Validates the knowledge and skills to develop, analyze, and administer the Cortex XSOAR security orchestration, automation, and response platform with native threat intelligence management.
The PCSAE certification validates professional-level expertise in developing, analyzing, and administering Cortex XSOAR — Palo Alto Networks' security orchestration, automation, and response platform with native threat intelligence management. It covers six exam domains: Playbook Development, Incident Objects, Automations and Integrations, Content Management and Solution Architecture, UI Workflow and Reports, and Threat Intelligence Management.
Recommended prerequisites: EDU-380 (Cortex XSOAR: Automation and Orchestration), plus Palo Alto Networks Certified Cybersecurity Apprentice, Practitioner, and Network Security Generalist designations are recommended.
Develop playbooks — reference context data, configure inputs/outputs, enable looping, differentiate task types (manual, automated, conditional, data collection, subplaybook), apply filters and transformers, use playbook debugger
Configure incident objects — incident types, layouts (fields, buttons, close forms), classifiers and mappers for incident management
Build automations and integrations — define automation capabilities across XSOAR functions, interpret and modify scripts, configure integration instances and framework
Manage content and solution architecture — marketplace concepts, custom vs system content, dev-prod remote repositories, RBAC, multitenancy, Docker, troubleshooting tools, and performance tuning
Use UI workflows, dashboards, and reports — query data (indicators, incidents, dashboards), manage investigations (War Room, Work Plan, Evidence Board), create and share dashboards and reports, use widget builder
Configure threat intelligence management — indicator objects (layouts, fields, reputation scripts, expiration), generate threat intel reports, configure feed integrations, auto-extract settings, and XSOAR indicators
SOC engineers and analysts who develop, administer, and maintain Cortex XSOAR playbooks and automation workflows in production environments
Security automation developers building custom playbooks, integrations, and scripts to orchestrate security operations across multiple tools
XSOAR customers, partners, and system engineers seeking to validate Cortex XSOAR administration and automation engineering skills
Security analysts and administrators responsible for threat intelligence management and incident lifecycle within the XSOAR platform
Zetlan Technologies provides expert-led PCSAE preparation covering all six exam domains with live sessions, hands-on playbook development labs, and comprehensive study materials.
Click any domain to expand and explore all topics covered in the official PCSAE exam blueprint.
Master XSOAR playbook development, automations, content management, and threat intel with Zetlan Technologies' expert-led PCSAE preparation program.