Get good at Cortex XSIAM.
An adaptive interview finds out what you already know, then drops you into a five-tier skill tree at exactly the right node. Every answer is graded against a rubric — not multiple choice, not a video you scrub past.
1 · Placement, not guesswork
Eight questions at most per tier. Answer well and it gets harder; struggle and it backs off. You end with a level 0–5 per tier and the evidence behind each rating. It is not one-shot: re-take any tier once you have levelled up, and your best result stands.
2 · Katas that bite back
Write the query, design the rule, spec the playbook. A grader checks your answer against the same rubric a reviewer would, criterion by criterion.
3 · A loop you keep coming back to
XP, streaks, spaced repetition, boss fights that gate the next tier, and a leaderboard. Miss a kata and it comes back around.
The five tiers
- Tier 1 — XQL fluency. Query structure, filtering, aggregation, dedup, joins, time handling, hunting idioms.
- Tier 2 — Data model. Datasets, ingestion paths, parsing rules, XDM mapping, field hygiene, cost levers.
- Tier 3 — Detection engineering. Correlation rules, analytics concepts, tuning, false-positive economics, ATT&CK mapping.
- Tier 4 — Automation. Playbook anatomy, integrations, scripts, guarding destructive actions, lifecycle.
- Tier 5 — API/SDK. Auth, core API surfaces, running queries programmatically, external jobs, hardening.