Courses Overview
The Palo Alto Networks: Cortex™ XSOAR: Automation and Orchestration (EDU-380) course is a four-day, instructor-led training that provides the knowledge and hands-on skills needed to automate workflows, streamline case management, and orchestrate resources using Cortex XSOAR.
This course introduces participants to Cortex XSOAR system features, including integrations, playbooks, and incident-page layouts. You will learn how to optimize analyst workflows, automate repetitive tasks, and build processes that enhance security operations efficiency.
- Configure integrations, create tasks, and design playbooks
- Build incident layouts that allow analysts to quickly triage and investigate incidents
- Categorize event data and map it to custom display fields
- Develop automations, manage content and indicator data, and organize artifact stores
- Schedule jobs, define user roles, and manage collaborative case workflows
- Gain practical insight into building complete playbooks for real-world use cases, such as phishing investigations
This course is recommended for learners who have already completed the Cortex XSOAR Analyst digital learning. While experience with scripting (Python, JavaScript) and JSON data handling is an advantage, coding proficiency is not required to succeed in this course.
- Security Operations (SecOps) Engineers
- SOAR Engineers
- Managed Security Service Providers (MSSPs)
- Service Delivery Partners
- System Integrators
- Professional Services Engineers
This training prepares SOC, CERT, CSIRT, and SOAR engineers to work with Cortex XSOAR features such as integrations, playbooks, incident layouts, and automations. The third module of the course provides a complete demonstration of developing a playbook to automate phishing incident response — offering a practical, end-to-end framework that supports deeper exploration of key topics in later modules.
- Module 1: Core Functionality and Feature Sets
- Module 2: Enabling and Configuring Integrations
- Module 3: Playbook Development
- Module 4: Classification and Mapping
- Module 5: Layout Builder
- Module 6: Solution Architecture
- Module 7: Docker
- Module 8: Automation Development and Debugging
- Module 9: The Marketplace and Content Management
- Module 10: Indicators and Threat Intelligence Management
- Module 11: Jobs and Job Scheduling
- Module 12: Users and Role-Based Access Controls (RBAC)
- Module 13: Integration Development
- Cortex XSOAR Analyst digital learning