Cortex XSOAR 6 Security Orchestration and Automation Course

Navigate the XSOAR UI and configure user preferences, themes, notifications, and access management. Learn how to enable automatic backups, set password policies, and use log bundles and diagnostics for troubleshooting.

Explore how incidents function as case files and how incident types and fields shape their structure. See how layouts, playbooks, and the War Room support automated and collaborative incident response.

Explore how integrations connect XSOAR to external systems via the marketplace, create multiple instances with distinct configurations, and use the sample incident generator to drive playbooks and automations.

Learn to create and configure Cortex XSOAR playbooks that automate security operations, including generating passwords, printing results, and managing inputs, outputs, and the context JSON across tasks.

Learn how to create automation scripts in xor using python, javascript, or powershell to validate passwords, test via the xor cli and playground, and leverage reputation and integration commands.

Create and manage lists in XOR, a versatile data container for playbooks. Build an IP-to-hostname workflow with a JSON list and script helper to return hostname or not found.

Explore threat intelligence indicators in XSOAR, learn to extract and enrich them with VirusTotal via regex and indicator types, and configure integrations and extraction rules for automated incident workflows.

Learn to manage jobs in xor, including time triggered and delta feed event driven types, to run playbooks automatically. Create a time triggered job to delete expired indicators daily.

Explore the marketplace and content packs, learn to search for resources like integrations and playbooks, manage packs, contribute your own, and export or import packs across environments.

Explore playbook task types, including section headers, manual tasks, automated tasks, conditional tasks, and data collection tasks. Understand how to implement and manage each type to build robust playbooks.

Explore Xsoar sub playbooks and parent playbooks, with inputs and outputs and shared context, to modularize automation and enable reusable, secure security workflows like ip reputation checks.

Discover how loops in XOR automate tasks by iterating over item arrays, processing indicators and hosts with playbook tasks, sub playbooks, and built-in loop controls.

Extend context to retrieve only reputation value from a VirusTotal URL check by specifying context key and path; using argument and quiet mode boost speed.

Develop excel scripts in your favorite ide by bridging Xsoar's limitations with Mr. Mock, enabling code completion, debugging, and error detection in PyCharm or Visual Studio Code.

Explore the most commonly used commands, methods, and functions in XSOAR integrations, including fetch incidents, fetch indicators, get last run, set last run, and Demisto parameters.

Explore pre-processing rules in XSOAR, which perform deduplication, linking, dropping, or closing incidents. Watch a practical demo that filters unclassified incidents using a top-down rule and a sample incident generator.

Explore pre-processing scripts in XSOAR and learn to create a pre-processing rule that adds custom tags to incidents based on type, such as phishing or malware.

Define a use case and build an automated webhook-driven workflow to notify teams of critical changes across virtual machines, networking and security, information, and event management.

Leverage Exor's robust capabilities to integrate security tools and streamline incident response through automation, using the PDF guide and source code to refine skills in real-world scenarios.