MGT551: Building and Leading Security Operations Centers

  • In Person (5 days)
  • Online
30 CPEs

Managing a security operations center (SOC) requires a unique combination of technical knowledge, management skills, and leadership ability. Whether you are looking to build a new SOC or take your current team to the next level, MGT551 provides the right balance of these elements to super-charge your people, tools, and processes. In the new 5-day version of MGT551, we will help you build a high-performing SOC tailored to your organization and the threats it faces. We will give you the tools you need to manage an effective defense, measure progress towards your goals, and build out more advanced processes like threat hunting, active defense, and continuous SOC assessment. Best of all, each section is packed with hands-on labs, introductions to some of the industrys best free and open source tools, and an interactive game in which you will apply your new SOC management skills in real-world scenarios.

What You Will Learn

From Your Physical Front Door to Your Network Back Door

Information technology is so tightly woven into the fabric of modern business that cyber risk has become business risk. SOC teams are facing more pressure than ever before to help manage this risk by identifying and responding to threats across a diverse set of infrastructures, business processes, and users. Furthermore, SOC managers are in the unique position of having to bridge the gap between business processes and the highly technical work that goes on in the SOC. Managers must show alignment to the business and demonstrate real value - a challenge when the threats are constantly changing and sometimes unseen. How do we know our security teams are aligned to the unique threats facing our organization? How do we get consistent results and prove that we can identify and respond to threats in time to minimize business impact? And how can we build an empowering, learning environment where analysts can be creative and solve problems while focusing on the mission at hand?

MGT551 bridges this gap by giving students the technical means to build an effective defense and the management tools to build an effective team. From section one of this training, students will learn how to design their defenses around their unique organizational requirements and risk profile. They will learn how to combine SOC staff, processes, and technology in a way that promotes measurable results and covers all manner of infrastructure and business processes. Most importantly, they will learn how to keep the SOC growing, evolving, and improving over time.

Throughout this course, students can expect to learn key factors for success in managing a Security Operations Center (SOC), including:

  • Collecting the most important logs and network data
  • Building, training, and empowering a diverse team
  • Creating playbooks and managing detection use cases
  • Using threat intelligence to focus your budget and detection efforts
  • Threat hunting and active defense strategies
  • Efficient alert triage and investigation workflow
  • Incident response planning and execution
  • Choosing metrics and long-term strategy to improve the SOC
  • Team member training, retention, and prevention of burnout
  • SOC assessment through capacity planning, purple team testing, and adversary emulatio

"There are so many [organizations] that seem to be trying to reinvent the wheel. All they need to do is invest in this course for real-world, actionable information that can put them on a solid path toward building, staffing, and leading their own SOC." - Brandi Loveday-Chesley


  • We are often asked how SEC450 and MGT551 are different. Here are the primary differences:


While this course is focused on management and leadership, it is by no means limited to non-technical processes and theory. Throughout the five days of instruction, students will work on fifteen hands-on exercises covering everything from playbook implementation to use case database creation, attack and detection capability prioritization and visualization, and purple team planning, threat hunting, and reporting. Plus, students will have the opportunity to participate in a brand new iteration of Cyber42 Cybersecurity Leadership Simulation built specifically for MGT551! Attendees will leave with a framework for understanding where their SOC should be focusing its efforts, how to track and organize defensive capabilities, and how to drive, verify, and communicate SOC improvements.


  • Custom distribution of the Linux Virtual Machine containing free open-source SOC tools
  • MP3 audio files of the complete course lecture
  • Printed and Electronic Courseware
  • A digital download package that includes the above and more



Syllabus (30 CPEs)

Download PDF
  • Overview

    MGT551 starts with the critical elements necessary to build your Security Operations Center: understanding your enemies, planning your requirements, making a physical space, building your team, and deploying a core toolset. Throughout this course section, students will learn how to build a strong foundation upon which an SOC can operate, focusing first on the most important users and data, and tailoring defense plans to threats most likely to impact your organization. Through workflow optimization, information organization, and data collection, you will learn how to ensure that your security operations will hit the ground running as efficiently as possible while protecting privileged SOC users and data. Exercises show how to implement these concepts through threat group and asset profiling, mapping likely attack paths into your environment, and implementing use cases repeatable playbooks to identify the threats and attack vectors you have identified.

    • Threat actor assessment
    • Attack path development
    • Developing and implementing SOC playbooks


    • What we are up against/industry surveys
    • The average SOC
    • What top-performing SOCs have in common
    • SOC trends
    • Class goals

    SOC Functions

    • High-level SOC diagram
    • SOC functions
    • Core activities
    • Auxiliary functions

    SOC Planning

    • Do you need a dedicated internal SOC?
    • What is and what is not a SOC?
    • Mission and purpose
    • Requirements
    • Standards and frameworks
    • Policies
    • Roles
    • Staffing levels
    • Constituency
    • Steering committee
    • Services/Capabilities
    • Charter

    Team Creation, Hiring, and Training

    • Organizational charts
    • Choosing a tiered vs. tierless SOC
    • Building a dream team
    • Interviewing tips and techniques
    • Interviewing mistakes and avoiding bias
    • Training plans

    Building the SOC

    • Physical space
    • Analyst/SOC IT considerations
    • Protecting SOC data

    SOC Tools and Technology

    • Foundational network and endpoint collection and detection technologies
    • "Next-gen" must-have capabilities
    • Advanced detection technologies
    • Analyst core toolset
    • Live response tools
    • Playbooks and SOAR
    • Planning tools and frameworks

    SOC Enclave and Networking

    • Requirements for SOC connectivity
    • Protecting SOC Data
    • SOC networking
    • SOC data flow
  • Overview

    Section 2 of MGT551 focuses on expanding our understanding of attacker tactics, techniques, and procedures and how we might identify them in our environment. We will discuss defensive theory and mental models that can guide our assessment and planning efforts, data collection and monitoring priorities, and cyber threat intelligence collection. We will also cover more specialized security monitoring use cases like DevOps, supply chain, insider threat, and business e-mail compromise. Exercises include using the MITRE ATT&CK framework to plan security data collection and writing solid threat intelligence requirements for relevant, timely information that answers your most pressing defensive questions.

    • Attack Tree Assessment
    • Visualizing Attack Techniques and Security Controls
    • Writing Priority Intelligence Requirements

    Cyber Defense Theory and Mental Models

    • Ops Tempo and the OODA Loop
    • Threat modeling
    • MITRE ATT&CK/Kill Chain
    • Threat Intel - F3EAD
    • Pyramid of pain and analytic types
    • The SOC as an "infinite game"

    Prevention and the Future of Security

    • Defensible network architecture
    • Hardening at the network and host level
    • Zero trust best practices
    • Identity security
    • Balancing productivity and security

    SOC Data Collection

    • The SOC data collection system
    • Open-source NSM and host-data tools
    • Collection issues
      • Tactical log collection
      • Audit policy flexibility
      • Most important data sources
      • How to collect data
      • Parsing, filtering, enrichment, and storage
    • Secure protocols and encrypted traffic analysis

    Other Monitoring Use Cases

    • DevOps telemetry
    • Chaos engineering and security monitoring
    • Supply chain security
    • Business e-mail compromise
    • Insider threat
    • Major breach case studies

    Using MITRE ATT&CK to Plan Collection

    • Key data sources
    • Defense mapping
    • Assessing your capabilities using DETT&CT

    Cyber Threat Intelligence

    • Threat intelligence types and sources
    • Consuming and producing intelligence
    • Mental models for threat intel
    • Intel transport and use
    • Threat intelligence platforms and integration

    Practical Collection Concerns

    • Security data collection
    • Parsing, filtering, categorization, and normalization
    • Data enrichment
    • Storage and indexing
  • Overview

    Section 3 of MGT551 is all about improving detections. We begin with effective triage and analysis and then move to more effective alerting mechanisms, starting with the fundamentals of analytic design. We will discuss detection engineering as a core SOC discipline to be planned, tracked, and measured. You will learn a repeatable, data-driven approach to SOC capacity planning and apply that process in a hands-on exercise using custom tools that you can take back to your own environment. We will also cover the different types of proactive threat hunting, see a structured approach that results in measurable improvements to your detection capability, and apply that approach in a hands-on threat hunting lab. Finally, we will look at active defense concepts and their role in a mature security operations capability. Taking the tools, processes, and concepts from section 3 of MGT551 back to your SOC will ensure that no (virtual) stone in your environment remains unturned.

    • SOC Capacity Planning
    • Structuring, Documenting, and Organizing Use Cases
    • Planning a Threat Hunt

    Efficient Alert Triage

    • Triage approach in various SOC staffing models
    • Where to triage alerts
    • What analysis must know
    • Prioritizing sensitive and high-risk accounts
    • Data classification

    Capacity Planning

    • Basic and complicating factors in triage capacity planning
    • Estimating workload
    • Factors contributing to alert count
    • Determining the right number of alerts
    • Approaches for handling excessive alerts

    Detection Engineering

    • SOC threat detection systems
    • Analytic outcomes and tuning
    • Writing high-fidelity rules
    • Use case tracking and storage
    • Risk-based scoring and alert aggregation

    Analytic and Analysis Frameworks and Tools

    • Blue team knowledge standardization and upcoming tools
    • ATT&CK Navigator
    • Yara
    • Sigma
    • Jupyter notebooks
    • Detection testing labs

    Threat Hunting

    • What is threat hunting and why is it needed?
    • Scheduling
    • Data quality
    • Hunting process and techniques
    • Hunting maturity model
    • Showing the value of threat hunting

    Active Defense

    • What is active defense/deception?
    • Active defense techniques and goals
    • Active defense tooling

  • Overview

    From toolsets to proven frameworks to tips and tricks learned in countless real-world scenarios, section four covers the full response cycle, from preparation to identification to containment, eradication, and recovery, for operations managers. The fourth section of MGT551 begins with the fundamentals of investigation: effective triage, investigative mindset, and tools for avoiding bias. Then the focus turns to preparing your environment to be defended by deploying security controls, identifying high-value assets and users, and designing playbooks to guide your response efforts. Finally, we will review best of breed incident response tools and free frameworks to guide your planning. Lab exercises in section four include incident response playbook design using the free RE&CT framework, investigation review and quality control, and tabletop exercise development.

    • Designing Tabletop Exercises
    • Planning Incident Response Using RE&CT
    • Investigation Quality Control


    • Investigation mindset
    • Avoiding bias
    • Analysis of Competing Hypothesis
    • Useful investigative techniques

    Incident Response (IR) Planning

    • IR policy, plans, and procedures
    • Staffing for IR
    • Communication guidelines and methods
    • Incident response procedure overview


    • Defensible network architecture
    • The Center for Internet Security (CIS) Controls
    • Securing high-value assets
    • Incident response procedures
    • Developing IR playbooks using RE&CT
    • Incident response communications

    Identification, Containment, and Eradication

    • When to call incident
    • Triggering the incident response process and assembling the team
    • Incident categorization
    • Data acquisition
    • Containment procedures
    • Incident documentation
    • Preparing your IR "go bag"
    • Threat eradication
    • Preserving evidence and engaging law enforcement

    Recovery and Post-Incident

    • Writing the incident report
    • Collecting intelligence
    • Additional logging during and after incidents
    • IR plan improvement

    Incident Response in the Cloud

    • Preparing your cloud environment for detection and response
    • Containment in the cloud

    Dealing with a Breach

    • Crisis management process and key functions
    • Crisis communications
    • Breach case studies

    IR Tools

    • EDR, NDR, and XDR
    • Windows Management Instrumentation and command line incident response
    • Live response tools
    • Forensic analysis tools
    • Malware analysis tools

    Continuous Improvement

    • Collaborative problem solving
    • Improving shared knowledge
    • Designing tabletop exercises
  • Overview

    The fifth and final section of MGT551 is all about measuring and improving security operations. We focus on three areas: developing and improving people, measuring SOC performance, and continuous validation through assessment and adversary emulation. We will also cover some of the more challenging elements of managing people in a dynamic and often high-pressure environment: building the right culture, addressing damaging behaviors, and handling common pitfalls of daily operations. By demonstrating value through structured testing and fostering a culture of learning, collaboration, and continuous improvement, we can ensure long term growth and success. In section five, youll receive the tools, techniques, and insights to do just that. Hands-on exercises will include building skills self-assessments and training plans for your analysts, designing SOC metrics, and continuous assessment and validation.

    • Building a Skills Self-Assessment and Training Plan
    • Creating, Classifying, and Communicating Your Metrics
    • Purple Team Assessment

    Staff Retention and Mitigation of Burnout

    • Cultivating intrinsic motivation in your team
    • SOC human capital model
      • Growth, skills, empowerment, and creativity
      • Automation, Ops efficiency, management/metrics
    • Burnout mitigation tactics for new and experienced analysts
    • Optimizing tasks for analyst growth
    • Performance management

    Metrics, Goals, and Effective Execution

    • Daily Ops vs. initiatives
    • Metrics vs. KPIs. vs. OKRs
    • Selecting Metrics

      • Metrics sampling rates
    • Selecting KPIs

      • Organizing operational measures
    • Creating OKRs
    • Successful execution
      • Metrics types
      • Goal setting
      • Acting on the right metrics
      • Scoreboards
      • Keeping a cadence of accountability

    Measurement and Prioritization Issues

    • Levels and types of measurement
    • The downside of risk matrices and CVSS scoring
    • The right kinds of measurements
    • Quantitative and qualitative measurement with examples

    Strategic Planning and Communications

    • Building a strategic SOC plan
    • Executing your strategic plan
    • Maintaining direction, alignment, and commitment
    • Measuring SOC maturity with SOC-CMM
    • Storytelling and visualization in security

    Analytic Testing and Adversary Emulation

    • Analytic testing
      • Analytic testing tools
      • Automated assessments
    • Penetration resting, red teaming, and adversary emulation
    • Purple team vs. red team execution and benefits
    • Purple teaming
      • Benefits
      • Methodology and execution
      • Reporting and tracking tools

    Automation and Analyst Engagement

    • Types of automation
    • A 5-step approach to applying automation in the SOC
    • Automating SOC workflows with SOAR
    • Six sigma concepts
    • Gamification of SOC tasks and workflows
    • Optimizing for continuous engagement


This course does not have any specific prerequisites, but it is suggested that students have some experience in an operational security role. SANS courses such as SEC450: Blue Team Fundamentals: Security Operations and Analysis or MGT512: Security Leadership Essentials for Managers will give students a solid base-level understanding of the concepts that will be discussed.

Laptop Requirements

Important! Bring your own system configured according to these instructions!

A properly configured system is required to fully participate in this course. If you do not carefully read and follow these instructions, you will likely leave the class unsatisfied because you will not be able to participate in hands-on exercises that are essential to this course. Therefore, we strongly urge you to arrive with a system meeting all the requirements specified for the course.

Your host operating system must be either the latest version of Windows 10, macOS 10.15.x or later, or Linux that also can install and run VMware virtualization products described below. You also must have 8 GB of RAM or higher for the VM to function properly in the class.

It is critical that your CPU and operating system support 64-bit so that our 64-bit guest virtual machine will run on your laptop.

In addition to having 64-bit capable hardware, AMD-V, Intel VT-x, or the equivalent must be enabled in BIOS/UEFI.

Please download and install either VMware Workstation Pro 15.5.X+, VMware Player 15.5.X+ or Fusion 11.5+ on your system prior to the beginning of class. If you do not own a licensed copy of VMware Workstation or Fusion, you can download a free 30-day trial copy from VMware. VMware will send you a time-limited serial number if you register for the trial on its website.


CPU: 64-bit 2.0+ GHz processor or higher-based system is mandatory for this class (Important - Please Read: a 64-bit system processor is mandatory)

BIOS/UEFI: VT-x, AMD-V, or the equivalent must be enabled in the BIOS/UEFI

RAM: 8 GB (gigabytes) of RAM or higher is mandatory for this class (Important - Please Read: 8 GB of RAM or higher is mandatory)

Disk: 25 gigabytes of free disk space

Note: Apple systems using the M1 processor cannot perform the necessary virtualization at this time and cannot be used for this course.


  • Wireless Ethernet 802.11 B/G/N/AC
  • USB-A ports or an adapter to use a USB-A thumb drive if in person (version 3.0 compatibility highly recommended)


  • VMware Workstation, Workstation Player, or Fusion
  • The Linux virtual machine will be provided to students


Please verify before coming to class that you have the administrative permissions required to transfer a virtual machine from a USB drive to your hard disk and start it. Also verify that Windows Device Guard, DLP, or other host-based protections will not interfere with the USB transfer or VM startup. (This is a common issue with company-built PCs, so if you intend to bring a corporate laptop, please test this before the event.)

Your course media will now be delivered via download. The media files for class can be large, some in the 40 - 50 GB range. You need to allow plenty of time for the download to complete. Internet connections and speed vary greatly and are dependent on many different factors. Therefore, it is not possible to give an estimate of the length of time it will take to download your materials. Please start your course media downloads as you get the link. You will need your course media immediately on the first day of class. Waiting until the night before the class starts to begin your download has a high probability of failure.

SANS has begun providing printed materials in PDF form. Additionally, certain classes are using an electronic workbook in addition to the PDFs. The number of classes using eWorkbooks will grow quickly. In this new environment, we have found that a second monitor and/or a tablet device can be useful by keeping the class materials visible while the instructor is presenting or while you are working on lab exercises.

Author Statement

"Written to compliment my first SOC course (SEC450: Blue Team Fundamentals), MGT551 completes the security operations picture by introducing the best higher-level frameworks and organization tactics I've discovered throughout my career as a SOC analyst and manager for a large pharmaceutical company. By including hands-on application with state of the art open-source tools and methods for security operations, MGT551 delivers the complete package for SOC leaders. This course condenses years of knowledge and real-life experience with months of additional research to bring you the most important information to effectively and efficiently lead your security team to success." - John Hubbard

"As someone who has been the victim of less than ideal processes, tools, and team structure, my goal with this course is to help ensure every organization's blue team runs at peak efficiency and capability regardless of size and resources, and that no one must suffer through repeating mistakes so commonly made within the industry. This course is the culmination of 20 years of supporting, building, and leading security operations and I am incredibly excited to bring it to the SANS community." - Mark Orlando

"[I] would and will recommend this course to some of my peers. I have been a security sales engineer for so many years, but was missing customer pain or customer side knowledge. This course has been spot on so far!" - Moises Acevedo, Recorded Future


I would recommend this course to anyone running a security operations team. I'd further recommend it to more experienced analysts so they can begin to see the bigger picture.
Robert Wilson
University of South Carolina
This is a great management course for both those in start-up SOCs as well as established SOCs. As a newer leader myself, I found a lot of value in the leadership training as well.
Joel Kociemba
Directly applicable content and I have written down so many ideas.
Garry Byrne
Tesco Plc

    Register for MGT551

    • In Person

    Training events and topical summits feature presentations and courses in classrooms around the world.

    Learn more
    • Live Online

    Live, interactive sessions with SANS instructors over the course of one or more weeks, at times convenient to students worldwide.

    Learn more
    • OnDemand

    Study and prepare for GIAC Certification with four months of online access. Includes labs and exercises, and support.

    Learn more