Course Overview
This training is designed to enable a SOC, CERT, CSIRT, or SOAR engineer to start working with Cortex XSOAR integrations, playbooks, incident-page layouts, and other system features to facilitate resource orchestration, process automation, case management, and analyst workflow.
The course includes coverage of a complete playbook-development process for automating a typical analyst workflow to address phishing incidents. This end-to-end view of the development process provides a framework for more focused discussions of individual topics that are covered in the course.
Course Objectives
- Configure integrations, create tasks, and develop playbooks
- Build incident layouts that enable analysts to triage and investigate incidents efficiently
- Identify how to categorize event information and map that information to display fields
- Develop automations, manage content, indicator data, and artifact stores, schedule jobs, organize users and user roles, oversee case management, and foster collaboration
Who Should Attend?
Security-operations (SecOps), or security, orchestration, automation, and response (SOAR) engineers, managed security service providers (MSSPs), service delivery partners, system integrators, and professional services engineers.
- Top-rated instructors: Our crew of subject matter experts have an average instructor rating of 4.8 out of 5 across thousands of reviews.
- Authorized content: We maintain more than 35 Authorized Training Partnerships with the top players in tech, ensuring your course materials contain the most relevant and up-to date information.
- Interactive classroom participation: Our virtual training includes live lectures, demonstrations and virtual labs that allow you to participate in discussions with your instructor and fellow classmates to get real-time feedback.
- Post Class Resources: Review your class content, catch up on any material you may have missed or perfect your new skills with access to resources after your course is complete.
- Private Group Training: Let our world-class instructors deliver exclusive training courses just for your employees. Our private group training is designed to promote your team’s shared growth and skill development.
- Tailored Training Solutions: Our subject matter experts can customize the class to specifically address the unique goals of your team.
Agenda
Outline
- 1 - Core Functionality and Feature Sets
- 2 - Enabling and Configuring Integrations
- 3 - Playbook Development
- 4 - Classification and Mapping
- 5 - Layout Builder
- 6 - Solution Architecture
- 7 - Docker
- 8 - Automation Development and Debugging
- 9 - The Marketplace and Content Management
- 10 - Indicators and Threat Intelligence Management
- 11 - Jobs and Job Scheduling
- 12 - Users and Role-Based Access Controls (RBAC)
- 13 - Integration Development