PSE Cortex study guide
PSE Cortex · Work through your exam, one topic at a time.
PSE Cortex is a specialist-level credential in the Palo Alto Networks certification program, aimed at professionals who deploy, operate, and manage the Cortex security operations portfolio. It sits alongside the vendor's other specialist exams - XSIAM Analyst, XDR Analyst, XSIAM Engineer, XDR Engineer, and XSOAR Engineer - but is broader in scope, spanning the full set of Cortex platforms rather than a single product. Candidates typically come from SOC analyst, security engineering, and automation roles where Cortex tooling is used daily. Because the Cortex portfolio is organized into five product areas - Cortex XSIAM for AI-driven SOC operations, Cortex XDR for extended detection and response, Cortex XSOAR for orchestration and automation, Cortex Xpanse for attack surface management, and Cortex Cloud for cloud security from code to cloud - exam preparation should be structured around those areas. The PSE Cortex study guide has 5 sections and about 1,540 words.
01Cortex XSIAM
Cortex XSIAM is Palo Alto Networks' AI-driven security operations platform that consolidates SIEM, SOAR, ASM, UEBA, and XDR into a single console. The exam tests the data pipeline, the detection layers, and how detections become incidents - not marketing names.
308 words, about 2 min02Cortex XDR
Cortex XDR is the endpoint-centric detection and response platform. The exam tests the agent's protection modules, the alert-to-incident path, and the rule types used for detection.
312 words, about 2 min03Cortex XSOAR
Cortex XSOAR is the security orchestration, automation, and response platform, with threat intelligence management built in. The exam tests incident ingestion, playbook mechanics, and how data moves through context.
286 words, about 1 min04Cortex Xpanse
Cortex Xpanse is attack surface management (ASM). It discovers internet-facing assets from the outside in, attributes them to your organization, and flags exposures.
314 words, about 2 min05Cortex Cloud
Cortex Cloud is Palo Alto Networks' cloud-native application protection platform (CNAPP). It combines cloud posture, runtime protection, application security, and data and identity security.
320 words, about 2 min