XSIAM Analyst study plan

Map the Cortex XSIAM automation architecture end to end, naming where playbooks, scripts, and integrations sit relative to the incident and alert data model

Identify every trigger type available for a playbook and state in one sentence when each is the correct choice

Create a working playbook that enriches a new high-severity alert with endpoint and identity context and writes results back to the incident

Explain how task inputs and outputs are passed between playbook tasks and how to reference a prior task result inside a later task

Build a conditional branching playbook that routes on severity and on enrichment verdict, including at least one loop over a list of entities

Write and unit-test a Python automation script that takes incident context as input and returns a structured verdict

Configure a feed or integration instance and verify data flows into the tenant

Implement error handling so a failed task does not silently abort the playbook, using timeouts and fallback paths

Design a playbook that closes the loop on a phishing report, from alert intake to mailbox remediation and user notification

Explain how automation interacts with incident fields, layouts, and the war room so an analyst sees automation output without opening the playbook

Tune a playbook to run only on the alert subsets you intend, using query-based and field-based scoping

List the failure modes that make automation noisy, such as over-broad triggers or missing deduplication, and state the mitigation for each

Describe how Cortex XSIAM ingests and normalizes logs into the data model, and trace one event from raw log to a queryable field

Write detection queries against the normalized schema that surface suspicious process, network, and identity behavior

Explain the role of analytics, correlation rules, and threat intelligence matching in generating alerts, and distinguish a BIOC-style detection from a simple IOC match

Configure a custom detection and confirm it fires against a simulated event

Interpret alert severity, confidence, and the evidence panel well enough to explain why an alert fired

Triage a set of alerts and classify each as true positive, benign, or needs more data, documenting the reasoning

Use entity and asset context to determine blast radius for a compromised endpoint or identity

Identify which MITRE ATT&CK techniques your detections cover and name two high-value gaps

Map the incident lifecycle from alert grouping through resolution, naming the state transitions and who or what drives each

Build a response playbook that isolates an endpoint and disables a user account, with a manual approval gate before destructive actions

Explain how threat intelligence and indicators are used during response to scope an incident

Configure incident grouping so related alerts consolidate into one incident rather than many

Execute a full response on a simulated ransomware scenario, from detection through containment, eradication, and recovery

Collect and preserve forensic evidence from an endpoint without destroying it, and document chain of custody

Write a post-incident summary that states root cause, scope, actions taken, and residual risk

Define the escalation criteria that determine when an analyst hands off to incident command

Run a timed mixed-domain practice set and score each domain separately to expose weak areas

Rebuild from memory the two playbooks and one detection you are least confident in, without notes

Review every missed item and write the underlying concept in your own words

State the end-to-end flow from log ingestion to automated response as a single narrative