XSIAM Engineer study plan

Map the Cortex XSIAM deployment topology end to end, naming each component (management plane, data plane, brokers, collectors, engines) and stating what each one does

Trace a single event from endpoint agent through broker and ingestion pipeline to a stored alert, and annotate every hop with the protocol and port involved

Compare the deployment options available to an on-premises customer versus a fully cloud-managed one, and list the prerequisites each imposes on the customer network

Sketch a sizing worksheet that converts daily EPS, retention days, and endpoint count into a proposed tenant configuration

Describe the role of the broker and how agent-to-tenant communication is authenticated and encrypted, including what happens when a broker loses connectivity

List the built-in data source categories (endpoint, network, cloud, identity, email) and name at least two concrete log sources per category

Explain the difference between streaming and polling ingestion, and identify which integrations use each

Configure a test data source in a lab tenant and confirm events appear in the dataset with correct timestamps

Write a custom parser for a non-standard log format and validate it against at least five sample events, including one malformed event

Explain the normalization model and map raw fields to the standard schema fields used by detections

Diagnose a common ingestion failure (timezone drift, multiline stack traces, or dropped events) and document the fix

Apply a data retention or exclusion rule and explain the cost and detection trade-offs it creates

Explain how the analytics engine correlates events into alerts and distinguish rule-based, behavioral, and machine-learning-driven detections

Build a simple correlation rule that fires on a defined sequence of events and tune it to reduce false positives

Identify which fields and datasets a detection depends on, and predict what breaks if that source stops sending data

Review a set of existing detections and classify each by the technique it covers

Use the MITRE ATT&CK coverage view to identify at least three gaps relevant to your environment and propose a detection for each

Write a detection that uses threat intelligence indicators and explain how indicator matching differs from behavioral detection

Create a tuning exception that suppresses a known benign pattern without blinding the underlying rule

Explain how alert severity and confidence are assigned and how they affect incident creation

Design a playbook that enriches an alert, decides whether to isolate an endpoint, and notifies the responsible team

Use conditional branching, loops, and task outputs so the playbook handles both a malicious and a benign verdict

Configure an integration instance with proper credential handling and verify connectivity

Explain how playbooks attach to incident types and how automation runs differ from manual task execution

Walk through the incident lifecycle from creation through triage, investigation, and closure, naming the artifacts collected at each stage

Configure an incident type with custom fields and a matching layout, and explain how classification drives routing

Describe how threat intelligence feeds are consumed and how to judge whether an indicator is worth acting on

Explain what attack surface management surfaces and how exposed assets are prioritized

Design a role-based access model with at least three roles and justify each permission boundary

Diagnose three common troubleshooting scenarios (agent not reporting, integration auth failure, playbook task timeout) and document the diagnostic path for each

Review audit logs and describe how to trace a configuration change back to its author

Re-run a timed mixed-domain assessment and close any remaining weak areas