Palo Alto Networks Cortex XDR: Investigation and Analysis

About this course

Sharpen your investigation skills in Cortex XDR. You will manage incidents, apply causality and analytics concepts, and trace alerts through the Causality and Timeline views. Response actions such as remote script execution, on-demand and scheduled searches in the Query Center, and custom BIOC and IOC rules round out the two days.

What you'll learn

• Investigate and manage incidents
• Describe the Cortex XDR causality and analytics concepts
• Analyze alerts using the Causality and Timeline Views
• Work with Cortex XDR Proactions such as remote script execution
• Create and manage on-demand and scheduled search queries in the Query Center
• Create and manage the Cortex XDR rules BIOC and IOC
• Working with Cortex XDR assets and inventories
• Write XQL queries to search datasets and visualize the result sets
• Work with Cortex XDR’s external-data collection

Curriculum

Who it's for

Security analysts and incident responders who have completed Cortex XDR prevention and deployment training.

Before you start

• Participants must have taken the course EDU-260 (Cortex XDR: Prevention and Deployment).