Domain 1: Alerting and Detection Processes
- The Analytics engine reads logs as they stream into the tenant, including firewall data, analyzes them on arrival, and raises an Analytics issue when activity deviates from the baseline it has built.
- Analytics profiles fall into three categories: peer group profiles compare entities within a peer group, temporal profiles compare an entity with itself over time, and entity classification models the role of an entity, such as a service account or a domain controller.
- The training period builds a detector's baseline, the test period is the recent logging time compared against it, and the activation period is the shortest amount of log time before a detector can generate an issue.
- Cortex XSIAM automatically disables issues from any Analytics detector, and any correlation rule, that reaches 5,000 or more matches over 24 hours, to keep the Issues table from being overcrowded.
- A user with Edit permissions changes an Analytics rule's severity per variant through Edit Rule, a customised severity is immune to content updates, and selecting several rows only allows enabling or disabling them.
- SmartScore assigns each case a numeric value from its severity and calculated risk, and it factors in user and host risk scores, so minor issues on highly critical assets can be raised above a critical issue on a low-risk asset.
- Scoring rules need Analytics enabled and then SmartScore enabled under Cases & Issues > Case Configuration > Case Scoring; a rule's score applies by default only to the first matching issue in a case, and the case score is the total of its issue scores.
- Starring rules are added under Cases & Issues > Case Configuration > Starred Issues with Add Starring Configuration, and starred cases carry a purple star that lets analysts narrow the Cases page.
- Featured fields are created under Cases & Issues > Case Configuration > Featured Fields, one value at a time or by CSV upload, and issues containing a featured Host, User or IP address value are flagged in the Name field and found with the Contains Featured filters.
- Every new issue is assigned a domain automatically and its case takes the same domain; cases in different domains cannot be merged, and a custom case domain cannot be deleted or renamed once created.
- An issue exception is a temporary, time-bound acceptance that pauses the SLA timer until its end date, its filter must return fewer than 100,000 issues with at most 10 exceptions created per day, while an exclusion is a permanent acceptance.
- Firewall issues with the same name and host within 24 hours are deduplicated into one row, while agent deduplication applies only to WildFire or Local Analysis issues within a 1-hour sliding window.
- Real Time correlation rules support only the dataset, datamodel, filter, alter, fields and config case_sensitive stages and must include a filter, while scheduled rules run no more often than every 10 minutes and the call and top stages are not supported in any correlation rule.
- A BIOC rule's XQL must filter on event_type, uses the xdr_data and cloud_audit_log datasets, allows only the filter and alter stages without aggregations, and can carry up to 3 MITRE techniques or tactics.
- After an IOC is loaded, XSIAM scans past xdr_data for the first 10,000 matches and keeps evaluating new data, and a Default Rule Expiration set for an IOC type applies to all existing and future rules of that type.
Domain 2: Incident Handling and Response
- A case is created automatically for Security or Posture domain issues of Medium severity or higher and for public API and correlation issues of Medium severity or higher, while Low severity correlation issues are not grouped into cases.
- A manually created case needs a domain, name and severity, its severity cannot be Low, files cannot be attached to it, and each manual case generates one issue whose name, severity and description mirror the case.
- A resolved issue stays linked to its case, the case closes automatically once all of its issues are resolved, and unlinking is done one issue at a time because bulk unlinking is not supported.
- When cases merge, the target keeps its ID and data, the source case is permanently deleted along with all of its context data, and a rule-based case score is recalculated to include both cases.
- Issues are grouped into a case when they share an artifact, are manually linked, are merged or are similar, whereas data stitching combines endpoint and firewall logs into stories, and the issue timeline is available only for issues stitched with endpoint data.
- In the causality chain a pen icon marks the last actor and a syringe icon marks an injected node, and besides the CGO-to-actor branch the view shows up to nine more process branches, nearest in time first.
- The All Events table in the causality view shows up to 100,000 related events that matched the issue criteria without triggering issues, and the network causality view can export it to a TSV file and isolate the host or open a Live Terminal.
- For PAN NGFW issues, Download triggering packet provides a session PCAP holding the first 100 bytes of the triggering packet, and Retrieve issue data and analyze returns its verdict in the Advanced Analysis field.
- Triage collections gather full file listings, event logs and registry hives, so each is limited to ten or fewer endpoints, and an offline Windows endpoint uses the matching 32-bit or 64-bit cortex-xdr-payload.exe run as administrator with the zip uploaded through Upload Offline Package.
- Closing a forensics investigation starts a 24-hour grace period in Close Pending status, during which Open cancels the close and keeps its collections.
- An ITDR Conditional Access Policy holds at most 20 rules and enforces the first matching rule, uses Okta or Entra ID as the MFA provider, and LDAP Protection takes effect only after the agent on the Domain Controller restarts.
- Journal mode is the default case timeline view, grouping consecutive activities from the same actor, and a playbook task registers results on it when Register as case timeline record is enabled with a Record name.
- An issue can read its parent case context through parentIncidentContext but not the context of other issues, and setParentIncidentContext writes data to the case context so other issues can use it.
- The Cortex Response and Remediation playbooks, built by the Cortex and Prisma research team, are recommended in the issue Work Plan tab, and Terminate Causality ends every process under the CGO's process tree.
- The case Resolution Center tabs are Pending, Recommended, In Progress and Done, and case team roles such as Assignee, Collaborator and Watcher are labels that grant no extra permissions.
Domain 3: Automation and Playbooks
- Playbooks run automatically on issues through automation rules, on a schedule or a delta through jobs, or manually on one or more issues, and they are built from regular tasks and sub-playbooks.
- Automation rules are evaluated in table order and only the first matching rule runs, manually created rules are added to the bottom of the table, and rules trigger only on the initial ingestion of an issue.
- Quick Actions are preset single commands, such as creating a ticket in a third-party system, that run without a playbook either manually or through an automation rule.
- Autonomous playbooks are enabled by default for tenants created on or after May 31, 2026; they cannot be edited, duplicated, deleted or run as sub-playbooks, and a custom automation rule placed above an autonomous rule with the same condition runs instead.
- Automation rules that trigger AI agents are a preview feature needing both the Edit Public Playbooks and Interact with agents permissions, and a rule whose agent is disabled in the Agents Hub fails and shows Agent Disabled.
- Conditional tasks come in four kinds: Built-in, a logical statement on playbook data; Manual, resolved by a person; Ask, a single-question survey; and Choose script, decided by a script such as IsIPInRanges.
- An Ask task creates a unique link for each answer and each recipient under Ask.Links, needs a condition path for every answer it acts on, and uses only the first answer received.
- A data collection survey is a separate web form with one link per recipient that needs no login, and field-based questions write the response straight into the issue field.
- AI prompt tasks default to a 10-second execution timeout, so a 504 DEADLINE_EXCEEDED error is fixed by raising Execution timeout (seconds) on the task's Advanced tab.
- Error handling with Stop, Continue or Continue on error path exists only for standard and conditional tasks that run a script, and task retries default to 0 with a 30-second interval, capped at 800 seconds.
- A task error is written to context under task.id.error, and in the Work Plan a red triangle marks a script or sub-playbook with errors while a yellow triangle marks a deprecated or outdated one.
- Sub-playbook outputs are Private by default unless shared globally, For each input runs equal-length lists once per set, and the built-in loop combines Exit when, Max iterations and Sleep.
- A playbook of more than thirty tasks should be split into sub-playbooks called from a parent that usually ends with closeInvestigation.
- The Playground is each user's private War Room, not connected to a live investigation, for safely testing scripts, APIs and commands, and it opens from Investigation & Response > Automation > Playground or the tenant URL ending in /playground.
- The Playground permission is None, typical for SOC Tier 1, or View/Edit, typical for Tier 2 and 3 analysts and engineers, and with Credentials set to None stored credentials cannot be referenced while testing.
- In Quiet Mode, playbook tasks do not save inputs and outputs, extract indicators or get indexed, but data still reaches context and errors and warnings still go to the War Room.
Domain 4: Data Analysis with XQL
- An XQL query names a data source, such as a dataset, preset or data model, followed by zero or more stages separated by pipes, and config is the only stage allowed before the dataset stage.
- Datasets reach the Cortex Data Model through automatic default mappings for xdr_data and six NGFW datasets, out-of-the-box Data Model Rules from Marketplace content, or user-defined Data Model Rules.
- A Data Model Rule maps one dataset to the data model: a MODEL section is mandatory and names the dataset, while an optional RULE section holds shared logic that a MODEL invokes with the call stage.
- If a data model query lists no fields, the xdm_core fieldset is returned, the _time system field is added by default, and raw fields not mapped to the XDM are reached as dataset_name.field_name.
- XDM aliases are used in a filter stage, and XDM_ALIAS.ip resolves to source, target and intermediate IP fields, host address arrays, DHCP addresses and VPN-allocated addresses.
- XDM enrichment such as IP geolocation is calculated on ingestion and saved, it is not performed for EDR events, and it is not supported in cold storage.
- XQL compares field values case-insensitively by default, and config case_sensitive = true is needed for case-sensitive matching.
- join defaults to type = inner and conflict_strategy = right, so when both sides return a field with the same name the joined value is kept.
- comp drops every field that is not in its by clause or a calculated column, including _time, and values() returns distinct values while list() keeps duplicates.
- top returns approximate counts in TOP_COUNT and TOP_PERCENT and up to 10 elements by default, while bin replaces each value with the start of its interval, so with span=1h a 10:45 timestamp becomes 10:00.
- The search stage must be the first stage, with only config allowed before it, and a query that uses search cannot use aggregation stages such as bin, comp, top or dedup.
- target must be the final stage, its type parameter is required, and append defaults to false, which overwrites existing data unless append=true is set.
- Hot storage queries use dataset = <name> by default while cold storage queries use cold_dataset = <name>, and forensic datasets such as forensics_prefetch appear only when the query names them explicitly.
- Syslog CEF data lands in a dataset named <CEFVendor>_<CEFProduct>_raw, and a dataset query that names no dataset runs against the datasets whose DEFAULT QUERY TARGET is Yes.
- The call stage runs a saved Query Library query by its exact name, a query containing call cannot itself be saved to the library, and running or scheduling library queries needs View/Edit on Query Center.
- XQL Helper describes common stage commands with example syntax in the Query Builder and in XQL widgets, and a scheduled query always runs on behalf of the user who created it, with Cancel stopping only the current run.
Domain 5: Endpoint Security Management
- Every registered endpoint is protected out of the box by a default security policy per platform, policy rules are evaluated top to bottom with the first match applied, and a rule that leaves a profile type unset uses the default profile for that type.
- Policy rules and profiles tied to targets beyond the user's scope are locked, and a profile can be deleted only when its Usage Count is 0, which View policy Rules helps confirm.
- Imported policy rules are added at the top of the list, imported default rules override the tenant default rule, and rules without a target stay disabled until one is set.
- With Treat Grayware as Malware disabled, grayware is treated as benign and not blocked, and when it is enabled grayware gets the same Action Mode as malware.
- Enabling XDR Agent Tampering Protection in the Agent Settings profile also requires tampering protection set to Block in the Malware profile, with both profiles assigned to the same endpoints.
- Items in agent allow lists can still generate security events, so Issue Exclusions are used to stop event reporting.
- For standard endpoints, Connected means a check-in within 10 minutes, Disconnected means 10 minutes to 30 days without one, and Connection Lost means 30 to 180 days.
- On Windows an endpoint reports Unprotected when behavioral threat protection and malware protection are not running, when exploit and malware protection are not running, or when content is unavailable; other module failures give Partially protected.
- While protection is paused, the agent runs with all prevention profiles disabled but stays connected, keeps forwarding EDR telemetry and can still receive policy and response actions.
- Live Terminal downloads files up to 200 MB and uploads files up to 40 MB, each operating system command runs independently so commands are chained with &&, and its File Explorer does not support network drives.
- Isolation also blocks IP-based file storage traffic, isolating a Mac needs agent 7.3 or later, macOS 10.15.4 or later and the network extension, and isolation is ended with Endpoint Control > Cancel Endpoint Isolation.
- A full malware scan can target up to 100 endpoints, periodic scanning is persistent so a missed scan runs when the endpoint powers on, and quarantined file records stay in the Quarantine List for 180 days.
- By default Isolate, Files Retrieval and Agent Upgrade actions expire after 30 days, while malware scans and quarantine expire after 4 days, configurable from 1 to 30 days under Action Center Expiration.
- Retrieved files are kept for up to 30 days and downloaded from the Action Center, environment variables cannot be used in retrieval paths on Mac and Linux, and Retrieve Support File targets up to 10 endpoints.
- Host Inventory can take up to 6 hours to collect initial data, the agent then scans every 24 hours, and agent audit logs are reported hourly and stored for 365 days.
Domain 6: Threat Intelligence Management and ASM
- Indicators enter Threat Intel Management through feed integrations, extraction from issues or manual entry, including STIX file upload, and the indicator store holds up to 100,000,000 indicators.
- On Cortex XSIAM 3.x, system-wide automatic indicator extraction and enrichment from issues is disabled by default unless the tenant was migrated from 2.x, and the TIM add-on allows enabling it in Server Settings.
- Expired indicators still exist and remain searchable, deletion is meant mainly for correcting ingestion errors, and when an indicator is on several feeds the most reliable feed sets its expiration.
- Excluding a domain with all of its subdomains takes two exclusion entries, the .domain value with Use Regex and the plain domain without regex, while Bypass exclusion list on a feed instance lets that feed add excluded indicators.
- Source reliability ranks Manual (A+++) above a reputation script (A++) and third-party enrichment (A+), then feeds rated A to F; the most reliable source sets the verdict, and equal sources that disagree give the worse verdict.
- A reputation script takes a single argument named input, needs the reputation tag, and its verdict overrides the reputation command and type defaults but never a manually set verdict.
- A DBotScore entry must include Indicator, Type, Vendor, Score and Reliability, a score of 0 means Unknown, and a score of 3 adds a Malicious key with Vendor and Description to the indicator context.
- A prevention indicator rule match creates an issue with source XDR Agent and action Prevented (Blocked), a detection rule match creates one with source Threat Intelligence and action Detected, and prevention rules are completed by selecting them in the Restrictions profile.
- Indicators must already be in the TIM database before an indicator rule is built on them, and when an indicator matches several TIM rules the highest severity rule wins, then the first created.
- XTI indicator rules scan collected log data and support only detection, their names can be up to 75 characters, and in XTI only the Verdict, Expiration and Tags fields can be overridden manually.
- Feeds and enrichment integrations such as URLhaus and AlienVault OTX v2 create indicator relationships automatically when Create relationships is selected, a manually added relationship defaults to related-to, and stale relationships can be revoked.
- Active Assets counts assets seen in agent or firewall logs while Active Managed Assets counts only those reporting agent logs, and asset upload requests are reviewed within five days while removals take effect within 24 hours.
- Emerging Vulnerabilities, under Posture Management > Vulnerability Management, needs the ASM add-on unless the tenant has XSIAM Premium, and after a relevant attack surface rule is enabled new findings can appear within 24 hours.
- Every attack surface rule has a default severity of Low, Medium or High, with Critical reserved for customers to set; issues inherit the rule's severity, and research team severity changes never override a customer's setting.
- Most attack surface rules are disabled by default, disabling a rule stops new issues but leaves open issues open, and a high-confidence inferred CVE match creates issues while a medium-confidence match creates findings only.
Palo Alto XSIAM Analyst exam tips
- Memorise the hard numbers in Alerting and Detection: 5,000 matches in 24 hours disables a detector or correlation rule, scheduled correlations run no more often than every 10 minutes, IOC backward scans stop at 10,000 matches, and exceptions cap at 10 per day.
- For Incident Handling, learn the case lifecycle end to end: which issues open a case automatically, what a manual case can and cannot carry, what a merge keeps and destroys, and when a case closes by itself.
- In Automation and Playbooks, practise reading a Work Plan and an automation rules table: first match wins, new rules go to the bottom, and error handling exists only on script tasks, so trace each scenario before choosing an action.
- Write real XQL against a tenant or the documentation examples, paying attention to stage defaults such as case-insensitive matching, inner joins that keep the right side, comp dropping unlisted fields and target overwriting by default.
- Treat Threat Intelligence and ASM as two halves of a 20 percent domain: drill the reliability ladder and verdict rules for TIM, then the attack surface rule defaults, asset inventory counters and Emerging Vulnerabilities workflow for ASM.
Study guide FAQ
What does the XSIAM Analyst exam cover?
Six domains from the August 2025 datasheet: Alerting and Detection Processes (19%), Incident Handling and Response (20%), Automation and Playbooks (15%), Data Analysis with XQL (14%), Endpoint Security Management (12%), and Threat Intelligence Management and ASM (20%).
Who is the XSIAM Analyst exam for?
It targets individuals who use Cortex XSIAM for automation, threat detection and threat response, including those who want to advance a SecOps analyst career. The datasheet expects familiarity with SecOps processes such as MITRE ATT&CK, incident response plans and the investigative lifecycle, plus hands-on use of XQL, playbooks, endpoint policies and IOC hunting.
How does CertGrid practice relate to the real exam?
CertGrid questions are written to the six datasheet domains and weighted the same way. Palo Alto Networks sets the passing score at 860 on a 300-to-1000 scale for every one of its exams and publishes no question count or seat time for this exam, so the length of a CertGrid mock is a practice setting, and a scaled score cannot be read as a percentage correct.
What should I study first?
Start with the two 20 percent domains, Incident Handling and Response and Threat Intelligence Management and ASM, together with Alerting and Detection Processes at 19 percent, since they carry well over half the score. Then build XQL fluency, which supports detection, hunting and investigation questions across the other domains.
Official exam sources
The domain names and weightings on this page follow the published exam blueprint. Each source below records what it confirmed and when it was read, so the split can be checked rather than taken on trust.
- Palo Alto Networks - XSIAM Analyst datasheetBlueprint revised AUGUST 2025 · link and content verified 18 October 2026Six domains totalling 100%: Alerting and Detection Processes 19%, Incident Handling and Response 20%, Automation and Playbooks 15%, Data Analysis with XQL 14%, Endpoint Security Management 12%, Threat Intelligence Management and ASM 20%; leaf objectives 1.1-1.4, 2.1-2.7, 3.1-3.3, 4.1-4.5, 5.1-5.4, 6.1-6.8.
- Palo Alto Networks - certification handbooklink and content verified 18 October 2026"For ALL Palo Alto Networks Certification exams, the converted raw passing score is 860 on a scale of 300 to 1000." 700 is CertGrid's own internal threshold, not the vendor figure.
The vendor does not publish this. Palo Alto publishes neither an item count nor an exam length for this exam on its certification page, in the datasheet or in the handbook. So the 90 minutes and 75 questions of the CertGrid mock are practice settings, unverified from Palo Alto's own documents, and the question count is shown as "Varies" rather than as a Palo Alto figure.