This page brings together the vendor's two Cortex XDR courses. "Investigation and Analysis" (2 days) is built for analysts: case handling, causality chains, XQL queries and forensics. "Security Operations and Integration" (3 days) targets engineers: agents, collectors, Broker VM, integrations, detection engineering and tuning. Take one, the other or both, depending on your role in the SOC. Both courses are built around hands-on exercises, so participants leave with practical reflexes they can apply in their own SOC rather than theory alone.
Run an end-to-end investigation and read an alert's causality chain
Query and analyze logs with XQL
Manage endpoints, vulnerabilities and forensic artifacts
Deploy and integrate agents, XDR collectors, NGFWs and Broker VM
Design detection rules and automated workflows
Apply External Dynamic Lists and indicator rules
Build dashboards and reports
Program
Investigation and Analysis – introduction and endpoints
Cortex XDR overview
Endpoint management
Investigation and Analysis – XQL, alerting and detection
XQL queries
Alerting and detection logic
Investigation and Analysis – vulnerabilities and forensics
Vulnerability assessment
Forensic collection
Investigation and Analysis – automation, cases and reporting
Platform automation
Case management
Dashboards
Security Operations and Integration – software components
Agents, XDR collectors, Broker VM
Security Operations and Integration – integrations
NGFWs, third-party data sources
Security Operations and Integration – XQL and detection engineering
Correlation rules, indicators, EDLs
Security Operations and Integration – optimization and reporting
System tuning
Dashboards and reports
Prerequisites
Investigation and Analysis: cybersecurity fundamentals and experience analyzing incidents
Security Operations and Integration: a solid grasp of cybersecurity principles, including network and endpoint security
Target audience
SOC, CERT and CSIRT analysts, threat hunters and incident responders
SOC and detection engineers
MSSPs, service delivery partners, system integrators and security consultants
The exam
The courses do not include an exam. "Investigation and Analysis" is the recommended course for the XDR Analyst certification, and "Security Operations and Integration" for XDR Engineer. These role-based certifications are part of the vendor's program overhaul, which retired PCNSE and PCNSA on 31 July 2025. Question counts and exam length are not published; exams are in English, with 30 extra minutes in non-English-speaking countries. Before booking, review the official datasheet for your target exam and spend time in a lab tenant practicing queries and detection rules.
Preparation tips
Practice XQL daily on real or test datasets
Read the official datasheet of your target exam and review domain by domain
Round out with the vendor's online learning path
Frequently asked questions (FAQ)
Which of the two courses should I pick?
Analysts triaging alerts: Investigation and Analysis. Engineers deploying and integrating the platform: Security Operations and Integration. Mixed-role teams often take both.
What is XQL?
Cortex XDR's query language, used to explore collected data, hunt threats and build detections; it is central to both courses.
Which certifications do these courses target?
XDR Analyst for the two-day course and XDR Engineer for the three-day course.
Are the exams available in French?
No, they are in English, with 30 extra minutes for candidates in non-English-speaking countries.
How are sessions delivered?
In French or English, live online, in person in Casablanca or on-site at your organization, for one course or both back to back.