instructor-led training
(EDU-262) Cortex XDR: Investigation and Response
Level
Intermediate
Duration
2 Days
Format
Instructor-Led Training
Supported Platforms
Cortex XDR
(EDU-262) Cortex XDR - Investigation and Response helps you to:
- Learn how to activate a Cortex XDR instance
- Create agent-installation packages and Security policies and profiles to protect endpoints against multistage, fileless attacks built using malware and exploits.
Objectives
Successful completion of this instructor-led course with hands-on lab activities should enable participants to:
- Investigate and manage incidents
- Describe the Cortex XDR causality and analytics concepts
- Analyze alerts using the Causality and Timeline Views
- Work with Cortex XDR Pro actions such as remote script execution
- Create and manage on-demand and scheduled search queries in the Query Center
- Create and manage the Cortex XDR rules BIOC and IOC
- Working with Cortex XDR assets and inventories
- Write XQL queries to search datasets and visualize the result sets
- Work with Cortex XDR’s external-data collection
Target Audience
Cybersecurity analysts and engineers, and security operations specialists
Prerequisites
Participants must have taken the course EDU-260 (Cortex XDR: Prevention and Deployment).
Training credit information
Palo Alto Networks Training Credits allow you a single point of purchase for training for use throughout the year. Training credits are redeemable by all employees within an organization for any Palo Alto Networks open enrollment, private on-site, or online course offered by our Authorized Training Partners (ATPs).
Course Modules
- Cortex XDR Incidents
- Causality and Analytics Concepts
- Causality Analysis of Alerts
- Advanced Response Actions
- Building Search Queries
- Building XDR Rules
- Cortex XDR Assets
- Introduction to XQL
- External Data Collection
