Palo Alto Networks: Cortex XSOAR 6.8: Automation and Orchestration (EDU-380)

Most of this course happens at the keyboard. Participants enable an integration, watch events arrive, shape them into incidents, and then write the playbook that handles them. EDU-380 is Palo Alto Networks Cortex XSOAR training built around that sequence of doing.

It runs four days, is instructor-led, and is based on Cortex XSOAR 6.8. After a first look at core functionality, you configure integrations so the platform can talk to other security tools. Next comes playbook development, where tasks are chained into a workflow. The course demonstrates a complete phishing-response playbook, so you see how the pieces fit before the detail begins.

Classification and mapping follow. They decide how an incoming event is recognised and which of its data lands in which incident field. The layout builder then arranges that data into the page an analyst works from. A good layout saves clicks on every single case.

Automations come next. You look at how they are developed and debugged, and at Docker, which the platform uses to run scripts and integrations. The course then widens to the marketplace and content management, indicators and threat intelligence management, jobs and scheduling, and role-based access controls. Integration development closes the outline, and solution architecture explains how the platform is put together.

Participants must complete the Cortex XSOAR Analyst digital learning first. Palo Alto Networks states that proficiency in writing code is not required, though scripting and JSON familiarity make the automation modules easier. Many teams find that small, tested playbooks win over large, untested ones.

Course Objectives

• Enable integrations and confirm that data reaches Cortex XSOAR.
• Configure classification and mapping to turn raw events into structured incidents.
• Create tasks and chain them into playbooks.
• Follow a complete phishing-response playbook and adapt its approach.
• Arrange incident layouts around what analysts need to see first.
• Develop automations and debug them when they misbehave.
• Explain the role of Docker in running automations and integrations.
• Manage content, indicators, and scheduled jobs.
• Assign users and roles using role-based access controls.

Prerequisites

Participants must complete the Cortex XSOAR Analyst digital learning. Participants who have experience with scripting, the use of Python and JavaScript, and the use of JSON data objects will likely be able to apply what they learn more quickly than participants without such experience. However, completion of the course does not require proficiency in writing code.