PSE Cortex study plan

Map the Cortex XSIAM architecture end to end: data sources, brokers, Cortex Data Lake ingestion, analytics engine, and automation layer, drawing your own labeled diagram from memory

Explain how XSIAM consolidates SIEM, SOAR, ASM, and endpoint telemetry into a single platform, and articulate the operational difference from stitching separate products together

Define the core detection surfaces (identity, endpoint, network, cloud, third-party logs) and list which native sensors or integrations feed each one

Practice navigating the XSIAM console areas for incidents, alerts, cases, threat intelligence, and detection rules until you can locate each without searching

Walk through the XSIAM incident lifecycle from ingestion and correlation through triage, investigation, response, and closure, and describe what triggers each transition

Compare XSIAM detection content types (analytics, correlation rules, IOC matching, behavioral analytics) and explain when each is the right tool

Draft a triage workflow for a brute-force-then-lateral-movement scenario, naming the specific artifacts and queries you would inspect at each step

Identify how XSIAM handles alert grouping into incidents and what tuning levers reduce noise without suppressing true positives

Diagram Cortex XDR's endpoint agent, local analysis, causality chain, and cloud analytics components, and explain what runs on the endpoint versus in the cloud

Explain the causality analysis model and how it links processes, files, network connections, and registry changes into a single investigation view

Configure and describe the main policy types (prevention, exploit, malware, restriction) and state what each profile blocks versus alerts on

Practice building an investigation from an alert using the causality view, and document the exact click path and filters you used

Use basic and advanced XQL syntax to query process, network, and file event tables, and write at least five working queries from memory

Explain alert severity, star/score ranking, and how BIOC and IOC rules differ in what they detect and how they are authored

Describe response actions available on an endpoint (isolate, terminate, quarantine, live terminal, file retrieval) and the risk and scope of each

Trace how XDR alerts and incidents can be forwarded or shared with XSIAM or a SIEM, and what the integration changes about analyst workflow

Map XSOAR's core objects (incidents, playbooks, integrations, commands, content packs, layouts, classifiers) and how they relate at runtime

Explain the difference between the built-in engine and the marketplace content model, and describe how to evaluate and install a content pack safely

Write a task-based playbook outline with inputs, outputs, conditional branches, and error handling for a phishing triage use case

Describe how incident fields, mappers, and classifiers shape incoming data into a usable incident, and why mapper errors cause downstream playbook failures

Write and debug a small Python automation script for XSOAR that uses the common execution context objects and handles errors and timeouts

Explain how integrations authenticate and how commands return results, including context output paths used by downstream tasks

Set up and explain the difference between a war room investigation and an automated playbook run, and when to hand off between them

Describe how XSOAR handles indicators, indicator types, and reputation scoring, and how that feeds playbook decisions

Explain Cortex Xpanse's attack surface discovery model: how it identifies unknown internet-facing assets and attributes them to an organization

Classify Xpanse findings by risk type (exposed services, weak certificates, misconfigurations, shadow IT) and describe the remediation path for each

Describe how Xpanse findings flow into XSIAM or XSOAR for automated response, and what enrichment is needed before action

Explain Cortex Cloud's core value proposition for cloud security posture and workload protection, including how it relates to the other Cortex products

Review your weakest two domains using your own notes and re-explain each core concept aloud without reference material

Take timed practice sets across all five domains and log every wrong answer with the underlying concept gap, not just the correct choice

Re-derive the XSIAM, XDR, and XSOAR architecture diagrams from memory and correct any drift against your week 1-6 notes

Build a one-page cross-product integration map showing how telemetry and incidents move between XSIAM, XDR, XSOAR, Xpanse, and Cloud