Learning Objectives

Successful completion of this instructor-led course with hands-on lab activities should enable you to:

• Describe the architecture and components of the Cortex XDR family
• Use the Cortex XDR management console, including reporting
• Create Cortex XDR agent installation packages, endpoint groups, and policies
• Deploy Cortex XDR agents on endpoints
• Create and manage Exploit and Malware Prevention profiles
• Investigate alerts and prioritize them using starring and exclusion policies
• Tune Security profiles using Cortex XDR exceptions
• Perform and track response actions in the Action Center
• Perform basic troubleshooting related to Cortex XDR agents
• Deploy a Broker VM and activate the Local Agents Settings applet
• Understand Cortex XDR deployment concepts and activation requirements
• Work with the Customer Support Portal and Cortex XDR Gateway for authentication and authorization

Scope

• Course level: Intermediate
• Course duration: 3 days
• Course format: Lecture and hands-on labs
• Platform support: Cortex XDR Pro per Endpoint

Who Should Attend?

• Cybersecurity analysts
• Engineers
• Security operations specialists
• Administrators
• Product deployers

Prerequisites & Exams

Recommended Prerequisites:

• Participants must be familiar with enterprise product deployment, networking, and security concepts.

Course Outline

• Module 1: Cortex XDR Overview
• Module 2: Cortex XDR Main Components
• Module 3: Cortex XDR Management Console
• Module 4: Profiles and Policy Rules
• Module 5: Malware Protection
• Module 6: Exploit Protection
• Module 7: Cortex XDR Alerts
• Module 8: Tuning Policies Using Exceptions
• Module 9: Response Actions
• Module 10: Basic Agent Troubleshooting
• Module 11: Broker VM Overview
• Module 12: Deployment Considerations