Included
Video Recordings
Video recordings are included as a standard student benefit, so you can revisit demos and complex topics after the class.
Palo Alto NetworksCortex XDRXDR-A
Cortex XDR: Investigation and Analysis
Investigate incidents with Cortex XDR: alert analysis, causality chains, response actions, and hunting across endpoint and network telemetry.
- Duration
- 2 Days
- Delivery
- Live instructor-led
- Format
- Online or classroom
- Learner rating
- 4.67/5525 Course reviews
What you will be ready to do
Get hands-on with the official Palo Alto Networks curriculum.
- Work through guided, hands-on labs on your own dedicated instance.
- Apply configuration best practices from real projects.
- Understand how the platform components work together.
- Troubleshoot common issues with a structured approach.
Who it’s for
Is XDR-A the right course?
Designed for
SOC analysts who investigate and respond to incidents surfaced by Cortex XDR.
Prerequisites
Ask for course advice Basic networking knowledge is recommended. No prior Palo Alto Networks experience is required unless stated for advanced courses.
Included
Lab access
You work in your own dedicated lab during the training week. FireWall courses include 3-month extended lab access after the class.
Course authority
Official curriculum
Official Palo Alto Networks curriculum
Course content
Verify the curriculum before you choose a class.
Learn by doing in a dedicated lab. Every module pairs theory with lab time, so you practise each step the way you would on the job. The pace suits engineers who are new to the platform as well as administrators who want to close gaps and adopt best practices across their deployment.
Best Practices & real Life Experience
Your instructor brings years of real-world Palo Alto Networks project experience into the classroom and shares field-proven best practices throughout the course.
Certification
This course supports the matching Palo Alto Networks certification path. Ask our training team which exam and preparation route fits your goals.
Scope
The course follows the official Palo Alto Networks curriculum for the version listed in the schedule.
FAQ
Questions about formats, time zones, payment options, or team training? Contact the training team at training@consigas.com.
Genuine learner feedback
Students Love Our Instructors
Based on 525 course reviews
Featured learner reviews Reviews collected via Reviews.io ↗
View the complete Consigas profile on Reviews.io (opens in a new tab).
Artur Grygoruk at NTT Data
Verified via Reviews.io
Very important content, which discussed how to use Query Builder to filter logs and alerts. It was mainly focus on lab exercises. I enjoyed especially the part about blocking specific files and investigation process related mapping specific alerts to incident. Kenan explained this part very well and I will review for sure uploaded videos from EDU-262 training in order to get prepared to PCDRA exam soon in center.
Anonymous
Verified via Reviews.io
Marcin was very knowledgable and presented the information with great efficiency. We was always open to questions, and was willing to re-explain things as necessary. Overall it was a great course.
Anonymous
Verified via Reviews.io
I have taken EDU-260 AND EDU -262 will Alin Budisan. He is a fantastic trainer and really cares about his students. He explains the material well and provides additional information, not in the training document. He also gives real-world examples from other known breaches and his real-world experiences.
I highly recommend him for all training
Francis Waldron at Californian Department of Veterans Affairs
Verified via Reviews.io
The “Cortex XDR: Investigation and Analysis” training course was very informative and well organized. I enjoyed the class and thought it provided a good overview of how to investigate alerts, review case details, analyze artifacts, follow timelines, and understand endpoint activity within Cortex XDR. The hands-on assessment helped reinforce the material and made the investigation workflow easier to understand. Overall, it was a very good course and a valuable learning experience.
Dejan Nedeljkovic at Medigroup
Verified via Reviews.io
This course provided a much more in-depth view of forensics and gave me new insight into how SOC teams actually perform investigations in real-world scenarios. The training clarified how automation is used during investigations and made the overall investigation and scanning process easier to understand and follow. The hands-on approach helped connect theory with practical SOC workflows, making the investigation and analysis capabilities of Cortex XDR much clearer and more effective.
Michael Kujawa at Yakima Valley Farm Workers Clinic (YVFWC)
Verified via Reviews.io
It would be great if the section detailing XQL was expanded upon further, but the rest of the course was fine.
Page 1 of 2
Course agenda
Explore the complete Cortex XDR: Investigation and Analysis agenda.
The “Cortex XDR: Investigation and Analysis” course covers the following content.
Select a module to see its topics and lab activities.
Course Introduction
- Welcome and introductions
- Intended audience and course focus
- Course objectives and modules
- Learning Center tasks
Cortex XDR Incidents
- INTELLIGENTLY GROUPING AND DISPATCHING ALERTS TO THE INCIDENTS
- Cortex XDR Incidents
- Working with Incidents
- Advanced View Tabs
- Incident Scoring Rules
- Lab: Working with Enhanced Endpoint Data
- Analyze Alerts Stitched with Enhanced Endpoint Data
- Manage Enhanced Endpoint Data Monitoring from Endpoints
Causality and Analytics Concepts
- DETECTING ATTACKS using normal and abnormal behaviors
- Causality Analysis Engine: Log Stitching
- Causality Analysis Engine: Causality Chains
- Analytics Engine
- Lab: Working with Incidents
- Work with the Advanced Incident View
- Score Your Incidents
- Investigate Files Using Hash View
Causality Analysis of Alerts
- CAUSALITY AND TIMELINE ANALYSIS OF ALERTS AND SUSPICIOUS ACTIVITIES
- Causality View
- Causality Instance Graph
- Timeline View
- Lab: Causality Analysis of Alerts
- Analyze Alerts in Causality View
Advanced Response Actions
- ADVANCED RESPONSE ACTIONS IN CORTEX XDR PRO
- Remediation Suggestions
- Remote Script Executions
- Enabling Cortex XDR EDL Service
- Lab: Advanced Response Actions
- Execute Scripts on Endpoints
Building Search Queries
- Investigating leads using Cortex XDR tools
- Building Simple Queries
- Managing Queries
- Lab: Building Search Queries
- Build and Manage Search Queries
Building XDR Rules
- Using user-defined indicators of compromises
- IOC Rules
- BIOC Rules
- Custom Prevention Rules
- IOC/BIOC Suppression Rules
- Correlation Rules
- Lab: Working with Cortex XDR Rules
- Managing IOC Rules
- Managing BIOC Rules
- Custom Prevention Rules
Cortex XDR Assets
- DISCOVERY, INVENTORY, AND MANAGEMENT OF NETWORK ASSETS
- Asset Inventory
- Network Configuration
- Vulnerability Assessment
- Lab: Working with Network Assets
- Activate and Register a Broker VM
- Scan IP Ranges with Network Mapper
- Investigate IP Addresses Using IP View
Introduction to XQL
- XDR Query Language (XQL)
- XQL Search Basics
- XQL Stages
- XQL Functions
- Result Set Visualization
- Lab: Getting Started with XQL Queries
- Get Started with XQL Search Page
- Create XQL Queries with Multiple Stages
- Visualize Query Results
External Data Collection
- COLLECTING EXTERNAL ALERTS AND LOGS
- External Data Collection
- Dataset Management
- External Alerts by Cortex XDR API
- Lab: Working with External Data
- Create and Manage Datasets
- Insert External Alerts Using XDR API
Your next step
Choose the XDR-A class that fits your schedule.
Compare dates and prices first. If you are still confirming timing, you can reserve this course for free or ask the training team for advice.