Domain 1: Alerting and Detection Processes
- Marking a single alert as a false positive only closes that one alert instance and does not change future detection; to stop recurrence you must tune the correlation rule or create an alert exclusion.
- A correlation rule's alert severity, category, and description are set by the rule author and applied to every alert it generates, not derived from viewer settings or the number of enabled rules.
- IOC rules match known-bad static atomic indicators such as file hashes, domains, and IP addresses (well suited to threat-intel feeds), while BIOC rules match real-time endpoint behavior like process execution, network connections, file, and registry activity.
- Custom BIOC and correlation rules in Cortex XDR are authored using XQL, and mapping a rule to a MITRE ATT&CK technique adds adversary-tactic context to its detections.
- Behavior-based modules catch novel threats: ransomware protection detects the encryption-like pattern itself (and can restore files from pre-encryption copies), behavioral threat protection correlates process lineage across related processes, and exploit prevention watches the exploitation technique rather than a known vulnerability.
- A causality chain traces the parent-to-child process lineage that connects related activity on a host, and Cortex XDR groups alerts by shared host involvement and temporal proximity within that chain.
- A Detected (Reported) action means the activity was logged but allowed to continue, whereas differing prevention-profile enforcement between endpoints is the usual reason identical activity yields different action outcomes.
- A Palo Alto Networks next-generation firewall forwards threat log data (spyware, vulnerability, WildFire verdicts) that becomes network-category Cortex XDR alerts, generally retaining the original category.
- Incident severity is driven by the highest alert severity present and the scope of affected hosts and users; WildFire verdicts and global prevalence are useful intelligence inputs during triage.
- Alert exclusions scoped to specific field values stop future matching alerts from surfacing, whereas disabling a correlation rule removes all its coverage including true positives; escalate an alert only when validated evidence indicates genuine malicious activity or broader compromise.
Domain 2: Incident Handling and Response
- Incident severity equals the maximum severity among its alerts, so an incident containing only Low alerts is rated Low; the scale runs Low, Medium, High, up to Critical.
- Cortex XDR automatically correlates alerts that share artifacts such as the same malicious IP address, or the same host and user account, into a single incident without manual analyst action.
- New and Under Investigation both indicate an incident that has not reached a final closed state, with Under Investigation marking one an analyst is actively reviewing, and the alert timeline presents events chronologically to reconstruct how the attack unfolded.
- The causality view's process tree shows full parent-to-child lineage plus associated file, registry, and network activity, revealing everything downstream of the initiating process to gauge impact.
- A causality chain is endpoint-specific, built from activity observed on that host; whether a new event's lineage traces back to the same causality group owner determines chain membership.
- Isolating an endpoint cuts its network connectivity and does not expire automatically; connectivity is restored only by explicitly canceling the isolation in the console.
- Analysts should weigh stakeholder communication, operational impact, and their own permission level before isolating a critical endpoint, and may deliberately delay isolation to coordinate first.
- Quarantining a file moves it into a secured local folder where it cannot run, and adding its hash to the block list (managed in the block-list interface) can quarantine matching existing files, not just block future execution.
- Live Terminal gives an analyst real-time interactive access to browse and manipulate files on a single endpoint during response.
- The Action Center tracks multiple action types including scripts, file retrievals, and malware scans, and Query Center supplies predefined query templates and dataset presets for hunting; a script runs independently on each endpoint against its own local state, so results naturally vary.
Domain 3: Data Analysis
- XQL queries typically begin with the dataset keyword to specify the data source, and xdr_data is the primary dataset holding raw endpoint telemetry: process, network, file, and registry activity.
- Query Builder searches translate into equivalent XQL behind the scenes, and switching to the XQL view shows the auto-generated query; choose the category by intent, using Process Event filtered by process name to find which endpoints ran a process and Network Event for connections to an external IP.
- Matching network events uses the enum comparison event_type = ENUM.NETWORK, not a quoted text string; using the wrong syntax causes the condition to match no rows.
- causality_actor_process fields trace an event back to the process that started the entire causal chain, while action_process fields describe the process created as a result of the recorded action.
- A by clause listing multiple fields groups rows by every unique combination of those field values, and the union stage can combine results from queries against different datasets, not only identical ones.
- In a join, multiple matching field pairs can be combined with 'and' so all pairs must match, but null values in a join key can prevent rows from matching, producing missing or incomplete results.
- concat() joins two or more string values end to end into one field, commonly used to build composite identifiers like domain plus username without inserting extra characters.
- Sorting with desc severity followed by asc _time orders by severity high to low, then breaks ties by time oldest first.
- A narrower time range limits how much underlying data the query scans and generally improves performance; searching beyond hot-tier retention may reach archived or cold storage and take longer.
- Query results display in a sortable table and can be exported to CSV, scheduled queries execute automatically at recurring intervals, and Query Center lets an analyst check whether a submitted long-running search has finished.
Domain 4: Endpoint Security Management
- Restrictions profiles govern where and how executable files are permitted to launch; when a trusted app is wrongly blocked, the fix is to narrow or add a targeted exception to the Restrictions rule for its path, not disable unrelated profiles.
- Policy rules define their target endpoints, attached profiles, name, and order position; static groups hold a fixed manually chosen endpoint list while dynamic groups update membership from filter criteria that can combine attributes like operating system and domain.
- An agent upgrade policy controls which endpoints move to a new agent version and on what timeline, letting admins validate a build on a subset before wider rollout; it does not govern content updates, scans, or licensing.
- Local analysis uses a static on-agent machine-learning model to produce an immediate verdict even without cloud connectivity, while WildFire performs deeper cloud static and dynamic analysis that refines the verdict, though requiring a verdict before execution can briefly delay legitimate unknown files.
- Device Control policies restrict removable devices at the device-class level, such as all mass-storage devices, and exceptions should be scoped as narrowly as practical to limit the risk they introduce.
- A device-specific exception lets one approved device through by targeting its identifiers while the broader policy continues blocking similar devices.
- Disk encryption status is reported per platform, with FileVault the native full-disk encryption on macOS and BitLocker the Windows equivalent, viewable in the endpoint's details or asset inventory.
- Scans have distinct scopes and states: a full scan covers the whole file system while a quick scan focuses on common infection points, and a requested scan progresses through pending, in progress, and completed.
- Endpoint Administration surfaces agent version, content version (the latest content package applied), and last-seen time per endpoint, and Cytool is a local command-line utility for checking agent driver and service status.
- Deleting an endpoint record releases its license back to the shared pool and removes it from console management, but does not remotely uninstall the agent or shrink the overall license pool; different network location rule sets adjust firewall exposure as a device moves between trusted and untrusted networks.
Palo Alto XDR Analyst exam tips
- Know the difference between resolving or marking a single alert (per-instance only) versus tuning a rule or creating an exclusion (stops recurrence); the exam repeatedly tests that a false-positive mark does not change future detection.
- Be able to place a detection in the right rule type: IOC for static known-bad indicators, BIOC for real-time endpoint behavior, correlation rules for cross-signal logic, all authored in XQL.
- Memorize how severity rolls up: incident severity equals the highest alert severity plus host/user scope, and correlation-rule alert severity is set by the rule author, not the viewer.
- For XQL questions, remember queries start with dataset, xdr_data holds endpoint telemetry, enum fields use ENUM.NETWORK syntax, and causality_actor_process versus action_process distinguish the chain originator from the resulting process.
- For endpoint management, know that isolation must be manually canceled, deleting an endpoint frees a license but leaves the agent installed, and blocking behavior differs between local analysis, WildFire, Restrictions, and Device Control.
Study guide FAQ
What does the Palo Alto Networks Certified XDR Analyst exam cover?
It covers four areas within Cortex XDR: alerting and detection processes (alert sources, Analytics, BIOC, IOC, and correlation rules, plus tuning), incident handling and response (causality analysis, containment and remediation, Live Terminal, incident lifecycle), data analysis with XQL, and endpoint security management (agent deployment, prevention profiles, Device Control, exceptions).
How do BIOC, IOC, and correlation rules differ?
IOC rules match static known-bad indicators like hashes, domains, and IPs. BIOC rules match real-time endpoint behavior such as process, network, file, and registry activity. Correlation rules combine multiple signals in XQL and let the author set severity, category, and MITRE ATT&CK mapping.
What is a causality chain in Cortex XDR?
A causality chain is an endpoint-specific view of parent-to-child process lineage plus associated file, registry, and network activity. It lets an analyst trace a process back to its origin and see everything downstream of the initiating process to assess the full impact of an incident.
Do I need to know XQL to pass the exam?
Yes. You should be comfortable reading and building XQL queries: starting with the dataset keyword, querying xdr_data, using enum comparisons like event_type = ENUM.NETWORK, grouping with by, combining datasets with union, joining on multiple keys, and sorting and filtering to hunt through endpoint telemetry.
Official exam sources
The domain names and weightings on this page follow the published exam blueprint. Each source below records what it confirmed and when it was read, so the split can be checked rather than taken on trust.
- Palo Alto Networks - XDR Analyst datasheetlink and content verified 8 September 2026Four domains totalling 100%: Alerting and Detection Processes 23%, Incident Handling and Response 34%, Data Analysis 28%, Endpoint Security Management 15% - the domain weights used by CertGrid practice exams exactly.
- Palo Alto Networks - certification handbooklink and content verified 8 September 2026"For ALL Palo Alto Networks Certification exams, the converted raw passing score is 860 on a scale of 300 to 1000." That single sentence settles the pass mark for all seven guides, and it is why five of them no longer say "a scaled passing score of 700" - 700 is CertGrid's own grading threshold, never Palo Alto's. The handbook also explains why the figure is scaled: cut scores are set per exam form by the Certification Committee, and scaling absorbs the difficulty variation between forms.
The vendor does not publish this. Palo Alto publishes neither an item count nor an exam length on its certification pages, in the datasheets or in the handbook - the handbook sends candidates to Pearson VUE for the appointment time, and notes that the time shown there is the whole appointment, including reading the candidate agreement, rather than answering time. So the 90 minutes on this guide is unverified from Palo Alto's own documents, and the question count is already shown as "Varies" rather than as a Palo Alto figure.