Palo Alto ATC Logo

Palo Alto Networks EDU 380

Cortex™ XSOAR 6.2: Automation and Orchestration

Palo Alto ATC Logo

Please note: In the online format, the course also lasts four days from 9:00-17:00 (Irish Time) each day.

This training is designed to enable a SOC, CERT, CSIRT, or SOAR engineer to start working with Cortex XSOAR integrations, playbooks, incident-page layouts, and other system features to facilitate resource orchestration, process automation, case management, and analyst workflow.

The third module of the course demonstrates a complete playbook-development process for automating a typical analyst workflow to address phishing incidents. This end-to-end view of the development process provides a framework for more focused discussions of individual topics that are covered in subsequent modules.

Course Contents

  • Core Functionality and Feature Sets
  • Enabling and Configuring Integrations
  • Playbook Development
  • Classification and Mapping
  • Layout Builder
  • Solution Architecture
  • Docker
  • Automation Development and Debugging
  • The Marketplace and Content Management
  • Indicators and Threat Intelligence Management
  • Jobs and Job Scheduling
  • Users and Role-Based Access Controls (RBAC)
  • Integration Development

E-Book Symbol You will receive the original course documentation by Palo Alto in English language as an e-book.

Target Group

Security-operations (SecOps), or security, orchestration, automation, and response (SOAR) engineers, managed security service providers (MSSPs), service delivery partners, system integrators, and professional services engineers

Knowledge Prerequisites

Participants must complete the Cortex XSOAR Analyst digital learning. Participants who have experience with scripting, the use of Python and JavaScript, and the use of JSON data objects will likely be able to apply what they learn more quickly than participants without such experience. However, completion of the course does not require proficiency in writing code.

Classroom training

Do you prefer the classic training method? A course in one of our Training Centers, with a competent trainer and the direct exchange between all course participants? Then you should book one of our classroom training dates!

Online training

You wish to attend a course in online mode? We offer you online course dates for this course topic. To attend these seminars, you need to have a PC with Internet access (minimum data rate 1Mbps), a headset when working via VoIP and optionally a camera. For further information and technical recommendations, please refer to.

Tailor-made courses

You need a special course for your team? In addition to our standard offer, we will also support you in creating your customized courses, which precisely meet your individual demands. We will be glad to consult you and create an individual offer for you.
Request for customized courses
PDF SymbolYou can find the complete description of this course with dates and prices ready for download at as PDF.

Please note: In the online format, the course also lasts four days from 9:00-17:00 (Irish Time) each day.

This training is designed to enable a SOC, CERT, CSIRT, or SOAR engineer to start working with Cortex XSOAR integrations, playbooks, incident-page layouts, and other system features to facilitate resource orchestration, process automation, case management, and analyst workflow.

The third module of the course demonstrates a complete playbook-development process for automating a typical analyst workflow to address phishing incidents. This end-to-end view of the development process provides a framework for more focused discussions of individual topics that are covered in subsequent modules.

Course Contents

  • Core Functionality and Feature Sets
  • Enabling and Configuring Integrations
  • Playbook Development
  • Classification and Mapping
  • Layout Builder
  • Solution Architecture
  • Docker
  • Automation Development and Debugging
  • The Marketplace and Content Management
  • Indicators and Threat Intelligence Management
  • Jobs and Job Scheduling
  • Users and Role-Based Access Controls (RBAC)
  • Integration Development

E-Book Symbol You will receive the original course documentation by Palo Alto in English language as an e-book.

Target Group

Security-operations (SecOps), or security, orchestration, automation, and response (SOAR) engineers, managed security service providers (MSSPs), service delivery partners, system integrators, and professional services engineers

Knowledge Prerequisites

Participants must complete the Cortex XSOAR Analyst digital learning. Participants who have experience with scripting, the use of Python and JavaScript, and the use of JSON data objects will likely be able to apply what they learn more quickly than participants without such experience. However, completion of the course does not require proficiency in writing code.

Classroom training

Do you prefer the classic training method? A course in one of our Training Centers, with a competent trainer and the direct exchange between all course participants? Then you should book one of our classroom training dates!

Online training

You wish to attend a course in online mode? We offer you online course dates for this course topic. To attend these seminars, you need to have a PC with Internet access (minimum data rate 1Mbps), a headset when working via VoIP and optionally a camera. For further information and technical recommendations, please refer to.

Tailor-made courses

You need a special course for your team? In addition to our standard offer, we will also support you in creating your customized courses, which precisely meet your individual demands. We will be glad to consult you and create an individual offer for you.
Request for customized courses

PDF SymbolYou can find the complete description of this course with dates and prices ready for download at as PDF.