SEC450: Blue Team Fundamentals: Security Operations and Analysis

GIAC Security Operations Certified (GSOC)
GIAC Security Operations Certified (GSOC)
  • In Person (6 days)
  • Online
36 CPEs

SEC450 provides students with technical knowledge and key concepts essential for security operation center (SOC) analysts and new cyber defense team members. By providing a detailed explanation of the mission and mindset of a modern cyber defense operation, this course will jumpstart and empower those on their way to becoming the next generation of blue team members.

What You Will Learn

Is your organization looking for a quick and effective way to onboard new Security Analysts, Engineers, and Architects? Do your Security Operations Center (SOC) managers need additional technical perspective on how to improve analysis quality, reduce turnover, and run an efficient SOC?

SEC450 is an accelerated on-ramp for new cyber defense team members and SOC managers. This course introduces students to the tools common to a defender's work environment, and packs in all the essential explanations of tools, processes, and data flow that every blue team member needs to know.

Students will learn the stages of security operations: how data is collected, where it is collected, and how threats are identified within that data. The class dives deep into tactics for triage and investigation of events that are identified as malicious, as well as how to avoid common mistakes and perform continual high-quality analysis. Students will learn the inner workings of the most popular protocols, and how to identify weaponized files as well as attacks within the hosts and data on their network.

The course employs practical, hands-on instruction using a simulated SOC environment with a real, fully-integrated toolset that includes:

  • Security Information and Event Management (SIEM)
  • An incident tracking and management system
  • A threat intelligence platform
  • Packet capture and analysis
  • Automation tools

While cyber defense can be a challenging and engaging career, many SOCs are negatively affected by turnover. To preemptively tackle this problem, this course also presents research-backed information on preventing burnout and how to keep engagement high through continuous growth, automation, and false positive reduction. Students will finish the course with a full-scope view of how collection and detection work, how SOC tools are used and fit together, and how to keep their SOC up and running over the long term.

Hands-On Training

It is our belief that hands-on training is a crucial component of classroom learning, so each day of this course will include multiple hands-on exercises. To achieve the most realistic scenario possible, the class virtual machine is loaded with all the tools typically used in a SOC. Students will be introduced to the concepts, interconnections, and workflow associated with each of those tools. Throughout the class we will utilize a SIEM, threat intelligence platform, incident management and ticketing system, automation and orchestration tools, full packet capture, and analysis software, as well as multiple command line, open-source intelligence, and analysis tools. All of these tools have been set up and integrated to work with each other in order to re-create the workplace environment as closely as possible, allowing students to gain experience that they can directly translate to their own setup when they get back to the office.

Some of the highlights of what students will learn include:

  • How SIEM, threat intelligence platforms, incident management systems, and automation should connect and work together to provide a painless workflow for analysts
  • Analysis of common alert types including HTTP(S), DNS, and email-based attacks
  • Identification of post-exploitation attacker activity
  • Mental models for understanding alerts and attack patterns that can help to effectively prioritize alerts
  • How to perform high-quality, bias-free alert analysis and investigation
  • How to identify the most high-risk alerts, and quick ways to verify them
  • How logs are collected throughout the environment and the importance of parsing, enrichment, and correlation capability of the SIEM
  • How to create and tune threat detection analytics to eliminate false positives

What You Will Receive

  • Custom distribution of the Linux Virtual Machine containing a pre-built simulated SOC environment
  • MP3 audio files of the complete course lecture
  • Introduction and walk-through videos of labs
  • Digitanl Download Package that includes the above and more

Syllabus (36 CPEs)

Download PDF
  • Overview

    This day starts with an introduction to the blue team, the mission of a SOC, and how to understand an organization's threat model and risk appetite. It is focused on top-down learning to explain the mindset of an analyst, the workflow, and monitoring tools used in the battle against attackers. Throughout this day, students will learn how SOC information management tools fit together, including incident management systems, threat intelligence platforms, SIEMs, and SOAR tools. We end the day describing the various groups of attackers, how their methods differ, and their motivations.

    • TheHive Incident Management System
    • MISP Threat Intelligence Platform
    • SIEM with the Elastic Stack
    • Introduction to the Blue Team Mission
      • What is a SOC? What is the mission?
      • Why are we being attacked?
      • Modern defense mindset
      • The challenges of SOC work
    • SOC Overview
      • The people, process, and technology of a SOC
      • Aligning the SOC with your organization
      • SOC functional component overview
      • Tiered vs. tierless SOCs
      • Important operational documents
    • Defensible Network Concepts
      • Understanding what it takes to be defensible
      • Network security monitoring (NSM) concepts
      • NSM event collection
      • NSM by network layer
      • Continuous security monitoring (CSM) concepts
      • CSM event collection
      • Monitoring sources overview
      • Data centralization
    • Events, Alerts, Anomalies, and Incidents
      • Event collection
      • Event log flow
      • Alert collection
      • Alert triage and log flow
      • Signatures vs. anomalies
      • Alert triage workflow and incident creation
    • Incident Management Systems
      • SOC data organization tools
      • Incident management systems options and features
      • Data flow in incident management systems
      • Case creation, alerts, observables, playbooks, and workflow
      • Case and alert naming convention
      • Incident categorization framework
    • Threat Intelligence Platforms
      • What is cyber threat intelligence?
      • Threat data vs. information vs. intelligence
      • Threat intel platform options, features, and workflow
      • Event creation, attributes, correlation, and sharing
    • SIEM
      • Benefits of data centralization
      • SIEM options and features
      • SIEM searching, visualizations, and dashboards
      • Use cases and use case databases
    • Automation and Orchestration
      • How SOAR works and benefits the SOC
      • Options and features
      • SOAR value-adds and API interaction
      • Data flow between SOAR and the SIEM, incident management system, and threat intelligence platform
    • Who Are Your Enemies?
      • Who's attacking us and what do they want?
      • Opportunistic vs. targeted attackers
      • Hacktivists, insiders, organized crime, governments
      • Motivation by attacker group
      • Case studies of different attack groups
      • Attacker group naming conventions
  • Overview

    Day 2 begins the technical journey of understanding the environment. To defend a network, you must thoroughly understand its architecture and the impact that it will have on analysis. This day introduces the concepts of a modern organization's network traffic flow by dissecting a typical organization's network setup, the tools that contribute to security, and the features necessary for segmentation and monitoring. These modules ensure that students have a firm grasp on how network design affects their "view of the world" as an analyst.

    After discussing the network, day 2 then goes in-depth on common network services. These sections provide a thorough, working explanation of the current and upcoming features of DNS, HTTP(S), SMTP, and more, with a focus on the most important points for analysts to understand. In each section there is a focus on understanding what normal data looks like, as well as the common fields and areas that are used to spot anomalous behavior. The goal will be to leave the day with the ability to quickly recognize common tricks used by attackers to turn these everyday services against us.

    • Exploring DNS
    • HTTP and HTTPS Analysis
    • SMTP and Email Analysis
    • Corporate Network Architecture
      • Routers and security
      • Zones and traffic flow
      • Switches and security
      • VLANs
      • Home firewall vs. corporate next-gen firewall capabilities
      • The logical vs. physical network
      • Points of visibility
      • Traffic capture
      • Network architecture design ideals
      • Zero-trust architecture and least-privilege ideals
    • Traffic Capture and Analysis
      • Network traffic capture formats
      • NetFlow
      • Layer 7 metadata collection
      • PCAP collection
      • Wireshark and Moloch
    • Understanding DNS
      • Name to IP mapping structure
      • DNS server and client types (stub resolvers, forwarding, caching, and authoritative servers)
      • Walkthrough of a recursive DNS resolution
      • Request types
      • Setting records via registrars and on your own server
      • A and AAAA records
      • PTR records and when they might fail
      • TXT records and their uses
      • CNAME records and their uses
      • MX records for mail
      • SRV records
      • NS records and glue records
    • DNS analysis and attacks
      • Detecting requests for malicious sites
      • Checking domain reputation, age, randomness, length, subdomains
      • Whois
      • Reverse DNS lookups and passive DNS
      • Shared hosting
      • Detecting DNS recon
      • Unauthorized DNS server use
      • Domain shadowing
      • DNS tunneling
      • DNS traffic flow and analysis
      • IDNs, punycode, and lookalike domains
      • New DNS standards (DNS over TLS, DNS over HTTPS, DNSSEC)
    • Understanding HTTP and HTTPS
      • Decoding URLs
      • HTTP communication between client and server
      • Browser interpretation of HTTP and REST APIs
      • GET, POST, and other methods
      • Request header analysis
      • Response header analysis
      • Response codes
      • The path to the Internet
      • REST APIs
      • WebSockets
      • HTTP/2 & HTTP/3
    • Analyzing HTTP for Suspicious Activity
      • HTTP attack and analysis approaches
      • Credential phishing
      • Reputation checking
      • Sandboxing
      • URL and domain OSINT
      • Header and content analysis
      • User-agent deconstruction
      • Cookies
      • Base64 encoding works and conversion
      • File extraction and analysis
      • High frequency GET/POST activity
      • Host headers and naked IP addresses
      • Exploit kits and malicious redirection
      • HTTPS and certificate inspection
      • SSL decryption - what you can do with/without it
      • TLS 1.3
    • How SMTP and Email Attacks Work
      • Email delivery infrastructure
      • SMTP Protocol
      • Reading email headers and source
      • Identifying spoofed email
      • Decoding attachments
      • How email spoofing works
      • How SPF works
      • How DKIM works
      • How DMARC works
    • Additional Important Protocols
      • SMB - versions and typical attacks
      • DHCP for defenders
      • ICMP and how it is abused
      • FTP and attacks
      • SSH and attacks
      • PowerShell remoting
  • Overview

    It is extremely difficult to succeed at cyber defense without knowing where and how your data is produced, so day 3 takes us down to the host, logging, and file level. Starting with a survey of common endpoint-based attack tactics, day 3 will orient students to the array of techniques that are used against their hosts. The first portion of the day will show how each step of the attack lifecycle aligns with typical defensive tools and what methods an organization can use to detect and prevent attacks on their endpoints.

    To further prepare students for attack detection, these sections are followed by a thorough review of how Linux and Windows logging works. Reviewing logging capabilities gives students perspective on which logs will be present on any given system, where to find them, and how to interpret them. These sections cover high-importance log events and provide an in-depth explanation of how to interpret the most important Windows and Linux logs. The value of parsing and enriching logs is explained, as well as how SIEM log normalization and categorization works. These topics give a complete view of what happens from the moment a log is generated to when it shows up in our security tools.

    Many new analysts struggle to understand how files are structured at a low level and therefore are hesitant when it comes to answering questions such as "could a file of type x be used for evil?" The final part of day 3 provides students with the concepts needed to reason through the answer, diving into files at the byte level. This section explains the difference between binary and text-based files, and what makes a file a valid document, PDF, executable, word document, or otherwise. It also explains file-based exploitation methods and the features and formats most seen in attacks. Concepts such as using strings, hashes, and file signatures are explained to show students how to quickly and accurately identify potentially malicious file samples. Students will finish this day understanding how different common file formats are identified, how they are typically weaponized, and how to quickly decide whether a given sample is likely to be malicious.

    • Interpreting Windows Logs
    • Log Enrichment and Visualization
    • Malicious File Identification
    • Endpoint Attack Tactics
      • Endpoint attack centricity
      • Initial exploitation
      • Service-side vs client-side exploits
      • Post-exploitation tactics, tools, and explanations - execution, persistence, discovery, privilege escalation, credential access, lateral movement, collection, exfiltration
    • Endpoint Defense In-Depth
      • Network scanning and software inventory
      • Vulnerability scanning and patching
      • Anti-exploitation
      • Whitelisting
      • Host intrusion prevention and detection systems
      • Host firewalls
      • File integrity monitoring
      • Privileged access workstations
      • Windows privileges and permissions
      • Endpoint detection and response tools (EDR)
      • File and drive encryption
      • Data loss prevention
      • User and entity behavior analytics (UEBA)
    • How Windows Logging Works
      • Channels, event IDs, and sources
      • XML format and event templates
      • Log collection path
      • Channels of interest for tactical data collection
    • How Linux Logging Works
      • Syslog log format
      • Syslog daemons
      • Syslog network protocol
      • Log collection path
      • Systemd journal
      • Additional command line auditing options
      • Application logging
      • Service vs. system logs
    • Interpreting Important Events
      • Windows and Linux login events
      • Process creation logs for Windows and Linux
      • Additional activity monitoring
      • Firewall events
      • Object and file auditing
      • Service creation and operation logging
      • New scheduled tasks
      • USB events
      • User creation and modification
      • Windows Defender events
      • PowerShell logging
      • Kerberos and Active Directory Events
      • Authentication and the ticket-granting service
      • Kerberos authentication steps
      • Kerberos log events in detail
    • Log Collection, Parsing, and Normalization
      • Logging pipeline and collection methods
      • Windows vs. Linux log agent collection options
      • Parsing unstructured vs. structured logs
      • SIEM-centric formats
      • Efficient searching in your SIEM
      • The role of parsing and log enrichment
      • Log normalization and categorization
      • Log storage and retention lifecycle
    • Files Contents and Identification
      • File contents at the byte level
      • How to identify a file by the bytes
      • Magic bytes
      • Nested files
      • Strings - uses, encoding options, and viewing
    • Identifying and Handling Suspicious Files
      • Safely handling suspicious files
      • Dangerous files types
      • Exploits vs. program "features"
      • Exploits vs. Payloads
      • Executables, scripts, office docs, RTFs, PDFs, and miscellaneous exploits
      • Hashing and signature verification
      • Signature inspection and safety of verified files
      • Inspection methods, detecting malicious scripts and other files
  • Overview

    Now that the course has covered the ground required to understand the tools and data most frequently encountered by analysts, it's time to focus on the process of analysis itself. This day will focus on how the analysis process works and explain how to avoid the common mistakes and biases new analysts can slip into. To accomplish this, this day examines how our memory perception affects analysis and how cognitive biases cause us to fail to see what is right in front of us. The goal is to teach students not only how to think clearly and methodically, but also how to explain how they reached their conclusions in a way that can support future analysis.

    In addition to analysis technique, this day covers both offensive and defensive mental models that are necessary to understand to perform high-quality analysis. Students will use these models to look at an alert queue and get a quick and intuitive understanding of which alerts may pose the biggest threat and which must be attended to first. Afterward, safe analysis techniques and analysis operational security concerns are discussed to ensure that analysts do not tip their hand to attackers during the investigation process. The day finishes discussing both how to react to identified intrusions and considerations for doing so as well as how to ensure high-quality documentation for incidents is produced and maintained. The goal is for students to leave this day better prepared to understand their alert queues, perform error-free investigation, and be able to choose the best response for any given attack situation.

    • Alert Triage and Prioritization
    • Structured Analytical Challenge
    • Collecting and Documenting Incident Information
    • Alert Triage and Prioritization
      • Priority for triage
      • Spotting late-stage attacks
      • Attack lifecycle models
      • Spotting exfiltration and destruction attempts
      • Attempts to access sensitive users, hosts, and data
      • Targeted attack identification
      • Lower-priority alerts
      • Alert validation
    • Perception, Memory, and Investigation
      • The role of perception and memory in observation and analysis
      • Working within the limitations of short-term memory
      • Efficiently committing info to long-term memory
      • Decomposition and externalization techniques
      • The effects of experience on speed and creativity
    • Mental Models for Information Security
      • Network and file encapsulation
      • Cyber kill chain
      • Defense-in-depth
      • NIST cybersecurity framework
      • Incident response cycle
      • Threat intelligence levels, models, and uses
      • F3EAD
      • Diamond model
      • The OODA loop
      • Attack modeling, graph/list thinking, attack trees
      • Pyramid of pain
      • MITRE ATT&CK
    • Structured Analysis Techniques
      • Compensating for memory and perception issues via structured analysis
      • System 1 vs. System 2 thinking and battling tacit knowledge
      • Data-driven vs. concept-driven analysis
      • Structured analytic techniques
      • Idea generation and creativity, hypothesis development
      • Confirmation bias avoidance
      • Analysis of competing hypotheses
      • Diagnostic reasoning
      • Link analysis, event matrices
    • Analysis Questions and Tactics
      • Where to start - breaking down an investigation
      • Alert validation techniques
      • Sources of network and host information
      • Data extraction
      • OSINT sources
      • Data interpretation
      • Assessing strings, files, malware artifacts, email, links
    • Analysis OPSEC
      • OPSEC vs. your threat model
      • Traffic light protocol and intel sharing
      • Permissible action protocol
      • Common OPSEC failures and how to avoid them
    • Intrusion Discovery
      • Dwell time and intrusion type
      • Determining attacker motivation
      • Assessing business risk
      • Choosing an appropriate response
      • Reacting to opportunistic/targeted attacks
      • Common missteps in incident response
    • Incident Closing and Quality Review
      • Steps for closing incidents
      • Quality review and peer feedback
      • Analytical completeness checks
      • Closed case classification
      • Attribution
      • Maintaining quality over time
      • Premortem and challenge analysis
      • Peer review, red team, team A/B analysis, and structured self-critique
  • Overview

    Repetitive tasks, lack of empowerment or challenges, poorly designed manual processes - analysts know these pains all too well. While these are just some of the common painful experiences in day-to-day SOC work, they are also major contributing factors to unhappiness and burnout that can cause turnover in a SOC. Do things have to be this way? Of course not! But it will take some understanding and work on your part to do things differently.

    This day focuses squarely on improving the efficiency and team enthusiasm for SOC work by tackling the most common problems head-on. Through process optimization, careful analytic design and tuning, and workflow efficiency improvements, we can eliminate many of these common pain points. This frees us from the repetitive work we loathe and allows us to focus on what we do best - analysis! Having the time for challenging and novel work leads to a virtuous cycle of growth and engagement throughout the SOC - and improving everyone's life in the process.

    This day will focus on tuning your tools using clever analysis techniques and process automation to remove the monotonous and non-value-added activities from your day. It also covers containment activities including the containment techniques teams can use, and how to decide which option is best to halt a developing incident or infection. We'll wrap up the day with recommendations on skill growth, long-term career development, and how to get more involved in the cyber defense community.

    • Alert Tuning
    • Security Automation
    • Incident Containment
    • Improving Life in the SOC
      • Expectations vs. common reality
      • Burnout and stress avoidance
      • Improvement through SOC human capital theory
      • The role of automation, operational efficiency, and metrics in burnout
      • Other common SOC issues
    • Analytic Features and Enrichment
      • Goals of analytic creation
      • Log features and parsing
      • High-feature vs. low-feature logs
      • Improvement through SIEM enrichment
      • External tools and other enrichment sources
    • New Analytic Design, Testing, and Sharing
      • Tolerance to false positives/negatives
      • The false positive paradox
      • Types of analytics
      • Feature selection for analytics
      • Matching with threat intel
      • Regular expressions
      • Common matching and rule logic options
      • Analytic generalization and sharing with Sigma
    • Tuning and False Positive Reduction
      • Dealing with alerts and runaway alert queues
      • How many analysts should you have?
      • Types of poor alerts
      • Tuning strategy for poor alert types
      • Tuning via log field analysis
      • Using policy to raise fidelity
      • Sensitivity vs. specificity
      • Automation and fast lanes
    • Automation and Orchestration
      • The definition of automation vs. orchestration
      • What is SOAR?
      • SOAR product considerations
      • Common SOAR use cases
      • Enumeration and enrichment
      • Response actions
      • Alert and case management
      • The paradox of automation
      • DIY scripting
    • Improving Operational Efficiency and Workflow
      • Micro-automation
      • Form filling
      • Text expanders
      • Email templates
      • Smart keywords
      • Browser plugins
      • Text caching
      • JavaScript page modification
      • OS Scripting
    • Containing Identified Intrusions
      • Containment and analyst empowerment
      • Isolation options across network layers - physical, link, network, transport, application
      • DNS firewalls, HTTP blocking and containment, SMTP, Web Application Firewalls
      • Host-based containment tools
    • Skill and Career Development
      • Learning through conferences, capture-the-flag challenges, and podcasts
      • Home labs
      • Writing and public speaking
      • Techniques for mastery and continual progress
  • Overview

    The course culminates in a day-long, team-based capture the flag competition. Using network data and logs from a simulated network under attack, day six provides a full day of hands-on work applying the principles taught throughout the week. Your team will be challenged to detect and identify attacks to progress through multiple categories of questions designed to ensure mastery of the concepts and data covered during the course.

GIAC Security Operations Certified

The GSOC certification validates a practitioner’s ability to defend an enterprise using essential blue team incident response tools and techniques. GSOC-certified professionals are well-versed in the technical knowledge and key concepts needed to run a security operations center (SOC).

  • SOC monitoring and incident response using incident management systems, threat intelligence platforms, and SIEMs
  • Analysis and defense against the most common enterprise-targeted attacks
  • Designing, automating, and enriching security operations to increase efficiency
More Certification Details


A basic understanding of TCP/IP and general operating system fundamentals is needed for this course. Being accustomed to the Linux command-line, network security monitoring, and SIEM solutions is a bonus. Some basic entry-level security concepts are assumed.

Laptop Requirements

Important! Bring your own system configured according to these instructions!

CRITICAL NOTE: Apple systems using the M1 processor line cannot perform the necessary virtualization functionality and therefore cannot in any way be used for this course.

A properly configured system is required to fully participate in this course. If you do not carefully read and follow these instructions, you will likely leave the class unsatisfied because you will not be able to participate in hands-on exercises that are essential to this course. Therefore, we strongly urge you to arrive with a system meeting all the requirements specified for the course.

Host Operating System: Latest version of Windows 10, macOS 10.15.x or later, or Linux that also can install and run VMware virtualization products described below. You also must have 8 GB of RAM or higher for the VM to function properly in the class.

It is critical that your CPU and operating system support 64-bit so that our 64-bit guest virtual machine will run on your laptop.

In addition to having 64-bit capable hardware, AMD-V, Intel VT-x, or the equivalent must be enabled in BIOS/UEFI.

Download and install either VMware Workstation Pro 15.5.X+, VMware Player 15.5.X+ or Fusion 11.5+ on your system prior to the beginning of class. If you do not own a licensed copy of VMware Workstation or Fusion, you can download a free 30-day trial copy from VMware. VMware will send you a time-limited serial number if you register for the trial at its website.


CPU: 64-bit 2.0+ GHz processor or higher-based system is mandatory for this class (Important - Please Read: a 64-bit system processor is mandatory)

BIOS/UEFI: VT-x, AMD-V, or the equivalent must be enabled in the BIOS/UEFI

RAM: 8 GB (gigabytes) of RAM or higher is mandatory for this class (Important - Please Read: 8 GB of RAM or higher is mandatory)

Disk: 25 gigabytes of free disk space


  • Wireless Ethernet 802.11 B/G/N/AC
  • USB-A ports or an adapter to use a USB-A thumb drive (version 3.0 compatibility highly recommended)


  • VMware Workstation, Workstation Player, or Fusion.
  • The Linux virtual machine will be provided in class via USB thumb drive.


Please verify before coming to class that you have the administrative permissions required to transfer a virtual machine from a USB drive to your hard disk and start it. Also verify that Windows Device Guard, DLP, or other host-based protections will not interfere with the USB transfer or VM startup. (This is a common issue with company-built PCs, so if you intend to bring a corporate laptop, please test this before the event.)

Your course media will now be delivered via download. The media files for class can be large, some in the 40 - 50 GB range. You need to allow plenty of time for the download to complete. Internet connections and speed vary greatly and are dependent on many different factors. Therefore, it is not possible to give an estimate of the length of time it will take to download your materials. Please start your course media downloads as you get the link. You will need your course media immediately on the first day of class. Waiting until the night before the class starts to begin your download has a high probability of failure.

SANS has begun providing printed materials in PDF form. Additionally, certain classes are using an electronic workbook in addition to the PDFs. The number of classes using eWorkbooks will grow quickly. In this new environment, we have found that a second monitor and/or a tablet device can be useful by keeping the class materials visible while the instructor is presenting or while you are working on lab exercises.

Author Statement

"As someone who has held every position from entry-level analyst to SOC manager at a 100,000-employee company, I thoroughly understand the struggle of starting your first position in cyber defense. While there is a seemingly infinite amount of information to learn, there are certain central concepts that, when explained systematically, can greatly shorten the time required to become a productive member of the team. This course was written to pass this knowledge on to you, giving you both the high- and low-level concepts required to propel your career in cyber defense. It's packed with the concepts that I expected new employees to understand, as well the thought process we tried to cultivate throughout analysts' careers to ensure the success of the individual and the organization. I have also worked hard to distill the lessons I've learned through the years on staying excited and engaged in cyber defense work. While some believe SOC positions can feel like a grind, they do not need to be that way! This course goes beyond technical knowledge to also teach the concepts that, if implemented in your SOC, will keep you and your colleagues challenged, happy, and constantly growing in your day-to-day work, leading to a successful, life-long career on the blue team!"

John Hubbard

"John has a great presentation style and it really helps drive the lesson home when there are brief anecdotal stories that come with the information." - Erick Sugimura, Mammoth Hospital

Register for SEC450

  • In Person

Training events and topical summits feature presentations and courses in classrooms around the world.

Learn more
  • Live Online

Live, interactive sessions with SANS instructors over the course of one or more weeks, at times convenient to students worldwide.

Learn more
  • OnDemand

Study and prepare for GIAC Certification with four months of online access. Includes labs and exercises, and support.

Learn more