Important Update: Cortex XSIAM: Security Operations and Automation (EDU-270) Course Retirement

Effective May 30, 2025, the “Cortex XSIAM for Security Operations and Automation” (EDU-270) course has been retired.

To better reflect the evolving roles within the Security Operations Centre (SOC) and the latest capabilities of Cortex XSIAM, Palo Alto Networks has introduced an updated training programme, splitting the former EDU-270 content into two distinct, role-based courses:

 

New Courses

1. Cortex XSIAM: Security Operations, Integration, and Automation (3-day course, recommended for XSIAM Engineers)
   This course is the direct successor for engineers previously taking EDU-270. It focuses on configuring Cortex XSIAM, managing integrations, data ingestion, and automation workflows.
   If your role centres on implementing, integrating, and automating Cortex XSIAM, this is the course for you.
2. Cortex XSIAM: Investigation and Analysis (2-day course, recommended for XSIAM Analysts)
   Tailored for analysts, this course covers the use of Cortex XSIAM for investigating incidents and alerts.
   If your daily work involves incident response and threat analysis using Cortex XSIAM, you’ll find all the tools and techniques you need here.

Which course should I take?

• Engineers/Integrators: Choose Cortex XSIAM: Security Operations, Integration, and Automation
• Analysts/Investigators: Choose Cortex XSIAM: Investigation and Analysis
• Hybrid roles: Both courses can be taken for a comprehensive skillset

Why the change?
This split ensures deeper, role-based expertise and allows customers to focus on the skills most relevant to their job function. Think of it as less “one-size-fits-all” and more “tailor-made to fit you.”

 

For more details on these new courses and to find the best fit for your needs, please contact us.