Palo Alto Networks: Cortex XSOAR 6.8: Automation and Orchestration (EDU-380)

Large organisations rarely suffer from a shortage of alerts. They suffer from a shortage of analyst time. When a security operations centre handles thousands of events from many tools, the work that matters gets buried under work that could have run itself. EDU-380 is Palo Alto Networks Cortex XSOAR training aimed at fixing that imbalance with automation and orchestration.

The four-day, instructor-led course is based on Cortex XSOAR 6.8 and written for SOC, CERT, CSIRT, and SOAR engineers. It begins with the platform’s core features, then shows how to enable and configure integrations with other security tools. Hands-on labs let participants test each build rather than only watch it.

Volume is managed through classification and mapping, which sort incoming events into incidents and place the right data in the right fields. Layouts then give analysts a working view for triage and investigation. Playbooks handle the repeatable steps, and a complete phishing workflow is built as the course’s worked example.

Larger deployments raise their own questions, so the course also covers solution architecture, Docker, scheduled jobs, and role-based access controls. Indicators and threat intelligence management, the marketplace and content management, automation development and debugging, and integration development complete the outline.

Participants must first complete the Cortex XSOAR Analyst digital learning, and Palo Alto Networks notes that proficiency in writing code is not required. Teams that standardise their response steps this way spend less time on routine triage and more on the cases that need judgement.

Course Objectives

• Enable and configure integrations that feed events into Cortex XSOAR.
• Classify and map incoming events so incidents contain usable, correctly placed data.
• Create tasks and playbooks that automate routine analyst steps.
• Walk through an end-to-end phishing playbook and explain each stage.
• Build incident layouts that speed up triage and investigation.
• Write, test, and debug automations, including how Docker supports them.
• Manage indicators, threat intelligence, and marketplace content.
• Set up scheduled jobs and apply role-based access to users.
• Outline the solution architecture and the steps for developing an integration.

Prerequisites

Participants must complete the Cortex XSOAR Analyst digital learning. Participants who have experience with scripting, the use of Python and JavaScript, and the use of JSON data objects will likely be able to apply what they learn more quickly than participants without such experience. However, completion of the course does not require proficiency in writing code.