If your security operations center uses Cortex, your analysts may already be working with capabilities their last training didn’t cover. Palo Alto Networks’ May 2026 release added AI agents that plan investigations and take response actions, with analysts approving sensitive steps.
Keeping up with those changes takes more than learning new features. Analysts need to understand what an agent has done and decide whether its next move makes sense. Engineers need to write XQL queries to detect threats and build automation that connects Cortex with other security tools.
The course content matters, but so does how the instructor explains it and how much time employees spend practicing.
You often see the difference after they return to work. An engineer writes a detection that produces no results, or an automated response stops halfway through an incident. Can they work out what happened and what to check next?
That’s where the training itself shows. Lab practice lets employees trace problems like these, and clear explanations help them see why something works or fails.
An official course outline tells you what’s covered, but less about how the instructor will teach it. For that, you’ll need to ask the partner directly. In this guide, we break down how to choose a Cortex training partner and how we handle each factor at Datacipher.
6 Factors to Check in a Top Palo Alto Cortex Training Partner
Here’s what you should look at before booking Cortex training for your SOC. These factors focus on how a partner delivers the course, since that shapes how ready employees are once they’re back at work.
1. Are They Authorized to Teach Your Cortex Course?
Cortex includes more than one platform, and each has its own courses. You should first confirm which platform your security operations center uses, then make sure the partner is authorized to teach courses for it. If you’re switching platforms, choose training for the new one.
Palo Alto Networks offers five instructor-led Cortex courses, and its class schedule lists the authorized partners running each one. You can filter the schedule by course and region to see which partners can train employees where they’re based.
Source – Palo Alto Networks
Once you’re speaking with a partner, you can confirm the version of Cortex the course covers and the official material included. Cortex is updated often, so the version tells you whether employees will learn the features they’ll actually use at work.
| Question to ask: Are you authorized to deliver this Cortex course, and which version of Cortex does it cover? |
2. Do They Offer Courses for Both Analysts and Engineers?
Your analysts and engineers work with Cortex in different ways, so it makes sense that they’d need different training. Palo Alto Networks splits its Cortex courses along the same line.
XDR and XSIAM each have a two-day Investigation and Analysis course for analysts. It’s meant for people who look into alerts and piece together what happened during an incident.
Engineers have their own three-day courses on both platforms. These focus on connecting data sources to Cortex and setting up the detection rules your analysts rely on. If your SOC builds its own automated workflows, there’s also a four-day XSOAR course. It teaches you to build playbooks that handle repetitive response work automatically.
In a smaller SOC, the same person may do both jobs. In that case, they may need both the analyst course and the engineering course for your platform.
A partner that runs both tracks can train your whole SOC on one platform, instead of leaving one group out. You should also make sure the courses your people need are actually on the partner’s schedule, not just listed on their website.
| Question to ask: Which Cortex courses do you offer for each role? |
3. Can the Trainer Explain Cortex Concepts Clearly?
A lot of what happens in Cortex isn’t visible on screen. The platform pulls in data from many sources and links related alerts into a single incident, often before anyone looks at them. When employees don’t understand how that works, they end up trusting results they can’t explain.
A good trainer walks employees through the reasoning behind each step. For example, they’ll explain why a search returns the results it does, or how an automated workflow decides what to do next. When an employee asks why Cortex behaved a certain way, the instructor explains what happened behind the scenes.
Your SOC likely has a mix of experience levels in the same class. A trainer who can explain an idea in different ways keeps newer analysts on track without slowing everyone else. You should find out who will be teaching the course before you register for the course.
| Question to ask: How does your trainer explain Cortex concepts to a class with mixed experience levels? |
4. Do the Labs Prepare Employees for Real Incidents?
Cortex courses include hands-on labs, but how much employees get out of them depends on how the lab time is run. Some exercises have employees follow set steps to a known result. Others drop them into a simulated attack and leave them to work out what’s going on. The second kind is much closer to what your SOC deals with every day.
That kind of practice is hard to get anywhere else. A live SOC rarely gives employees time to test different approaches without risking disruption. Labs provide a safe environment to experiment and learn from mistakes.
For analysts, a good exercise might involve following an attack across several alerts to find where it started. For engineers, it could be connecting a new data source or fixing a detection rule that keeps flagging harmless activity.
The review after each exercise counts too. When the trainer walks through how different people approached the same problem, everyone picks up something new.
You should also know how the course divides its time between teaching and lab work. If the class is mostly lectures, employees leave without the practice they need to handle things on their own.
| Question to ask: How do your lab exercises prepare participants for the incidents they’ll face at work? |
5. Can They Offer Training at Times That Suit Your Organization?
Getting several employees through a multi-day Cortex course takes a bit of planning. They’ll need to make every session without falling behind on their regular work. The format also has to suit wherever they’re based.
If your analysts are spread across offices or cities, live online classes are usually the simpler option. Classroom training, on the other hand, gets everyone in one room, so it’s easier to work through problems together.
If you’re training a larger group, a private class lets you pick dates that work for your organization. And if most of them sit in the same office, you should find out whether the trainer can come to you. A partner that offers these options makes it much easier to train everyone without disrupting your day-to-day work.
| Question to ask: Which delivery formats do you offer for this Cortex course? |
6. Have They Trained Security Professionals on Cortex Before?
A course page can only tell you so much. Feedback from people who’ve already taken the course gives you a much clearer picture of what your employees can expect.
You should look for comments from analysts and engineers who took the same Cortex course, not just general reviews of the provider. The most useful comments describe what happened after the class, such as whether analysts felt ready to investigate alerts on their own. For engineers, it might be whether they could set up detection rules without going back to their course notes.
You should also find out whether the partner has trained organizations like yours. A partner that has trained similar organizations will know the kinds of questions your employees are likely to ask.
| Question to ask: Can you share feedback from those who completed this Cortex course? |
With these questions in hand, it’s easier to see how one Cortex training partner compares with another. Now, let’s walk through how Datacipher approaches Cortex training.
How Datacipher Delivers Palo Alto Cortex Training
At Datacipher, we train analysts who investigate threats in Cortex and engineers who set it up and automate it. Our focus is helping them handle real incidents with confidence.
Source – Datacipher
Here’s how our training lines up with each of the six factors.
1. Authorized Cortex Training That Keeps Pace With the Platform
We’re an authorized Palo Alto Networks training partner for organizations in India and KSA, and in the US and APAC too. You will also find us listed in Palo Alto Networks’ training partner directory.
Source – Palo Alto Networks
Every class follows the official Palo Alto Networks course material, which defines the learning objectives for each course. For an analyst course, that includes tracing an incident back to where it started. For an engineering course, it includes connecting Cortex to your other security tools and automating repetitive tasks. Our lessons and lab exercises stay close to those objectives, so you know what employees will come away with.
Palo Alto Networks updates the material as Cortex changes, and we keep our classes on the latest version. Before you register, we’ll confirm which Cortex version the course covers, so you know it lines up with what your SOC runs.
2. Cortex Courses for Every Role in Your SOC
We offer all five instructor-led Cortex courses in Palo Alto Networks’ catalog. They’re split by the work employees do, so your analysts and engineers can each take the course that fits their role.
The available courses include:
- Cortex XDR: Security Operations and Integration
- Cortex XDR: Investigation and Analysis
- Cortex XSOAR: Engineering Security Automation Solutions
- Cortex XSIAM: Security Operations, Integration, and Automation
- Cortex XSIAM: Investigation and Analysis
The Investigation and Analysis courses show analysts how to search log data and work through cases during an investigation. The engineering courses for XDR and XSIAM cover how data reaches Cortex. They also show engineers how to turn known threat details, like suspicious web addresses, into security rules. The XSOAR course goes deeper into automation and includes handling a phishing campaign from start to finish.
Not sure which course suits your team? We can help you choose the right one before you register.
3. Labs Built Around Realistic Security Incidents
Our Cortex courses include hands-on lab work built around real-world scenarios. Many exercises take place in a cyber range, a practice environment that simulates real attacks on a working network.
In a recent Cortex XDR: Investigation and Analysis class, participants started with a single alert about a suspicious script running on an employee’s laptop. By following the related alerts, they traced it back to a phishing email opened two days earlier. They also found the attacker had already tried to reach a shared file server. A few participants missed the file server at first, which turned into a useful discussion about what to check next.
In an XSOAR class, participants built an automated workflow to handle a reported phishing email. When one group’s workflow kept stopping halfway, the instructor walked them through the logs to find the setting they’d missed.
Our instructors stay close during every exercise and go over each one afterward, so everyone hears how others approached the same problem.
After the course ends, participants keep lab access for two more days. It gives them a chance to rerun an investigation or try a different approach before applying it at work.
4. Instructors Who Make Cortex Easy to Understand
Our Cortex instructors have at least seven years of industry experience, and several have more than ten. They also explain why each step works, helping employees understand Cortex instead of simply following instructions.
In one of our Cortex XSIAM: Investigation and Analysis classes, the instructor used parcel tracking to explain how Cortex links related alerts. One scan doesn’t say much on its own, but together they show where the parcel started and every stop it made. Cortex does the same thing with an attack, so analysts can trace it back to where it began. Once that clicked, participants had a much easier time working through their first incident in the lab.
You’ll usually have newer analysts sitting next to engineers with years of experience. Our instructors keep the pace comfortable for newer participants and go deeper with anyone who wants more.
And if someone has a problem from their own SOC, they’re welcome to bring it up. Where it helps, the instructor turns it into an example the whole class can learn from.
One participant shared their experience with the instructor’s explanations and guidance in these words:
5. Flexible Ways to Bring Cortex Training to Your Employees
We offer Cortex training in two ways, depending on where your organization is based. In India and KSA, our instructors come to your office and run the course on-site. In the US and APAC, classes run live online, with the instructor teaching in real time.
On-site training works well when most of your SOC sits in one building. Analysts and engineers learn in the same room, so they can work through an investigation together and compare notes as they go. When someone gets stuck, others often pick up something just from watching it get solved. And since the class happens at your office, nobody has to travel to attend.
Live online classes make it easy to bring together analysts from different offices. Everyone joins from their own desk, and questions still get answered as they come up. If someone hits a problem in the lab, the instructor can walk them through it right there in the session. It also makes it simple to train two analysts from one office and three from another in the same class.
If you’re training a larger group, we can also run a private class just for your organization. You get more say over the dates, and the discussion can stay focused on how your SOC actually uses Cortex.
6. What Security Professionals Say After Training with Us
The easiest way to get a feel for a class is to hear from someone who’s taken it. Here’s what one Cortex participant told us:
We’ve now trained professionals from more than 50 enterprises, everyone from global consulting firms to banks and telecom providers. Some of them work in SOCs where the alerts pretty much never stop. Over time, that’s shown our instructors which parts of Cortex tend to trip people up. In class, those are the topics they take a little slower.
Using Palo Alto Networks Training Credits for Cortex Courses
Palo Alto Networks Training Credits can be used for any of the Cortex courses we offer. If your organization already has some, it’s a simple way to cover the cost of training.
Each credit is worth $100, and the number you need depends on how long the course runs. Here’s how it breaks down:
| Cortex Course | Length | Training Credits |
| Cortex XDR: Investigation and Analysis | 2 days | 20 |
| Cortex XDR: Security Operations and Integration | 3 days | 30 |
| Cortex XSIAM: Investigation and Analysis | 2 days | 20 |
| Cortex XSIAM: Security Operations, Integration, and Automation | 3 days | 30 |
| Cortex XSOAR: Engineering Security Automation Solutions | 4 days | 40 |
Training Credits expire 12 months after purchase, so schedule your courses early enough to use them before they expire.
To get started, you can email us at training@datacipher.net with your Training Credit ID and the course you have in mind. You can also reach us through the form on any Cortex course page. We’ll confirm how many credits it needs and help you find a session that fits before your credits run out.
