Palo Alto Networks: Cortex XDR 3.2: Investigation & Response (EDU-262)

Successful completion of this instructor-led course with hands-on lab activities should enable you to:

• Investigate and manage incidents
• Describe the Cortex XDR causality and analytics concepts
• Analyze alerts using the Causality and Timeline Views
• Work with Cortex XDR Pro actions such as the remote script execution
• Create and manage on-demand and scheduled search queries in the Query Center
• Create and manage the Cortex XDR rules BIOC and IOC
• Investigate artifacts using the specialized views IP View and Hash View
• Write XQL queries to search datasets and visualize the result sets
• Work with Cortex XDR’s external data collection

This class is comprised of the following modules:

• Module 1 – Cortex XDR Incidents
• Module 2 – Causality and Analytics Concepts
• Module 3 – Causality Analysis of Alerts
• Module 4 – Advanced Response Actions
• Module 5 – Building Search Queries
• Module 6 – Building XDR Rules
• Module 7 – Building XDR Rules
• Module 8 – – Introduction to XQL
• Module 9 – External Data Collection

Participants must complete EDU-260 (Cortex XDR: Prevention and Deployment).

Cybersecurity analysts and engineers and security operations specialists, as well as administrators and product deployers.