Test / Eksamen: Palo Alto Networks: XSIAM Analyst (PAN-S-XSIAMA)

The Palo Alto Networks Certified XSIAM Analyst certification is designed to validate the knowledge and skills required to use the Palo Alto Networks XSIAM platform for automation, threat detection, and threat response.

Target Audience

This exam is designed for the individuals who want to demonstrate the knowledge and skills required to use the Palo Alto Networks XSIAM platform for automation, threat detection, and threat response, including those who want to advance their SecOps analyst career.

Palo Alto Networks certification exam items are developed and approved by exam development experts in conjunction with subject matter experts (SMEs) who represent a broad spectrum of roles relevant to each certification. Each item is referenced to a publicly available technical or scholarly source.

Candidates should be able to demonstrate an understanding of SecOps processes and procedures

• Common SecOps processes and practices
• MITRE ATT&CK framework
• Incident response plans
• Investigative lifecycle
• XSIAM in the SOC
• Dashboards and reports to support compliance, incident summaries, security coverage status, and leadership briefings
• Query language proficiency to search for and correlate events
• Key components of incidents
• Alert tuning and management
• Initiation and use of the XSIAM playbook
• Identification and hunting for IOCs
• Endpoint policy management
• Proficiency in the use of XSIAM for incident detection, analysis, and response actions
• Ability to interact with playbook tasks to progress an investigation
• Analytical Abilities: Ability to perform forensic investigations, threat intelligence analysis, and asset management

1. Alerting and Detection Processes 19%

• 1.1 Identify and describe the different types of analytic alerts
• 1.2 Explain alert prioritization handling
• 1.2.1 Incident scoring
• 1.2.2 Alert starring
• 1.2.3 Featured fields
• 1.2.4 Incident domains
• 1.3 Configure custom prioritizations
• 1.4 Identify and describe alert sources and corresponding actions
• 1.4.1 Correlations
• 1.4.2 XDR Agent
• 1.4.3 XDR behavioral indicator of compromise (BIOC)
• 1.4.4 XDR indicator of compromise (IOC)

2. Incident Handling and Response 20%

• 2.1 Explain the incident creation process
• 2.2 Review and investigate alert evidence
• 2.2.1 Forensics
• 2.2.2 Identity Threat Detection and Response (ITDR)
• 2.2.3 Causality chain
• 2.2.4 Timeline
• 2.3 Identify, analyze, and respond to security events and incidents
• 2.4 Apply the native automation response action
• 2.5 Identify, hunt, and investigate leads and IOCs
• 2.6 Interpret incident context data
• 2.7 Differentiate between alert grouping and data stitching

3. Automation and Playbooks 15%

• 3.1 Use playbooks for automated incident response
• 3.2 Identify and describe playbook components
• 3.2.1 Task types
• 3.2.2 Sub-playbooks
• 3.2.3 Error handling
• 3.3 Explain the purpose of the playground

4. Data Analysis with XQL 14%

• 4.1 Identify and describe Cortex Data Models (XDMs)
• 4.2 Use XDMs to analyze security events
• 4.3 Use XQL to query datasets
• 4.4 Explain XQL data structure
• 4.4.1 Syntax
• 4.4.2 Schema
• 4.4.3 Data sources
• 4.5 Identify and describe XQL options
• 4.5.1 Query Library
• 4.5.2 XQL Helper
• 4.5.3 Scheduled queries

5. Endpoint Security Management 12%

• 5.1 Validate endpoint profiles and policies
• 5.2 Validate agent operational status
• 5.3 Monitor endpoint activities
• 5.4 Respond to endpoint alerts and incidents
• 5.4.1 Live terminal
• 5.4.2 Endpoint isolation
• 5.4.3 Malware scan
• 5.4.4 Endpoint file retrieval

6. Threat Intelligence Management and ASM 20%

• 6.1 Import and manage indicators
• 6.2 Validate artifacts, verdicts, reputations, and impact
• 6.3 Explain the process of creating prevention and detection indicator rules
• 6.4 Explain the process of verdict management
• 6.5 Explain indicator relationships
• 6.6 Validate and monitor asset inventory
• 6.7 Use the attack surface threat response center to identify, review, assess, research, and remediate emerging threats
• 6.8 Explain attack surface rules functionality

Recommended completion of the following course:

• Cortex XDR: Investigation and Analysis