Palo Alto SecOps Architect study plan

Map the Cortex XSIAM architecture end to end (data sources, brokers, ingestion pipeline, analytics engine, case management) and sketch it from memory

Compare XSIAM's native SIEM, SOAR, ASM, and UEBA capabilities against a traditional SIEM-plus-SOAR stack and list three operational differences

Identify the core data model concepts: datasets, parsing rules, normalization, and correlation rules, and write a one-page glossary

Explain how XSIAM's AI/ML detection layers (analytics, behavioral analytics, threat intelligence) feed into incident generation

Configure a data source onboarding flow (e.g., a log forwarder/broker path) in a lab or sandbox and document each step

Build and test a custom parsing/normalization rule for a sample log type

Write and tune two correlation rules and observe how alerts roll up into cases

Describe how XSIAM handles incident grouping, deduplication, and case lifecycle

Explain Cortex XDR's endpoint protection, EDR, and detection/response workflow, including agent deployment options

Differentiate XDR prevention profiles, malware/exploit/behavioral threat modules, and how policy exceptions are scoped

Describe Cortex Xpanse's attack surface management model: asset discovery, attribution, and risk scoring

Contrast XDR (endpoint-centric) and Xpanse (internet-facing asset-centric) telemetry and where they converge in the platform

Map Cortex XSOAR's components: playbooks, integrations, incident types, layouts, and the automation engine

Build a simple playbook with at least one conditional branch and one integration command in a lab

Explain how XSOAR incident fields, classification/mapping, and deduplication work together

Describe how the platform's AI layer (e.g., AI-assisted investigation or playbook generation) augments analyst workflows

Trace how an XSIAM case can trigger or hand off to XSOAR automation, and where each product owns the workflow

Design a playbook that responds to a XSIAM-generated incident and document the data passed between systems

Compare automation approaches: native XSIAM playbooks vs. XSOAR playbooks, and when to choose each

Identify common integration failure points (auth, rate limits, output parsing) and mitigation patterns

Configure and test an XDR response action (isolate endpoint, terminate process, or block hash) in a lab and record the audit trail

Explain how Xpanse findings can be triaged and remediated through platform workflows

Describe how XDR and Xpanse alerts surface in the broader platform and how analysts prioritize them

Practice writing a customer-facing explanation of a detection and the response taken

Synthesize the four domains into a single reference architecture narrative covering data flow from endpoint and attack surface through detection to automation

Review weak areas from prior weeks and re-do one lab or rebuild one artifact from memory

Practice explaining trade-offs (build vs. buy, native vs. integrated automation) in written form

Draft answers to likely scenario questions on migration, tuning, and operational ownership

Complete a timed full-length practice set or self-authored scenario exam under exam conditions

Review every missed item and map it back to a domain and a specific concept

Re-read only the highest-error concepts and produce condensed flashcards

Finalize a one-page exam-day reference sheet of key facts and decision rules