Get good at Cortex XSIAM and Portfolio.
An adaptive interview finds out what you already know, then drops you into a skill tree at exactly the right node. Every answer is graded against a rubric — not multiple choice, not a video you scrub past.
1 · Placement, not guesswork
Eight questions at most per tier. Answer well and it gets harder; struggle and it backs off. You end with a level 0–5 per tier and the evidence behind each rating. It is not one-shot: re-take any tier once you have levelled up, and your best result stands.
2 · Katas that bite back
Write the answer out, the way the work is really done. A grader checks your answer against the same rubric a reviewer would, criterion by criterion.
3 · A loop you keep coming back to
XP, streaks, spaced repetition, boss fights that gate the next tier, and a leaderboard. Miss a kata and it comes back around.
The learning paths
Cortex XSIAM — 5 tiers
- Tier 1 — XQL fluency. Query structure, filtering, aggregation, dedup, joins, time handling, hunting idioms.
- Tier 2 — Data model. Datasets, ingestion paths, parsing rules, XDM mapping, field hygiene, cost levers.
- Tier 3 — Detection engineering. Correlation rules, analytics concepts, tuning, false-positive economics, ATT&CK mapping.
- Tier 4 — Automation. Playbook anatomy, integrations, scripts, guarding destructive actions, lifecycle.
- Tier 5 — API / SDK. Auth, core API surfaces, running queries programmatically, external jobs, hardening.
Portfolio — 3 tiers
- Tier 1 — The map. Every product in Strata, Prisma and Cortex: what it is, the problem it solves, who buys it, and what it is sold alongside.
- Tier 2 — The seams. Where the catalogue gets confusing: renamed products, old names still on screen, one family's console running another's product, and bundles that read like products.
- Tier 3 — Problem to product. Turn one customer sentence into a recommendation: which products, how each is counted and sized, what not to propose, and the question still to ask.