SEC450: AI-Enabled Security Operations: Hands-on Investigation, Detection, and Automation

Important! Bring your own system configured according to these instructions. 

A properly configured system is required for each student participating in this course. Before coming to class, carefully read and follow these instructions exactly.

You can use any 64-bit version of Windows, macOS, or Linux as your core operating system that also can install and run VMware virtualization products. While you also must have 8 GB of RAM or higher for the VM to function properly in the class, 16GB is highly recommended if you wish to use the full functionality of the virtual machine.

It is critical that your CPU and operating system support 64-bit so that our 64-bit guest virtual machine will run on your laptop.

In addition to having 64-bit capable hardware, AMD-V, Intel VT-x, or the equivalent must be enabled in BIOS/UEFI.

Please download and install the most recent version of VMware Workstation, VMware Fusion, or VMware Workstation Player (VirtualBox and other virtualization platforms are not supported) on your system prior to the beginning of class. 

Mandatory System Hardware Requirements

• CPU: 64-bit 2.0+ GHz processor or higher-based system is mandatory for this class (Important - Please Read: a 64-bit system processor is mandatory)
• CRITICAL: Apple Silicon devices cannot perform the necessary virtualization and therefore cannot in any way be used for this course.
• BIOS/UEFI: VT-x, AMD-V, or the equivalent must be enabled in the BIOS/UEFI
• RAM: 8 GB (gigabytes) of RAM or higher is mandatory for this class, 16GB is very highly recommended for full (Important - Please Read: 8 GB of RAM or higher is mandatory)
• Disk: 80 gigabytes of free disk space for the course virtual machine

Connectivity

• Wireless Internet connectivity
• USB-A ports or an adapter to use a USB-A thumb drive (version 3.0 compatibility highly recommended)

Software

• VMware Workstation, Workstation Player, or Fusion. 
• The Linux virtual machine will be provided in class via USB thumb drive.

Configuration

• Please verify before coming to class that you have the administrative permissions required to transfer a virtual machine from a USB drive to your hard disk and start it. Also verify that Windows Device Guard, DLP, or other host-based protections will not interfere with the USB transfer or VM startup. (This is a common issue with company-built PCs, so if you intend to bring a corporate laptop, please test this before the event.)

If you have questions about the laptop specifications, please contact customer service. 

This course is designed for security professionals who work in or support security operations: SOC analysts and intrusion detection analysts; cyber defense analysts moving beyond basic alert handling; incident handlers building stronger triage, evidence, and documentation skills; detection engineers who want more operational context for rule development and tuning; security engineers supporting SIEM, EDR/XDR, SOAR, case management, and AI-enabled SOC tooling; threat intelligence analysts connecting CTI more directly to SOC prioritization; and SOC leads or managers who need to understand how AI, automation, and analyst process fit together.

The GIAC Security Operations Certified (GSOC) certification validates a practitioner's ability to defend an enterprise using essential blue team incident response tools and techniques. GSOC-certified professionals are well-versed in the technical knowledge and key concepts needed to run a security operations center (SOC).

• SOC monitoring and incident response using incident management systems, threat intelligence platforms, and SIEMs
• Analysis and defense against the most common enterprise-targeted attacks
• Designing, automating, and enriching security operations to increase efficiency

More Certification Details

• Course books
• Custom distribution of the Linux Virtual Machine containing a pre-build simulated SOC environment
• MP3 audio files of complete course lectures

This course assumes foundational knowledge equivalent to entry-level SOC analyst requirements. You should have a basic understanding of TCP/IP networking and general operating system concepts across Windows and Linux environments. Some familiarity with core security principles and common attack types is helpful, though we'll build on these concepts throughout the course.

The course is designed for current SOC analysts looking to advance their skills and professionals actively pursuing SOC analyst roles. If you're comfortable with basic networking concepts, can navigate command-line interfaces, and understand fundamental security terminology, you're ready for the techniques we'll cover. We'll teach you the specific tools, logging mechanisms, and advanced techniques; you just need the foundational knowledge to build on.

SEC450 is part of the Cyber Defense curriculum.

Depending on your current or desired future role, one of these courses is a great next step in your cybersecurity journey:

SOC Analyst

• SEC503: Network Monitoring and Threat Detection In-Depth
• SEC504: Hacker Tools, Techniques, and Incident Handling

Security Architect or Engineer

• SEC511: Cybersecurity Engineering: Advanced Threat Detection and Monitoring
• SEC530: Defensible Security Architecture and Engineering: Implementing Zero Trust for the Hybrid Enterprise

SOC Lead or Manager

• LDR551: Building and Leading Security Operations Centers
• LDR512: Security Leadership Essentials for Managers

This is a practical SOC analyst course for the AI era. It does not treat AI as a replacement for analysts, and it does not teach AI as a standalone novelty. Instead, it teaches students how modern SOC work actually gets done: by combining mission clarity, evidence discipline, threat-informed prioritization, detection engineering, automation, AI-assisted workflows, and human judgment. 

SEC450 is designed to build job-ready skills for those entering or advancing in defensive cybersecurity roles.

Key Career Benefits

• Hands-On SOC Skills: Learn log analysis, SIEM operations, and incident triage, the core skills needed for Tier 1 and Tier 2 SOC analyst roles.
• Career Acceleration: Ideal for transitioning into cyber defense or strengthening early blue team experience.
• GIAC Certification (GSOC): Earn an industry-recognized credential that validates your ability to operate in real-world security environments.
• Professional Network: Connect with instructors and peers through SANS's global cybersecurity community.
• Path to Advancement: Builds a foundation for higher-level courses like SEC511 (Continuous Monitoring) and SEC555 (Detection Engineering).

Bottom Line

SEC450 equips you with the practical knowledge, certification, and connections to launch or accelerate a career in blue team cybersecurity.