Palo Alto SecOps Professional study plan

Map the Cortex XDR/Cortex XSIAM console layout to the exam domain list, writing a one-line note on where each of the five domains lives in the UI

Configure role-based access and user groups for a lab tenant, then verify least-privilege behavior with two test accounts

Explain the difference between the management console, the broker VM, and endpoint agents in your own words

Trace a single raw event from ingestion through the data model to a visible alert, documenting each hop

Onboard at least two log sources (for example firewall traffic and a cloud audit log) using the appropriate ingestion method

Write parsing and normalization rules that map raw fields to the platform's data model, then validate them against sample records

Configure a broker VM or collector and confirm connectivity and health status

Diagnose one deliberately broken ingestion pipeline and record the root cause and fix

Build three detection rules (one behavioral, one IOC-based, one correlation rule) and tune each to reduce false positives

Create a custom dataset or lookup table and reference it from a detection rule

Write investigation queries using the platform's query language against onboarded data

Identify which alert fields drive severity scoring and adjust one severity profile

Walk an incident from alert to closure, documenting triage steps, evidence collected, and verdict rationale

Use the causality chain or timeline view to reconstruct an attack sequence across at least three stages

Perform endpoint response actions (isolate, quarantine, retrieve file) in a lab and note their side effects

Draft an incident report with timeline, scope, root cause, and containment actions

Identify the repeatable steps in your week-4 investigation and list which are automatable

Create a playbook that automates alert enrichment with threat intelligence and asset context

Add a conditional branch and an approval or manual task step to the playbook

Test the playbook against a replayed alert and log where it fails or stalls

Extend the playbook to perform a containment action automatically under defined conditions

Implement error handling, retries, and a fallback path for a failed integration call

Build a second playbook for a different alert type to prove reusability of shared tasks

Document input/output contracts and required permissions for each playbook

Configure threat intelligence feeds and indicator scoring, then verify indicators appear on alerts

Run a hypothesis-driven hunt using at least two data sources and record the query and rationale for each step

Create a custom IOC list from hunt findings and wire it into a detection rule

Convert one successful hunt into a scheduled report or recurring detection

Re-run every week's deliverable against a checklist of exam objectives and mark gaps

Rebuild the weakest two deliverables from scratch without notes to confirm retention

Complete timed practice scenarios covering triage, playbook design, and hunting

Write a one-page summary of concepts you still cannot explain confidently and schedule review