Palo Alto Networks: Cortex XSOAR 6.8: Automation and Orchestration (EDU-380)

Providers and integrators face a particular problem. Several teams, or several customers, need the same response to the same threat, yet each tends to do it a little differently. Palo Alto Networks Cortex XSOAR training addresses that by teaching how to build response processes once, test them properly, and reuse them.

EDU-380 is a four-day, instructor-led course based on Cortex XSOAR 6.8. It is designed for SOC, CERT, CSIRT, and SOAR engineers, and Palo Alto Networks lists managed security service providers, service delivery partners, system integrators, and professional services engineers in its audience.

Reuse begins with solid foundations. The course covers core functionality, integrations and playbook development, using a complete phishing workflow as the example. Classification and mapping then standardise how events become incidents, and the layout builder gives every analyst the same working view.

Several modules suit environments where more than one team uses the platform. The marketplace and content management cover how content is obtained and controlled. Role-based access controls decide who may do what. Jobs and scheduling run tasks without a person starting them. Indicators and threat intelligence management keep shared context in one place.

Technical depth comes from solution architecture, Docker, automation development and debugging, and integration development. Participants must complete the Cortex XSOAR Analyst digital learning first. Palo Alto Networks states that proficiency in writing code is not required for the course. As service volumes grow, a team with standard playbooks and clear access rules can add work without adding confusion.

Course Objectives

• Configure integrations that link customer or business systems to Cortex XSOAR.
• Develop playbooks that apply the same response process every time.
• Standardise event handling through classification and mapping.
• Build layouts that give all analysts a consistent working view.
• Manage marketplace content and control how it is used.
• Organise users and roles with role-based access controls.
• Schedule jobs and manage indicators and threat intelligence data.
• Develop, test, and debug automations, including Docker use.
• Describe the solution architecture and integration development steps.

Prerequisites

Participants must complete the Cortex XSOAR Analyst digital learning. Participants who have experience with scripting, the use of Python and JavaScript, and the use of JSON data objects will likely be able to apply what they learn more quickly than participants without such experience. However, completion of the course does not require proficiency in writing code.