Domain 1: Security Operations Fundamentals
- Before enabling scope-based access control (SBAC), give users, user groups and API keys the scopes they need; in Permissive mode a user gets access when they hold at least one of the entity's scope tags.
- Deployment Admin is the infrastructure role for rolling out and maintaining agents without security operations capabilities, while Privileged Responder suits Tier 3 analysts who need Live Terminal, scripts and rule tuning.
- If a license expires or retention passes, data is purged and cannot be recovered or extended retroactively, and replacing an Event Forwarding token invalidates the previous one.
- System dashboards cannot be edited, but they can be duplicated into an editable copy, and a single dashboard or report can have up to four global filters.
- Reports are static snapshots for historical tracking, auditing and automated distribution; the Data Ingestion dashboard excludes Cortex XDR agent data, so an agent-only tenant shows an ingestion rate of 0.
- The Tier 1 triage specialist reviews alerts, adjusts their criticality and weeds out false positives, escalating what cannot be solved at Tier 1 to Tier 2.
- SIEM combines SIM and SEM to correlate log and event data, security orchestration coordinates interdependent security actions, and threat hunting proactively looks for threats that have not yet triggered alerts.
- The Analytics Engine builds a baseline from sensor data and needs EDR or network logs from at least 30 endpoints over 2 weeks, or cloud audit logs over 5 days.
- An LLM is a specific type of ML model, typically based on deep learning, designed for natural language tasks; regression predicts the next output from previous outcomes and is used in fraud detection.
- To act on Cortex XDR from Slack, the Slack email must match the Cortex user email so role-based access can be enforced.
Domain 2: Threat Intelligence and Incident / Case Response
- Building the incident response team, training staff and running exercises belong to the Preparation phase, and Detection and Analysis comes immediately before Containment, Eradication and Recovery.
- After case grouping comes case analysis, then response and resolution; low-severity issues created from correlation rules are not grouped into cases.
- Operational threat intelligence provides the campaign-specific context incident responders need, and dynamic filter indicator rules update their scope as new intel matches the filter.
- On first activation, SmartScore can take up to 48 hours to calculate and display case scores; if no scoring rule matches and there is enough data, a SmartScore is assigned.
- IOCs are checked against xdr_data across past data and new data as it arrives.
- To protect API quotas, indicators are re-enriched automatically only after the cache expires, 4,320 minutes (3 days) by default.
- For a low-confidence Benign WildFire verdict, Cortex XDR can treat the hash as unknown and run Local Analysis; if a hash is not in VirusTotal, avoid uploading the file to protect sensitive information.
- A real, correctly detected threat is resolved as True Positive, and True Positive and False Positive resolutions affect how future cases are handled and scored.
- Every threat hunt begins with a testable hypothesis grounded in threat intelligence, TTPs, incidents or risk, and researching a known threat starts by building an XQL query from that intelligence.
Domain 3: Cortex XDR
- Enhanced Application Logs from the firewall include DHCP information, which lets Cortex XDR raise issues by hostname instead of IP address, and Okta, Entra ID and PingOne logs are external authentication sensors.
- Cortex XDR continuously stitches data points into causality chains, and the network causality view is where analysts respond to stitched firewall and endpoint issues.
- The Causality Group Owner is shown on the left of the chain and is responsible for the other processes and events, while the Timeline shows all related events, issues, informational BIOCs and correlation rules over time.
- By default the agent blocks malware but does not quarantine it, hash exceptions take precedence over any additional verdict analysis, and if WildFire fails and Local Analysis is disabled no alert is generated on the file.
- An isolation action can be cancelled only while the endpoint is still Pending, and an endpoint cannot be searched until its initial scan is complete.
- Test a new or edited BIOC rule before saving it, since unrefined rules can generate thousands of issues; Analytics BIOC rules can only be disabled and enabled.
- Temporal profiles compare an entity to itself over time, peer group profiles compare it to similar entities, and entity classification detects an entity's role.
- An asset that stops reporting is Active for 0 to 3 days, Not Seen for 3 to 5, Lost for 5 to 7, and then no longer shown in the inventory.
- If an installation package is deleted, new agents installed from it cannot register, and after upgrading an endpoint with device control rules it must be rebooted for the rules to take effect.
- XDR extends protection beyond the endpoint by analyzing multiple telemetry sources and grouping related alerts, and XDR paired with SOAR automates response across multiple security layers.
Domain 4: Cortex XSOAR
- Without a TIM license, Cortex XSOAR is limited to 5 active feeds and 100 indicators per fetch, and the intel feed quota counts instances with Fetches Indicators selected, not whether the instance is enabled.
- Manual indicator expiration overrides every other method, a feed-level method overrides the indicator type, and expired indicators still exist and can be searched.
- TIM playbooks process indicators in batches of 1,000 and run in quiet mode by default, which is strongly recommended for production.
- The Generic Export Indicators Service publishes indicators as an External Dynamic List, keeping the most recent n by last seen when a query exceeds the list size.
- Each incident has a unique War Room that holds the audit trail of all manual and automatic actions; commands typed inside an incident return results there rather than to the Playground.
- Scheduled War Room commands run in the tenant's timezone, and War Room attachments should stay under 250 MB.
- Changing the playbook in the Work Plan removes completed tasks, and a failed task blocks later tasks until it is resolved.
- To-Do tasks are ad-hoc items outside the Work Plan with a single assignee, and incidents are kept for 6 months by default, with up to 1,000 retainable per tenant.
- Scripts can be written in JavaScript, Python or PowerShell; permission changes apply to playbooks at their next run, and all custom scripts are usable in conditional tasks while system scripts need the condition tag.
- Jobs are time triggered or triggered by a delta in a feed; a delta job does not run on a feed's initial fetch, and Reset last seen makes a rarely changing feed produce a delta.
Domain 5: Cortex XSIAM
- Cortex XSIAM Analytics analyzes Palo Alto Networks firewall, EAL, GlobalProtect and Prisma Access, XDR agent and Directory Sync data, plus external sensors such as third-party firewalls via a syslog collector and the Windows Event Collector on the Broker VM.
- Analytics detectors need an activation period, informally called soak time, before they raise issues, and detectors that reach 5000 or more matches in 24 hours are disabled.
- Automation rules follow WHEN / IF / THEN, trigger only on the initial ingestion of an issue, and only the first matching rule runs; they cover Medium and higher issues plus Low Analytic and ABIOC issues tagged Identity or Cloud.
- Quick Actions are single commands that appear as War Room entries but not in the Work Plan, and by default they run on every integration instance that contains the command.
- Content packs are free; mandatory dependencies are added automatically, Marketplace checks for updates every 2 hours, and reverting a pack does not revert its dependencies.
- Parsing rules are bound to a vendor and product and can drop unneeded data, while Data Model Rules map a dataset to XDM; editing a default mapping stops its Marketplace updates.
- Broker VM listener applets such as the Syslog, Netflow and Windows Event Collectors run active/active in an HA cluster, while pulling applets such as the DB Collector run only on the Primary node.
- The Cortex Data Lake tier is a cheaper tier for high-volume data that keeps XQL, correlation rules and dashboards but not XDM normalization, and real-time detection and stitching are out of scope apart from temporary exceptions.
- Case grouping links issues by artifact association, exact match detection and related entities, and a case stops accepting issues after 30 days, 14 days without a new issue, or 1,000 issues.
- IOC rules cover full path, file name, domain, destination IP, MD5 and SHA256; BIOC rules must filter on event_type; and Real Time correlation rules scan data as it is ingested and must include a filter stage.
Palo Alto Security Operations Professional exam tips
- Read every scenario for the product first: the same idea is called an incident in Cortex XSOAR and a case or issue in Cortex XDR and Cortex XSIAM, and the answer often depends on which console the question is set in.
- Know the hierarchies that decide conflicts - indicator expiration methods, source reliability for indicator fields, and the order in which automation rules are evaluated.
- Keep the automatic safeguards straight: rules disabled at 5000 hits in 24 hours, exceptions created for rules that hit more than 100 endpoints, and case grouping thresholds.
- For XQL questions, remember the default datasets, the 1,000-row default limit for basic queries, and that unmapped XDM fields return NULL.
- Separate what runs automatically from what an analyst triggers: automation rules and jobs run as the system, while the playbook debugger runs with the logged-in user's permissions.
Study guide FAQ
What does the Security Operations Professional exam cover?
Five domains from the July 2026 datasheet: Security Operations Fundamentals (25%), Threat Intelligence and Incident / Case Response (16%), Cortex XDR (23%), Cortex XSOAR (16%), and Cortex XSIAM (20%).
What is the passing score?
Palo Alto Networks sets the passing score at 860 on a 300-to-1000 scale for every one of its certification exams. A scaled score cannot be read as a percentage of questions answered correctly.
How many questions are on the exam and how long is it?
Palo Alto Networks does not publish a question count or seat time for this exam. It notes a 30-minute extension for candidates testing in non-English speaking countries. CertGrid's 75-question, 90-minute mock is a practice setting, not a vendor figure.
Do I need to know all three Cortex products?
Yes. The datasheet targets SOC professionals responsible for the basic application of Cortex XDR, Cortex XSIAM and Cortex XSOAR, and each product has its own domain alongside the SOC fundamentals and incident response domains.
Official exam sources
The domain names and weightings on this page follow the published exam blueprint. Each source below records what it confirmed and when it was read, so the split can be checked rather than taken on trust.
- Palo Alto Networks - Security Operations Professional datasheetBlueprint revised JULY 2026 · link and content verified 28 September 2026Five domains totalling 100%: Security Operations Fundamentals 25%, Threat Intelligence and Incident / Case Response 16%, Cortex XDR 23%, Cortex XSOAR 16%, Cortex XSIAM 20% - the domain weights used by CertGrid practice exams exactly. The target audience is SOC professionals responsible for the basic application of Cortex XDR, Cortex XSIAM and Cortex XSOAR. It also states that all exams are delivered in English and a 30-minute time extension is provided by default to candidates testing in non-English speaking countries.
- Palo Alto Networks - certification handbooklink and content verified 28 September 2026"For ALL Palo Alto Networks Certification exams, the converted raw passing score is 860 on a scale of 300 to 1000." 700 is CertGrid's own grading threshold, never Palo Alto's.
The vendor does not publish this. Palo Alto publishes neither an item count nor an exam length for this exam on its certification page, in the datasheet or in the handbook. So the 90 minutes and 75 questions of the CertGrid mock are practice settings, unverified from Palo Alto's own documents, and the question count is shown as "Varies" rather than as a Palo Alto figure.