PaloAlto - Ratio

Cortex XDR: Investigation and Analysis

The course is designed to enable cybersecurity professionals, particularly those in SOC/CERT/CSIRT and Security Analysts roles, to use XDR.
The course reviews XDR intricacies, from fundamental components to advanced strategies and techniques, including skills needed to navigate case management, platform automation, and orchestrate cybersecurity excellence

XDR is the industry’s most powerful extended detection and response platform. You will gain hands-on expertise in endpoint management, case management, forensic analysis and platform automation. Throughout this course, you will explore the key features of Cortex XDR.

This course will utilize the Simulated Lab Environment, which is embedded within The Learning Center (TLC).

Cortex XDR: Security Operations and Integration

This 3-day instructor-led course provides in-depth training on Cortex XDR, Palo Alto Networks’ powerful extended detection and response platform. You will gain hands-on expertise in security operations, incident investigation, and system optimization to effectively protect modern environments. Throughout this course you will explore the key features of Cortex XDR.

The course is designed to enable cybersecurity professionals, particularly those in SOC/CERT/CSIRT and engineering roles, to use XDR.
The course reviews XDR intricacies, from fundamental components to advanced strategies and techniques, including skills needed to configure security integrations, develop workflows, manage indicators, and optimize dashboards for enhanced security operations.

This is an update and replacement for the previous EDU-260 course, specifically intended for the individuals who are responsible for configuring Cortex XDR and managing integrations, data ingestion, and security policies as opposed to the analysts who investigate cases and issues.
A retirement date for the EDU-260 and EDU-262 will be announced once the replacement course for EDU-262 is released (date TBA). For now the EDU-260 and EDU-262 will remain available, in addition to this new course offering

Cortex XSIAM for Investigation and Analysis

XSIAM is the industry’s most comprehensive security incident and asset management platform, offering extensive coverage for securing and managing infrastructure, workloads, and applications across multiple environments. Throughout this course, you will explore the key features of Cortex XSIAM. This course is designed to enable you to:

– Investigate incidents, analyze key assets and artifacts, and interpret the causality chain.
– Query and analyze logs using XQL to extract meaningful insights.
– Utilize advanced tools and resources for comprehensive incident analysis.
The course is designed to enable cybersecurity professionals, particularly those in SOC/CERT/CSIRT and Security Analysts roles, to use XSIAM.
The course reviews XSIAM intricacies, from fundamental components to advanced strategies and techniques, including skills needed to navigate case management, automation, and orchestrate cybersecurity excellence.

With this release, Palo Alto are now replacing Cortex XSIAM for Security Operations and Automation (EDU-270) with the following two courses:

– Cortex XSIAM for Investigation and Analysis (2- day course for XSIAM analysts)
– Cortex XSIAM: Security Operations, Integration, and Automation (3-day course for XSIAM engineers)
Students may wish to take only one or both courses as applicable to their role

Cortex XSIAM: Security Operations, Integration and Automation

XSIAM is the industry’s most comprehensive security incident and asset management platform, offering extensive coverage for securing and managing infrastructure, workloads, and applications across multiple environments.
Throughout this course, you will explore the key features of Cortex XSIAM.
This course is designed to enable you to:

– Describe how endpoint agents, XDR collectors, NGFWs, and Broker VMs secure networks and devices.
– Query and analyze logs using XQL for data ingestion and detection.
– Configure Threat Intel Management features, automate workflows, and apply EDLs and indicator rules.
With this release, Palo Alto are now replacing Cortex XSIAM for Security Operations and Automation (EDU-270) with the following two courses:

– Cortex XSIAM for Investigation and Analysis (2- day course for XSIAM analysts)
– Cortex XSIAM: Security Operations, Integration, and Automation (3-day course for XSIAM engineers)

Students may wish to take only one or both courses as applicable to their role

Cortex XSOAR: Engineering Security Automation Solutions

The Palo Alto Networks Cortex XSOAR: Engineering Security Automation Solutions course is a four-day instructor-led training with a blend of lectures and hands-on labs. This training will enable students to use Cortex XSOAR to:

– Conduct incident investigation and response activities on a phishing campaign
– Create custom dashboards and generate reports
– Install multiple engines and configure a load balancing group
– Use built-in and external integrations to ingest incidents and automate security processes
– Plan and implement an automation use case by building playbooks and automation scripts
This is an update and replacement for the previous (EDU-380) Cortex XSOAR: Automation and Orchestration. Private EDU-380 classes (based on Cortex XSOAR 6.8) are available upon request.

Firewall Essentials: Configuration and Management

The Palo Alto Networks Firewall Essentials: Configuration and Management (EDU-210) course is five days of instructor-led training that will help you to:

– Configure and manage the essential features of Palo Alto Networks next-generation firewalls
– Configure and manage Security and NAT policies to enable approved traffic to and from zones
– Configure and manage Threat Prevention strategies to block traffic from known and unknown IP addresses, domains, and URLs
– Monitor network traffic using the interactive web interface and firewall reports
Exclusive to Fast Lane / ITLS:

Additional Palo Alto Labs and extended lab hours after the course

– Palo Alto Networks Firewalls for High Availability Solutions
– Global Protect Remote Access VPN Lab
– Site-to-Site VPN Lab
– Destination NAT Lab
– Captive Portal & User-ID Lab
– Optional Lab for Expedition Tool (BPA)

Duration: 5 days

Firewall: Troubleshooting

The Palo Alto Networks Firewall 11.0 Troubleshooting course is three days of instructor-led training that will help you:

– Use firewall tools, including the CLI, to investigate networking issues
– Follow proven troubleshooting methodologies that are specific to individual features
– Analyze advanced logs to resolve various real-life scenarios
– Solve advanced, scenario-based challenges
Exclusive to Fast Lane / iTLS:

Additional Palo Alto Labs and extended lab hours after the course

– Site-to-Site VPN Troubleshooting Lab
– Transit Traffic Troubleshooting Labs

Duration: 3 days

Panorama: Centralized Network Security Administration

The Palo Alto Networks Panorama: Centralized Network Security Administration course is two days of instructor-led training that should help you to:

– Learn how to configure and manage the next-generation Panorama management server
– Gain experience configuring templates (including template variables) and device groups
– Activate, configure, and manage Prisma Access using Panorama
The Panorama: Centralized Network Security Administration 2-day course is 1 day of basic Panorama content up to the creation of device groups, and templates + 1 day of Panorama-managed Prisma Access (from EDU-318), including activating and configuring Prisma Access, setting up service connections, and securing remote networks with templates and device groups

Panorama: NGFW Management

The Palo Alto Networks Panorama: NGFW Management course is two days of instructor-led training that should help you to:

– Learn how to configure and manage the next-generation Panorama management server
– Gain experience configuring templates (including template variables) and device groups
– Gain experience with administration, log collection, and logging and reporting
– Become familiar with planning and design considerations for Panorama deployment
The Panorama NGFW Management course is an update of the former EDU-220 Course.

Exclusive to Fast Lane / iTLS:

Extended lab hours after the course

Prisma Access Browser

The Prisma Access Browser course introduces you to the operational deployment of Prisma Access Browser and how it helps organizations meet the needs of the modern workforce by providing cloud-based network connectivity and security services.
This course will enable you to deploy, configure, maintain, and troubleshoot Prisma Access Browser using Strata Cloud Manager. The course is intended for professionals in cybersecurity and public-cloud security, as well as general network-security professionals who want to learn how to secure the last mile through a secure enterprise browser.

Prisma Access SSE: Configuration and Deployment

The Prisma Access SSE: Configuration and Deployment course introduces you to the operational deployment of Prisma Access Secure Access Service Edge (SASE) and how it helps organizations embrace the needs of the modern workforce by providing network connectivity and network security services from the cloud.
This course will enable you to deploy, configure, maintain, and troubleshoot Prisma Access using Strata Cloud Manager. The course is intended for professionals in cybersecurity and public-cloud security, as well as general network-security professionals who want to learn how to secure remote networks and mobile users.

The Prisma Access SSE: Configuration and Deployment course follows a similar architecture to the (EDU-318) Prisma Access SASE Security: Design and Operation course, but focuses on deployment and configuration through Strata Cloud Manager rather than Panorama. Additionally, this course includes modules covering Explicit Proxy, Prisma Access Browser (lecture-only module), and ADEM (with hands-on lab).

Prisma SD-WAN: Design and Operation

The Prisma SD-WAN Design and Operation course introduces you to Palo Alto Networks next-generation Prisma SD-WAN solution, the capability and value it provides over legacy WAN and SD-WAN implementations, and how to configure, operate, and troubleshoot the solution.

The Prisma SD-WAN: Design and Operation is an update of the former EDU-238 course.