Cortex XSIAM: Security Operations, Integration and Automation (XSIAM-SOIA) Training

This course trains security engineers to operate Cortex XSIAM, focusing on integrations, automation, threat intelligence, and XQL-based analysis.

Course Overview

The Cortex XSIAM: Security Operations, Integration, and Automation course is a three-day, instructor-led training that provides in-depth coverage of Cortex XSIAM, Palo Alto Networks’ comprehensive security incident and asset management platform. The course focuses on securing and managing infrastructure, workloads, and applications across hybrid and multi-cloud environments.

Throughout the course, participants will explore the core architecture and key capabilities of Cortex XSIAM, including how endpoint agents, XDR collectors, next-generation firewalls, and Broker VMs work together to secure networks and devices. Learners will gain hands-on experience querying and analyzing data using XQL, configuring Threat Intelligence Management, applying EDLs and indicator rules, and automating security workflows to improve operational efficiency.

This course is designed for security engineers and operations professionals responsible for configuring, integrating, and automating Cortex XSIAM environments.

Course Update Notice:
Palo Alto Networks has replaced the former Cortex XSIAM for Security Operations and Automation (EDU-270) with two role-based courses:

• Cortex XSIAM for Investigation and Analysis – a two-day course designed for XSIAM analysts

• Cortex XSIAM: Security Operations, Integration, and Automation – a three-day course designed for XSIAM engineers

Students may choose to attend one or both courses based on their job role and responsibilities.