- Demonstrate knowledge of planning and configuring system authentication and authorization
- Explain the process of planning and deploying engines
- Explain the process of planning and managing a dev/prod deployment
- Demonstrate knowledge of managing Marketplace pack installations and version updates
Palo Alto Networks Certification Training Course
Palo Alto Networks Certified XSOAR Engineer Certification Training Course
We'll get you ready for the Palo Alto Networks Certified XSOAR Engineer exam, the Specialist credential for engineers who build and run Cortex XSOAR.
Course focus: Planning, installation and maintenance, use case development, playbook development, incident interactions and reporting, and threat intelligence management, mapped to the official blueprint.
Course Overview
What the XSOAR Engineer course covers and who it's for.
Palo Alto Networks retired PCSAE on July 31, 2025 and recommends XSOAR Engineer in its place. If you were preparing for PCSAE, this is the course we now teach for security automation.
We follow the five domains in the official datasheet. Playbook development is the biggest at 30%, so we spend a lot of lab time on tasks, context data, sub-playbooks, filters and transformers.
Accumentum is an independent training provider. We are not affiliated with, endorsed by or a partner of Palo Alto Networks, and this isn't official Palo Alto Networks training. Palo Alto Networks sets exam content, fees and policies, so check paloaltonetworks.com before you book.
Course Objectives
Get ready for XSOAR Engineer the way the exam is built.
01
Cover the Whole Blueprint
Work through all 5 domains in the official XSOAR Engineer datasheet, weighted the way the exam weights them.
02
Go Deep on Playbook Development
Playbook Development is 30% of the exam score per Palo Alto Networks, so it gets the most class time.
03
Practice in a Lab
Hands-on lab work on the tasks the XSOAR Engineer blueprint lists, not just slides.
04
Be Ready for Test Day
The exam is in person at a Pearson VUE test center with multiple choice, matching and ordering items. We practice all three.
Who Should Attend
- SOC and security automation engineers.
- Playbook developers and XSOAR specialists.
- Security architects and support engineers.
- Former PCSAE candidates whose exam was retired.
Prerequisites
- Palo Alto Networks doesn't list a required prerequisite certification, and we don't have enrollment prerequisites either.
- Some scripting and SOC experience helps. Security Operations Professional is a good first step.
Pathway Map
The XSOAR Engineer course in 5 modules.
Each module is one domain from the official datasheet, with its exam weight.
Course Content
- Demonstrate understanding of incident and indicator lifecycles
- Explain field and layout configuration
- Demonstrate understanding of classifier and mapper configuration
- Identify and describe incident creation methods
- Explain playbook task input and output configuration and results
- Explain the process of referencing and manipulating context data to manage automation workflow
- Identify and describe the various playbook task types
- Demonstrate understanding of sub-playbook (inputs, outputs, looping) configuration
- Explain incident states and actions
- Demonstrate understanding of War Room activities
- Explain incident relationships
- Demonstrate understanding of dashboard and report configuration
- Identify and describe threat intelligence features
- Explain indicator creation methods
- Explain the process of indicator configuration
- Explain indicator relationships
Course Features
How we teach XSOAR Engineer.
Instructor-Led Classes
Live instruction with time for questions, so you aren't figuring out the hard parts alone.
Hands-On Labs
Lab work tied to the tasks in the XSOAR Engineer blueprint.
Blueprint Mapping
Every module maps to a domain in the official XSOAR Engineer datasheet.
Exam Strategy
Practice with multiple choice, matching and ordering questions, plus test center tips.
Certification Exam
About the XSOAR Engineer exam.
XSOAR Engineer Exam Readiness
Our students pass at a 98.8% rate across Accumentum courses. We'll get you ready for XSOAR Engineer the same way.
Per Palo Alto Networks, XSOAR Engineer is a Specialist level exam priced at $250 USD, and taxes may apply. Since August 1, 2025, Palo Alto Networks exams are delivered in person at Pearson VUE test centers only. Exams are in English, with multiple choice, matching and ordering questions.
The certification is valid for two years and you renew by retaking the exam. If you fail, the waits before retakes are 15, 30 and then 90 days. Full details are on the official XSOAR Engineer page.
Accumentum is an independent training provider. We are not affiliated with, endorsed by or a partner of Palo Alto Networks, and this isn't official Palo Alto Networks training. Palo Alto Networks sets exam content, fees and policies, so check paloaltonetworks.com before you book.
Exam Blueprint
The full XSOAR Engineer blueprint.
We map our lessons to the official XSOAR Engineer datasheet. Here is that blueprint, all 5 domains and 33 objectives, so you can see exactly what is in scope.
Domain 1: Planning, Installation, and Maintenance (14%)
1.1 Demonstrate knowledge of planning and configuring system authentication and authorization
1.2 Explain the process of planning and deploying engines
1.3 Explain the process of planning and managing a dev/prod deployment
1.4 Demonstrate knowledge of managing Marketplace pack installations and version updates
1.5 Identify and describe configuration and troubleshooting integration instances
1.6 Explain the process of maintaining and troubleshooting the system
Domain 2: Use Case Planning and Development (22%)
2.1 Demonstrate understanding of incident and indicator lifecycles
2.2 Explain field and layout configuration
2.3 Demonstrate understanding of classifier and mapper configuration
2.4 Identify and describe incident creation methods
2.5 Identify and describe incident preprocessing and postprocessing functions
2.6 Demonstrate knowledge of incident type playbooks, layouts, and SLAs
2.7 Explain list configuration and management
Domain 3: Playbook Development (30%)
3.1 Explain playbook task input and output configuration and results
3.2 Explain the process of referencing and manipulating context data to manage automation workflow
3.3 Identify and describe the various playbook task types
3.4 Demonstrate understanding of sub-playbook (inputs, outputs, looping) configuration
3.5 Explain the process of applying filters and transformers to manipulate data in playbook tasks
3.6 Explain the process of applying playbook debugger in development and troubleshooting
3.7 Identify and describe built-ins, commands, and scripts
3.8 Explain the process of creating and applying automation scripts
3.9 Explain job creation and management
Domain 4: Incident Interactions and Reporting (16%)
4.1 Explain incident states and actions
4.2 Demonstrate understanding of War Room activities
4.3 Explain incident relationships
4.4 Demonstrate understanding of dashboard and report configuration
Domain 5: Threat Intelligence Management (18%)
5.1 Identify and describe threat intelligence features
5.2 Explain indicator creation methods
5.3 Explain the process of indicator configuration
5.4 Explain indicator relationships
5.5 Demonstrate knowledge of indicator enrichment and source reliability
5.6 Explain threat intel sharing with external security services
5.7 Demonstrate understanding of indicator exclusions list configuration and management
Before You Start
Is XSOAR Engineer the right fit for you?
Here is who Palo Alto Networks says the XSOAR Engineer exam is for and what it expects you to bring, taken from the official datasheet.
Who Palo Alto Networks wrote this exam for
This certification is designed for security operations engineers, security engineers, XSOAR specialists, SOC engineers, automation engineers, playbook developers, security architects, and support engineers responsible for deploying, configuring, integrating, managing, and troubleshooting Cortex XSOAR environments.
Knowledge, skills and abilities
- Working knowledge of security operations, including incident response processes and workflows
- Understanding of network security, infrastructure, protocols, and topology
- Working knowledge of endpoint OS fundamentals and security concepts relevant to integration
- Working knowledge of common security operations technologies (for example SIEM, EDR, threat intelligence platforms, ticketing systems, email security)
- Working knowledge of programming and scripting languages, particularly Python, and to lesser extent JavaScript and PowerShell, as supported languages w writing automation scripts
- Understanding of automation principles for efficient incident handling and security orchestration
- Working knowledge of data source integration concepts, log normalization, and data parsing and extraction techniques
- Understanding of integration methodologies, including third-party products and tools, and familiarity with API concepts (REST)
- Working knowledge of the MITRE ATT&CK security frameworks (for example TTPs/APTs) for understanding threat intelligence object relationship models
- Proficiency with common data formats (especially JSON) and understanding of data transformation principles (for example mapping, filtering, using transformers)
Study Plan
How we approach XSOAR Engineer prep.
The weights tell you where to spend your hours. Playbook Development leads at 30%.
Work in the actual console whenever you can. Questions are written around how the product behaves today, not how it looked a few releases ago.
Our course follows the same blueprint, with on demand lessons you can pause and replay, and our students pass at a 98.8% rate across Accumentum courses.
Exam Policies
The rules around XSOAR Engineer.
Once you pass XSOAR Engineer, the certification stays valid for two years. Palo Alto Networks recertification means retaking the current exam.
Passing a higher level exam in the same track automatically extends your active lower level certifications in that track by two years. For XSOAR Engineer that can include an active Security Operations Professional, Cybersecurity Practitioner or Cybersecurity Apprentice certification.
If you don't pass, you get a results report broken down by domain. Palo Alto Networks requires a 15 day wait before a second attempt, 30 days before a third and 90 days before any attempt after that. After a pass you can't sit the same exam again for 18 months.
Exams are delivered in English through Pearson VUE, and candidates testing in non English speaking countries get a 30 minute time extension by default. Your badge and certificate come through Credly.
Career Outcomes
Where XSOAR Engineer can take you.
XSOAR Engineer fits security automation engineers and playbook developers. Teams adopting SOAR need people who can turn a manual runbook into a reliable playbook, and this exam tests that work.
For a sense of pay, BLS puts the May 2025 median annual wage for information security analysts at $129,180. BLS also projects employment of information security analysts to grow 21 percent from 2025 to 2035, much faster than the average for all occupations. Treat it as a reference point and not a promise. Location, experience and the employer drive what any one person earns. Source: BLS Occupational Outlook Handbook.
Funding
Ways to pay for XSOAR Engineer training.
Our funding page lays out every way to pay for training, and PathPay lists the courses that qualify for a monthly plan.
Veterans can look at VR&E benefits for career training, and our Veteran Skill Forge programs bundle several courses into one path. Questions about your situation? Contact us and we'll talk it through.
Frequently Asked Questions
Common questions about our XSOAR Engineer course.
Palo Alto Networks Certified XSOAR Engineer is a Specialist level certification from Palo Alto Networks. Details are on the official certification page at https://www.paloaltonetworks.com/services/education/palo-alto-networks-xsoar-engineer.
No. We're an independent training provider and we aren't a Palo Alto Networks partner. Our course follows the public exam blueprint in the official datasheet. Palo Alto Networks offers its own learning paths at learn.paloaltonetworks.com.
Palo Alto Networks retired PCSAE on July 31, 2025 and recommends XSOAR Engineer in its place. If you were preparing for PCSAE, this is the course we now teach for security automation.
Palo Alto Networks lists Specialist exams at $250 USD, and taxes may apply. Vouchers are sold through Pearson VUE and expire 12 months after purchase. Check the current price before you buy.
No. Since August 1, 2025, Palo Alto Networks certification exams are delivered in person at Pearson VUE test centers only.
Two years from the date you pass. You renew by retaking the exam, and passing a higher level exam in the same track renews your active lower level certifications.
Palo Alto Networks doesn't list a required prerequisite certification, and we don't have enrollment prerequisites either. Some scripting and SOC experience helps. Security Operations Professional is a good first step.
Instructor-led, with hands-on labs and practice questions. Ask us about upcoming class dates.
Use the registration page linked below, or email info@accumentum.net and we'll follow up with dates and next steps.
5. Per the official datasheet they are Planning, Installation, and Maintenance (14%), Use Case Planning and Development (22%), Playbook Development (30%), Incident Interactions and Reporting (16%), Threat Intelligence Management (18%).
Playbook Development at 30%, per the Palo Alto Networks datasheet.
This certification is designed for security operations engineers, security engineers, XSOAR specialists, SOC engineers, automation engineers, playbook developers, security architects, and support engineers responsible for deploying, configuring, integrating, managing, and troubleshooting Cortex XSOAR environments.
Palo Alto Networks requires a 15 day wait after a first failed attempt, 30 days after a second and 90 days after a third. Once you pass, you can't retake the same exam for 18 months.
Our PathPay page lists the courses that qualify for a monthly plan. For anything else, contact us and we'll go over options.
Enrollment
Enroll in XSOAR Engineer training with Accumentum.
Enroll in our XSOAR Engineer course to get ready for the Palo Alto Networks Certified XSOAR Engineer exam with instructor-led classes and hands-on labs.
For dates and next steps, use the registration page linked below or email info@accumentum.net.
Ready to start on XSOAR Engineer?
Tell us your target date and we'll help you plan the path.