SEC450: Blue Team Fundamentals: Security Operations and Analysis

GIAC Security Operations Certified (GSOC)
GIAC Security Operations Certified (GSOC)
  • In Person (6 days)
  • Online
36 CPEs
SEC450 provides students with technical knowledge and key concepts essential for security operation center (SOC) analysts and new cyber defense team members. By providing a detailed explanation of the mission and mindset of a modern cyber defense operation, this course will jumpstart and empower those on their way to becoming the next generation of blue team members. 16 Hands-on Labs & Defend the Flag Capstone

What You Will Learn

The Blueprint for SOC Analyst Excellence

SEC450 is a course designed from the ground up to be the most comprehensive SOC analyst training course available. If you are working in cyber defense operations, building a SOC, or want to improve the SOC you already with better data, workflow, and analysis technique, SEC450 is the course for you! By providing a detailed explanation of the mission and mindset of a modern cyber defense operation, this course will jumpstart and empower those on their way to becoming the next generation of blue team members. With six days of training, six course books, twenty hands-on labs, and an all-day Defend the Flag Capstone competition, there is simply no other offering on the market as complete as SEC450 for SOC and security analyst training.

What You Will Learn

If you're looking for the gold standard in cyber security analyst training, you've found it! SANS SEC450 and the accompanying GIAC GSOC certification are the premier pairing for anyone looking for a comprehensive security operations training course and certification. Check out the extensive syllabus and description below for a detailed run down of course content and don't miss the free demo available by clicking the "Course Demo" button!

Designed for teams of all types, SEC450 will get you hands-on with the tools and techniques required to quickly detect and halt advanced cyberattacks! Whether you are a part of a full SOC in a large enterprise, a small security ops group, or an MSSP protecting your customers, SEC450 will teach you and your team the critical skills for understanding how to defend a modern organization.

Designed By Security Analysts, For Security Analysts

SEC450 is authored, designed, and advised by a group of veteran SOC analysts and managers to be a one-stop shop for all the essential techniques, tools, and data your team will need to be effective, including:

  • Security Data Collection - How to make the most of security telemetry including endpoint, network, and cloud-based sensors
  • Automation - How to identify the best opportunities for SOAR platform and other script-based automation
  • Efficient Security Process - How to keep your security operations tempo on track with in-depth discussions on what a SOC or security operations team should be doing at every step from data generation to detection, triage, analysis, and incident response
  • Quality Triage and Analysis - How to quickly identify and separate typical commodity attack alerts from high-risk, high-impact advanced attacks, and how to do careful, thorough, and cognitive-bias free security incident analysis
  • False Positive Reduction - Detailed explanations, processes, and techniques to reduce false positives to a minimum
  • SOC Tools - including hands-on exercises demonstrating:
  • How to collect, organize, and use relevant threat data in a Threat Intelligence Platform (TIP)
  • Principles of success for endpoint security data collection whether you use a SIEM, EDR, or XDR
  • Alert Triage - How to quickly and accurately triage security incidents, using clever data correlation and enrichment techniques that will immediately surface and sort true positives from false positives
  • How to best use incident management systems to effectively analyze, document, track, and extract critical metrics from your security incidents
  • Crafting automation workflows for common SOC activities, relieving analysts of boring tasks and freeing up time for better threat hunting and detection engineering
  • Burnout and Turnover Reduction - Informed with both scientific research and years of personal experience, this class teaches what causes cyber security analyst burnout and how you and your team can avoid it by understanding the causes and factors that lead to burnout. This class will help you build a long-term sustainable cyber defense career so you and your team can deliver the best every day!
  • Certification - The ability to add on the GIAC GSOC certification that encourages students to retain the material over the long term, and helps you objectively demonstrate you and your team's level of skill

SEC450 takes the approach of not just teaching what to do, but also why these techniques work and encourages students to ask the critical question "how can we objectively measure that security is improving?" And unlike shorter security analyst training courses, SEC450 has the time to cover the deeper reasoning and principles behind successful cyber defense strategies, ensuring students can apply the concepts even beyond the class material to take their defensive skills and thinking to the next level. Don't just take our word for it, ask any of the course alumni! SEC450 instructors repeatedly see the long lists of improvement ideas students finish the class with, eager to bring them back to their organizations.

Business Takeaways

This course will provide:

  • A turn-key solution for SOC analyst training needs - giving analysts the skills they need to understand the tools, data, and defensive priorities required to defend your network from high-impact cyber attacks
  • How to derive clear strategic priorities for your security operations team
  • Show you how to make the most of security telemetry including endpoint, network, and cloud-based sensors
  • A battle-tested method to reduce false positives to the lowest possible level
  • The techniques for quick and accurate security incident triage
  • The methods to improve the effectiveness, efficiency, and impact of your SOC

Why Choose SANS450 Over The Competition?

Unmatched in the industry with its volume and depth, SEC450 includes:

  • 1300 pages of instructional content and labs with extensive notes and documentation
  • 20 hands-on exercises putting real SOC tools and situations in front of students to emphasize lessons with a virtual workbook containing extra challenges to test your understanding of the material
  • A custom course Linux virtual machine filled with real SOC tools
  • A capture-the-flag contest experience for students to apply their new knowledge and put their analysis skills to the test!
  • Continuously updated material to cover the newest attackers and techniques

This depth of material makes SEC450 and the GSOC certification a cyber security analyst training class like no other, covering techniques, mindset, and tools at a level unmatched by other offerings. Whether you're taking SEC450 yourself or including it in your analyst training plan, we'd love to have you and your org join the growing list of alumni and GSOC certified security analysts helping to halt the flow of disruptive cyberattacks!

What You Will Receive

  • Custom distribution of the Linux Virtual Machine containing a pre-built simulated SOC environment
  • MP3 audio files of the complete course lecture
  • Introduction and walk-through videos of labs
  • Digital Download Package that includes the above and more

What Comes Next?

Depending on your current role or future plans, one of these courses is a great next step in your cybersecurity journey:

Syllabus (36 CPEs)

Download PDF
  • Overview

    The course begins with laying the all-important foundations of a security team - understanding the mission of your SOC through the context of your organization and the external threat landscape. No matter where you are starting, SEC450 emphasizes the big-picture thinking on how to strategize and prioritize SOC processes and data to best detect and half high-impact cyberattacks. This section of the course teaches these concepts from the top down, ensuring students understand the mindset of an analyst, the required workflow, and the monitoring tools used in the battle against attackers. Throughout this day, students learn how monitoring data and security tools fit together (including incident management systems, threat intelligence platforms, SIEMs, and more) and see how to best integrate these tools all for a seamless workflow that allows alert triage and response to flow smoothly.

    • Using a SIEM for Log Analysis
    • Advanced SIEM Log Searching
    • Crafting SIEM Visualizations and Dashboards for Threat Hunting
    • Using Threat Intelligence Platforms
    • Incident Management Systems
    • Welcome to the Blue Team
    • SOC Foundations
    • SOC Organization and Functions
    • SOC Data Collection
    • An Introduction to SIEM
    • Building SIEM Queries
    • SIEM Visualizations and Dashboards
    • Knowing Your Enemy
    • Threat Intelligence Platforms
    • Alert Generation and Processing
    • Incident Management Systems and SOAR
  • Overview

    Day 2 begins the journey of building a deep understanding of your network. To defend a network, you must thoroughly comprehend its architecture and the impact that it will have on analysis. After discussing network visibility points, zones, traffic capture types, and how your network setup will drive the speed at which your SOC will need to be able to respond, section 2 then goes in-depth on common network services. These sections provide a thorough explanation of the current and upcoming features of DNS, HTTP (versions 1.1, 2 and 3), TLS, and more, with a focus on the most important points security professionals need to understand. In each section there is a focus on what normal data looks like, as well as the common fields and areas that are used to spot anomalous behavior. This section's goal is to give analysts the ability to quickly recognize common tricks used by attackers to turn these everyday services against us.

    • DNS Requests, Traffic, and Analysis
    • Analyzing Malicious DNS
    • Wireshark and HTTP/1.1 Analysis
    • HTTP/2 and HTTP/3 Traffic Analysis with Wireshark
    • Analyzing TLS Encrypted Traffic Without Decryption
    • Network Architecture
    • Traffic Capture and Analysis
    • Understanding DNS
    • DNS Analysis and Attacks
    • Understanding HTTP
    • HTTP(S) Analysis and Attacks
    • How HTTP/2 and HTTP/3 Work
    • Analyzing Encrypted Traffic for Suspicious Activity
    • Common Protocols for Post-Exploitation
  • Overview

    Day 3 of course opens with a discussion and demonstration of common endpoint attack techniques and the security controls and features organizations can use to disrupt and detect them. This includes an in-depth overview of how security logging is set up on Linux and Windows, and the decisions that will drive whether you are able to collect the logs needed to spot attacks. These sections cover high-importance log events and provide an in-depth explanation of how to interpret the most important Windows and Linux security logs. This section also covers practical concerns about the quality of your telemetry and how to ensure that your logs come with the context, categorization, and normalization required for analysts to make quick sense of them. These sections give a complete view of the logging pipeline from the moment a log is generated to when it arrives in our security tools, ensuring analysts know which logs they are receiving and why.

    Many new analysts struggle to understand how files are structured at a low level and therefore are hesitant when it comes to answering questions such as "could a file of type x be used for evil?" The second part of day 3 provides students with the concepts needed to reason through the answer, diving into files at the byte level. This section explains the difference between binary and text-based files, and what makes a file a valid document, PDF, executable, word document, or otherwise. Concepts such as strings, hashes, and file signatures are explained to show students how to quickly and accurately identify potentially malicious file samples. Students finish this day understanding how different common file formats can be identified, how they are typically weaponized, and how to quickly decide whether a given sample is likely to be malicious.

    • Threat Hunting with a SIEM Using Windows Logs
    • Log Enrichment and Visualization
    • Dissecting Common Malware File Types
    • Common Endpoint Attack Tactics
    • Endpoint Defense in Depth
    • How Windows Logging Works -- formats, channels, audit policies and more
    • How Linux Logging Works -- syslog format, protocol, and daemons, log files, journald
    • Interpreting Security-Critical Log Events
    • Making Logs Usable - Log Collection, Parsing, and Normalization
    • Identifying Potentially Malicious Files
    • Dissecting Commonly Weaponized File Types
    • Fast Identification and Safe Handling of Malicious Files
  • Overview

    In this section of the course we turn the focus to understanding and mastering the process of analysis with a focus on how to avoid common mistakes and biases. The course teaches a clear and methodical approach for alert triage and how to quickly sort opportunistic from potentially targeted attacks.

    In addition to analysis technique, this day covers both offensive and defensive mental models that are necessary to understand to perform high-quality analysis. Students will use these models to look at an alert queue and get a quick and intuitive understanding of which alerts may pose the biggest threat and need priority in investigation. It also covers cyber defense operational security (OPSEC) and safe investigation techniques to ensure that analysts do not tip their hand to attackers during the investigation process.

    In the final section of this day, phishing email investigation is covered in depth. With email being a primary entry vector for intrusions, it's incredibly important that analysts are confident in understanding multiple ways to detect the signs of a malicious email. Email header analysis is and verification protocols (SPF, DKIM, and DMARC) are explained in detail with the goal of teaching analysts how to quickly identify and dispose of clearly malicious and spoofed email. In addition, safe investigation of attached files, URLs, and email content is also covered so that analysts are ready for anything when it comes to the phishing triage inbox.

    • Alert Triage and Prioritization
    • Structured Analysis Challenge
    • High-Quality Incident Documentation
    • Analyzing Phishing Email Content and Headers
    • Alert Triage and Analysis
    • Structured Analytical Techniques for Alert Investigation
    • The Most Important Mentals Models for Security Analysts
    • Incident Documentation, Closing and Investigation Quality
    • Analysis OPSEC (Operational Security) for Defenders -- How to Not Tip Off Attackers of Defense Action
    • Detecting Malicious Emails through Email Header Analysis (SPF, DKIM, DMARC and more)
    • Email Content, URL, and Attachment Analysis
  • Overview

    Repetitive tasks, lack of empowerment or challenges, poorly designed manual processes - analysts know these pains all too well. While these are just some of the common painful experiences in day-to-day SOC work, they are also major contributing factors to unhappiness and burnout that can cause turnover in a SOC. Do things have to be this way? Of course not! But it will take some understanding and work on your part to do things differently.

    This section of the course targets improving efficiency and team enthusiasm for SOC work by tackling the most common problems head-on. Through process optimization, careful analytic design and tuning, and workflow efficiency improvements, we can eliminate many of these common pain points. This frees us from the repetitive work we loathe and allows us to focus on what we do best - analysis! Having the time for challenging and novel work leads to a virtuous cycle of growth and engagement throughout the SOC - and improves everyone's life in the process.

    This day will focus on tuning your tools using clever analysis techniques and process automation to remove the monotonous and non-value-added activities from your day. It also covers containment activities including the containment techniques teams can use, and how to decide which option is best to halt a developing incident or infection. We'll wrap up the day with recommendations on skill growth, long-term career development, and how to get more involved in the cyber defense community.

    • Alert Tuning and False Positive Reduction
    • SOC Automation - File Analysis
    • SOC Automation - Incident Containment
    • Reducing Burnout and Retention Issues in the SOC
    • False Positive Reduction - Analytic Features and the Importance of Log Enrichment
    • New Analytic Design, Testing, and Sharing
    • Alert Tuning Methodology
    • SOC Automation and Orchestration (with and without SOAR)
    • Improving Analyst Efficiency and Workflow
    • Methods for Quickly Containing Identified Intrusions
    • Skill and Career Development for SOC staff
  • Overview

    The course culminates in a day-long, team-based capture the flag competition. Using network data and logs from a simulated network under attack, day six provides a full day of hands-on work applying the principles taught throughout the week. Your team will be challenged to detect and identify attacks to progress through multiple categories of questions designed to ensure mastery of the concepts and data covered during the course.

GIAC Security Operations Certified

The GIAC Security Operations Certified (GSOC) certification validates a practitioner's ability to defend an enterprise using essential blue team incident response tools and techniques. GSOC-certified professionals are well-versed in the technical knowledge and key concepts needed to run a security operations center (SOC).

  • SOC monitoring and incident response using incident management systems, threat intelligence platforms, and SIEMs
  • Analysis and defense against the most common enterprise-targeted attacks
  • Designing, automating, and enriching security operations to increase efficiency
More Certification Details


A basic understanding of TCP/IP and general operating system fundamentals is needed for this course. Being accustomed to the Linux command-line, network security monitoring, and SIEM solutions is a bonus. Some basic entry-level security concepts are assumed.

Laptop Requirements

Important! Bring your own system configured according to these instructions.

A properly configured system is required to fully participate in this course. If you do not carefully read and follow these instructions, you will not be able to fully participate in hands-on exercises in your course. Therefore, please arrive with a system meeting all of the specified requirements.

Back up your system before class. Better yet, use a system without any sensitive/critical data. SANS is not responsible for your system or data.

  • CPU: 64-bit Intel i5/i7 (8th generation or newer), or AMD equivalent. A x64 bit, 2.0+ GHz or newer processor is mandatory for this class.
  • CRITICAL: Apple Silicon devices cannot perform the necessary virtualization and therefore cannot in any way be used for this course.
  • BIOS settings must be set to enable virtualization technology, such as "Intel-VTx" or "AMD-V" extensions. Be absolutely certain you can access your BIOS if it is password protected, in case changes are necessary.
  • 8GB of RAM or more is required.
  • 80GB of free storage space or more is required.
  • At least one available USB 3.0 Type-A port. A Type-C to Type-A adapter may be necessary for newer laptops. Some endpoint protection software prevents the use of USB devices, so test your system with a USB drive before class.
  • Wireless networking (802.11 standard) is required. There is no wired Internet access in the classroom.
  • Your host operating system must be the latest version of Windows 10, Windows 11, or macOS 10.15.x or newer.
  • Fully update your host operating system prior to the class to ensure you have the right drivers and patches installed.
  • Linux hosts are not supported in the classroom due to their numerous variations. If you choose to use Linux as your host, you are solely responsible for configuring it to work with the course materials and/or VMs.
  • Local Administrator Access is required. (Yes, this is absolutely required. Don't let your IT team tell you otherwise.) If your company will not permit this access for the duration of the course, then you should make arrangements to bring a different laptop.
  • You should ensure that antivirus or endpoint protection software is disabled, fully removed, or that you have the administrative privileges to do so. Many of our courses require full administrative access to the operating system and these products can prevent you from accomplishing the labs.
  • Any filtering of egress traffic may prevent accomplishing the labs in your course. Firewalls should be disabled or you must have the administrative privileges to disable it.
  • Download and install VMware Workstation Pro 16.2.X+ or VMware Player 16.2.X+ (for Windows 10 hosts), VMware Workstation Pro 17.0.0+ or VMware Player 17.0.0+ (for Windows 11 hosts), or VMWare Fusion Pro 12.2+ or VMware Fusion Player 11.5+ (for macOS hosts) prior to class beginning. If you do not own a licensed copy of VMware Workstation Pro or VMware Fusion Pro, you can download a free 30-day trial copy from VMware. VMware will send you a time-limited serial number if you register for the trial at their website. Also note that VMware Workstation Player offers fewer features than VMware Workstation Pro. For those with Windows host systems, Workstation Pro is recommended for a more seamless student experience.
  • On Windows hosts, VMware products might not coexist with the Hyper-V hypervisor. For the best experience, ensure VMware can boot a virtual machine. This may require disabling Hyper-V. Instructions for disabling Hyper-V, Device Guard, and Credential Guard are contained in the setup documentation that accompanies your course materials.
  • Download and install 7-Zip (for Windows Hosts) or Keka (for macOS hosts). These tools are also included in your downloaded course materials.

Your course media is delivered via download. The media files for class can be large. Many are in the 40-50GB range, with some over 100GB. You need to allow plenty of time for the download to complete. Internet connections and speed vary greatly and are dependent on many different factors. Therefore, it is not possible to give an estimate of the length of time it will take to download your materials. Please start your course media downloads as soon as you get the link. You will need your course media immediately on the first day of class. Do not wait until the night before class to start downloading these files.

Your course materials include a "Setup Instructions" document that details important steps you must take before you travel to a live class event or start an online class. It may take 30 minutes or more to complete these instructions.

Your class uses an electronic workbook for its lab instructions. In this new environment, a second monitor and/or a tablet device can be useful for keeping class materials visible while you are working on your course's labs.

If you have additional questions about the laptop specifications, please contact support.

Author Statement

"As someone who has held every position from entry-level analyst to SOC manager at a 100,000-employee company, I thoroughly understand the struggle of starting your first position in cyber defense. While there is a seemingly infinite amount of information to learn, there are certain central concepts that, when explained systematically, can greatly shorten the time required to become a productive member of the team. This course was written to pass this knowledge on to you, giving you both the high- and low-level concepts required to propel your career in cyber defense. It's packed with the concepts that I expected new employees to understand, as well the thought process we tried to cultivate throughout analysts' careers to ensure the success of the individual and the organization. I have also worked hard to distill the lessons I've learned through the years on staying excited and engaged in cyber defense work. While some believe SOC positions can feel like a grind, they do not need to be that way! This course goes beyond technical knowledge to also teach the concepts that, if implemented in your SOC, will keep you and your colleagues challenged, happy, and constantly growing in your day-to-day work, leading to a successful, life-long career on the blue team!"

-John Hubbard

"John has a great presentation style and it really helps drive the lesson home when there are brief anecdotal stories that come with the information." - Erick Sugimura, Mammoth Hospital


As a manager of a SOC - this is perfect. We can use all these tools.
April Morelock
So far, SEC450 not only meets but goes beyond my expectations. One year ago I became a SOC team lead and this course adds to my knowledge and puts a more structured approach on what a SOC I am running should look like
Radek Ochrymowicz
SEC450 was an excellent insight into the tasks of a SOC. Not only did it have actionable lessons on the tools and techniques needed to run a SOC, but also gave insight on ways to improve the operations of the team.
Nathan H

    Register for SEC450

    Prices below exclude applicable taxes and shipping costs. If applicable, these will be shown on the last page of checkout.