Palo Alto Networks: Cortex XSOAR 6.8: Automation and Orchestration (EDU-380)

Automation can sound like something for developers. For most security staff, the first step is much smaller: take a procedure you already follow and write it down in a form a machine can run. EDU-380 is Palo Alto Networks Cortex XSOAR training that guides analysts and engineers through that first step and the ones after it.

The course lasts four days, is instructor-led, and is based on Cortex XSOAR 6.8. It suits SOC, CERT, CSIRT, and SOAR engineers. Palo Alto Networks asks participants to finish the Cortex XSOAR Analyst digital learning first, so everyone arrives knowing the platform from an analyst’s point of view. It also states that writing code proficiently is not required.

A sensible order helps newcomers. The course opens with core functionality and feature sets, then moves to integrations, which let XSOAR work with your other tools. Playbook development follows, using a phishing workflow that most security teams will recognise.

After that, participants learn how events are classified and mapped into incidents, and how layouts present them to analysts. Automation development and debugging show what to do when something does not behave as expected.

The remaining modules cover solution architecture, Docker, the marketplace and content management, indicators and threat intelligence management, jobs and scheduling, role-based access controls and integration development. Teams with some scripting and JSON experience will move faster through these, although it is not mandatory. Starting with one well-understood procedure and automating it properly is a better beginning than trying to automate everything.

Course Objectives

• Describe the core features of Cortex XSOAR and where each fits in daily work.
• Connect other tools by enabling and configuring integrations.
• Convert a manual response procedure into a playbook of tasks.
• Follow the build of a complete phishing-response playbook.
• Classify events and map their data to incident fields.
• Create layouts that help analysts triage and investigate.
• Develop simple automations and debug them.
• Manage indicators, content, and scheduled jobs.
• Apply role-based access controls to users and roles.

Prerequisites

Participants must complete the Cortex XSOAR Analyst digital learning. Participants who have experience with scripting, the use of Python and JavaScript, and the use of JSON data objects will likely be able to apply what they learn more quickly than participants without such experience. However, completion of the course does not require proficiency in writing code.