builder
- Best practices
- Incidents Layout Configuration Lab
- Create a new incident type
- Create a new field
- Define the Incident Layout
- Update the new Incident Layout
- Test the layout
Solution Architecture
- Multiserver configurations for cloud hosting, dev‑prod, and high availability
- Basic topologies
- Scalability
- Dev-prod
- Log files
Docker
- How XSOAR uses it and how you can customize its use
- Docker basics
- System use of Docker
- Hardening and use of custom images
- Pre-Process Rules Lab
- Create the pre-processing rule
- Verify the results
Automation Development & Debugging
- Automation scripts perform narrowly defined, focused tasks
- Automation concepts
- Writing automations
- Build a Playbook Lab
- Create a new incident
- Create a custom playbook
- Test the playbook in the Work Plan
- Continue the playbook creation
The Marketplace and Content Management
- Content packs, what is inside them, and what may be outside . . .
- Platform content and the Marketplace
- Custom content
Indicators and Threat Intelligence Management
- Take command of observable indicators and threat intel feeds
- Indicator management
- Auto extraction
- Threat Intelligence Management
- Add SaaS Applications to a Firewall Allow List Lab
- Configure the Office 365 feed
- Configure the Instance Execute External setting
- Configuration of Palo Alto Networks firewall integration
- Populate and test the PANW EDL Service integration
- (Optional) Configure the firewall to get the EDL
- Block and/or Alert on Observable Known Threats Lab
- Configure threat-feed integrations
- Create a job for indicator analysis
- Business-partner and internal lists
- Test the functionality of the list
- Configure the PANW EDL Service to get configured Threat Feeds
- Verify that the EDL operates as expected
- Configure the firewall to get the EDL (Optional)
Jobs and Job Scheduling
- A job is a scheduled one-time or recurring incident
- Job concepts
- Create and edit jobs
- Monitor and manage jobs
- Lists Lab
- Set up the webserver
- Create a list
- Create a playbook
- Test your playbook
- Jobs Lab
- Create a new job
Users and Role-Based Access Controls (RBAC)
- Use RBAC settings to limit access to system functions
- Local User Accounts
- Network User Accounts
- RBAC Settings
- Troubleshooting
- Users and RBAC Lab
- Create roles
- Assign roles
- Create a playbook to assign roles
- Assign a default playbook to incident types
- Review your classification and pre-processing rules
- Test your role assignment
- Users and RBAC Lab
- Create roles
- Assign roles
- Create a playbook to assign roles
- Assign a default playbook to incident types
- Review your classification and pre-processing rules
- Test your role assignment
- Custom Widgets and Shifts Lab
- Create some new users
- Create shift roles
- Create an automation script for a widget
- Create a new dashboard and add a widget
Integration Development
- Bring your own integration! (BYOI)
- BYOI concepts
- Best practices
Your next step
Choose the XSOAR-E class that fits your schedule.
Compare dates and prices first. If you are still confirming timing, you can reserve this course for free or ask the training team for advice.