Learning Objectives

Successful completion of this instructor-led course with hands-on lab activities should enable participants to:

• Investigate and manage incidents
• Describe the Cortex XDR causality and analytics concepts
• Analyze alerts using the Causality and Timeline Views
• Work with Cortex XDR Pro actions such as remote script execution
• Create and manage on-demand and scheduled search queries in the Query Center
• Create and manage the Cortex XDR rules BIOC and IOC
• Working with Cortex XDR assets and inventories
• Write XQL queries to search datasets and visualize the result sets
• Work with Cortex XDR’s external-data collection

Scope

• Course level: Advanced
• Course duration: 2 days
• Course format: Lecture and hands-on labs
• Platform support: Cortex XDR Pro per Endpoint

Who Should Attend?

• Cybersecurity analysts and engineers
• Security operations specialists

Prerequisites & Exams

Recommended Prerequisites:

• Participants must have completed EDU-260 (Cortex XDR: Prevention and Deployment).

Course Outline

• Module 1: Cortex XDR Incidents
• Module 2: Causality and Analytics Concepts
• Module 3: Causality Analysis of Alerts
• Module 4: Advanced Response Actions
• Module 5: Building Search Queries
• Module 6: Building XDR Rules
• Module 7: Cortex XDR Assets
• Module 8: Introduction to XQL
• Module 9: External Data Collection