Cortex XDR: Investigation and Response

Cybersecurity analysts and engineers, and security operations specialists.

Successful completion of this instructor-led course with hands-on lab activities should enable the students to:

• Investigate attacks on the incidents page, and score, assign, and close them
• Investigate artifacts using the specialized views such as IP View and Hash View
• Work with Cortex XDR Pro actions: the remote script execution and EDL service
• Describe the Cortex XDR causality and analytics concepts
• Analyze alerts using the Causality and Timeline Views
• Create and manage on-demand and scheduled search queries in the Query Center
• Create and manage the Cortex XDR rules BIOC and IOC
• Work with the Cortex XDR’s external data ingestion support
• Write XQL queries to search datasets and visualize the result sets
• Create simple Correlation Rules and Parsing Rules using XQL

Participants must have taken the course EDU-260 (Cortex XDR: Prevention and Deployment).

• Cortex XDR Incidents

• Investigation Views

• Advanced Response Actions

• Causality and Analytics Concepts

• Causality Analysis of Alerts

• Building Basic Search Queries

• Building Basic XDR Rules

• External Data Collection

• Introduction to XQL

• Correlation and Parsing Rules

The technical curriculum developed and authorized by Palo Alto Networks and delivered by Palo Alto Networks Authorized Training Partners helps provide the knowledge and expertise that prepare you to protect our digital way of life. Our trusted certifications validate your knowledge of the Palo Alto Networks product portfolio and your ability to help prevent successful cyberattacks and safely enable applications.

Previous courses

Cortex XDR: Prevention and Deployment [EDU-260]