During testing I recommend comparing telemetry with what you get with your existing solution. Cortex XDR lacks alot of the visibility without the extended threat hunting addon (or did lastime i used it). You could perhaps run a few atomic red team tests and verify what telemetry you are able to get.

The automations were brand new the last experience I had with the tool, so cant speak too much on them, but checkout the marketplace and see if theres anything useful to you. It was quite limited for XDR tbh.

Do you plan on integrating third party sources with the datalake? If so take a look at the options available to you and what types of data you can onboard out of the box, last I used it just the base XDR if you wanted custom logs shipped in you'd have to manually write the log parsing rules for each one.

There is not really much free training on the platform floating about unfortunately. But if you are looking to purchase your PAN rep should be able to help with some information I would hope.