Cortex XDR : Security Operations and Integration

Training Content

DAY 1
9.00am – 10.30am
0. Course Overview
1. Overview of Cortex XDR

• Overview of the Cortex XDR security platform
• Cortex solution architecture components
• Cortex XDR Agents
• XDR Collectors
• Broker VM
• Third-party data ingestion
• Lab Activities: XDR Management Console walkthrough and Next-Generation Firewall onboarding to Cortex XDR

10.30am – 10.45am – Short Break

10.45am – 12.30pm
2. Software Components

• Exploring the Cortex XDR Management Console
• Roles and functions of the Customer Support Portal
• Overview of the Cortex Gateway
• Capabilities and features of the XDR Agent
• Capabilities and functions of the XDR Collector
• Lab Activities: Installing the Linux/Kubernetes Agent, Configuring XDR Agent Groups and Endpoint Policy and Installing the Windows XDR Agent and Collecto

12.30pm – 1.30pm – Lunch

1.30pm – 3.00pm
3. Integrations

• Integrating Cortex XDR with other security tools and data sources
• API Ingestion integration
• Next-Generation Firewall (NGFW) integration
• Broker VM integration and functionality

3.00pm – 3.15pm – Short Break

3.15pm – 5.00pm

• Cloud Identity Engine integration
• Data ingestion and connectivity workflows
• Lab Activities: Onboarding Broker VM and Configuring External Dynamic Lists

DAY 2
9.00am – 10.30am
4. XQL

• Introduction to advanced Cortex XDR concepts
• Overview of Cortex XQL
• Using XQL to analyze data
• Building queries to uncover insights
• Applying XQL for investigation and threat hunting
• Lab Activities: XQL Syntax Review and Winning Gold with XQL

10.30am – 10.45am – Short Break

10.45am – 12.30pm
5. Detection Engineering

• Create and optimize detection rules (IOC/BIOC/Correlation rules)
• Lab Activities: OOTB IOC and BIOC Walkthrough, Reviewing Correlation Rules, and Creating Custom IOCs

12.30pm – 1.30pm – Lunch

1.30pm – 3.00pm
6. Platform Automation

• automation capabilities built into XDR (playbooks, scripts and triggers)
• Using the Marketplace

3.00pm – 3.15pm – Short Break

3.15pm – 5.00pm

• Lab Activities: Configuring Automation Integrations and Create a Playbook and Rule

DAY 3
9.00am – 10.30am
7. System Optimization

• Streamlining Cortex XDR operational processes
• Best practices for maintaining and optimizing the XDR environment
• Using Cytool for agent management

10.30am – 10.45am – Short Break

10.45am – 12.30pm

• Retrieving and analyzing Support Files
• Creating issue exclusions in Cortex XDR
• Managing exceptions and policy exclusions

12.30pm – 1.30pm – Lunch

1.30pm – 3.00pm
8. Dashboards and Reports

• Dashboards and Reports
• Lab Activities: Creating Dashboards, Reports and Widgets

3.00pm – 3.15pm – Short Break

3.15pm – 5.00pm
9. Email Security

• Features of the Advanced Email Security