Palo Alto Networks: Cortex XSOAR 6.8: Automation and Orchestration (EDU-380)

When an incident closes, someone will eventually ask what happened. Which alert started it? What indicators were found? Who did what, and when? Cortex XSOAR is designed to hold those answers in one case, and Palo Alto Networks Cortex XSOAR training shows how to set that up properly.

EDU-380 is a four-day, instructor-led course based on Cortex XSOAR 6.8. It focuses on case management, process automation, orchestration, and analyst workflow for SOC, CERT, CSIRT, and SOAR engineers.

Visibility starts with data. The course covers enabling integrations, then classification and mapping, which determine how an incoming event becomes an incident and which details are displayed. The layout builder then lets you design the page analysts use, so the evidence they need is on screen when a case opens.

Playbooks supply the process. Participants see a complete phishing-response workflow built step by step, so each decision and action is recorded in the case. Indicators and threat intelligence management add context, and role-based access controls decide who can see and change what.

The outline also includes solution architecture, Docker, automation development and debugging, the marketplace and content management, jobs and scheduling, and integration development. Palo Alto Networks requires the Cortex XSOAR Analyst digital learning beforehand and states that proficiency in writing code is not required. Teams that record work in one place find reviews, handovers, and post-incident questions much easier to answer.

Course Objectives

• Explain how Cortex XSOAR supports case management and analyst workflow.
• Enable integrations that bring events and context into the platform.
• Classify events and map their fields to the data analysts need.
• Construct incident layouts that put key evidence first.
• Develop playbooks that record each automated and manual step.
• Manage indicators and threat intelligence data.
• Schedule jobs and manage content from the marketplace.
• Control user access with role-based access controls.
• Develop and debug automations that support the workflow.

Prerequisites

Participants must complete the Cortex XSOAR Analyst digital learning. Participants who have experience with scripting, the use of Python and JavaScript, and the use of JSON data objects will likely be able to apply what they learn more quickly than participants without such experience. However, completion of the course does not require proficiency in writing code.