Palo Alto Networks: Cortex XSOAR 6.8: Automation and Orchestration (EDU-380)

EDU-380 is a four-day, instructor-led Palo Alto Networks course on automating and orchestrating security operations with Cortex XSOAR. It is based on Cortex XSOAR 6.8. Participants configure integrations, build playbooks and incident layouts, and manage content, indicators, jobs, and user roles. It is designed for SOC, CERT, CSIRT, and SOAR engineers.

The outline runs from core functionality, integrations, and playbook development to classification and mapping, the layout builder, solution architecture, and Docker. It also covers automation development and debugging, content management, indicators, jobs, role-based access controls, and integration development. A phishing-response playbook serves as the worked example. Teams on a different XSOAR version should ask how closely the labs match their deployment.

Palo Alto Networks names security operations and SOAR engineers, MSSPs, service delivery partners, system integrators, and professional services engineers. The course is designed to help SOC, CERT, and CSIRT engineers start working with XSOAR. If your role involves building or maintaining automated response, it is relevant to you.

Palo Alto Networks requires participants to complete the Cortex XSOAR Analyst digital learning before attending. It also states that completing EDU-380 does not require proficiency in writing code. Partner course notes add that experience with scripting, Python, JavaScript, and JSON data helps participants apply the material faster.

You practise enabling integrations, building playbooks with tasks, classifying and mapping events, and designing incident layouts. You also work on automation development and debugging, managing indicators and content, scheduling jobs, and setting role-based access. How far you progress depends on your starting experience and how often you apply the skills.

No. EDU-380 is training. It is not an exam and not a certification. Palo Alto Networks has moved to role-based certifications and retired the PCSAE exam in 2025, so check its current certification catalogue for any exam relevant to Cortex XSOAR. Certification requires passing an exam separately, and attending the course does not award one.

Playbooks turn repeated manual steps into documented, repeatable actions. Orchestration connects the tools involved, so an analyst does not switch between consoles to check one indicator. The result is more consistent incident records and more analyst time for cases that need judgment, rather than for copying data between systems.

It builds practical skills in security automation, which are relevant to SOC, incident response, and SOAR engineering roles. Documented playbooks also give you work you can demonstrate to colleagues. The course does not guarantee a job, salary increase, or promotion, as those depend on many factors outside the training.