LDR551: Building and Leading Security Operations Centers

GIAC Security Operations Manager (GSOM)
GIAC Security Operations Manager (GSOM)
  • In Person (5 days)
  • Online
30 CPEs

** USE THIS VERSION FOR CLASSES AFTER AUGUST 31, 2023 ** Information technology is so tightly woven into the fabric of modern business that cyber risk has become business risk. SOC teams are facing more pressure than ever before to help manage this risk by identifying and responding to threats across a diverse set of infrastructures, business processes, and users. Furthermore, a SOC manager is in the unique position of having to bridge the gap between business processes and the highly technical work that goes on in the SOC. MGT551 students will learn how to design their defenses around their unique organizational requirements and risk profile. We will give you the tools to build an intelligence-driven defense, measure progress towards your goals, and develop more advanced processes like threat hunting, active defense, and continuous SOC assessment. 15 Hands-On Exercises

What You Will Learn

IMPORTANT NOTICE: SANS is in process of changing course prefixes from “MGT” to “LDR”. There is no change in course content or pricing. MGT551 will run through August 31, 2023, then LDR551 will run thereafter. Course books may reflect the “MGT” prefix even for "LDR" classes of the course during the transition. If you would like to take the course before August 31, 2023 or via OnDemand, please visit the MGT551 course page.

SOC managers must show alignment to the business and demonstrate real value - a challenge when the threats are constantly changing and sometimes unseen. Managing a security operations center (SOC) requires a unique combination of technical knowledge, management skills, and leadership ability. LDR551 bridges gaps by giving students the technical means to build an effective defense and the management tools to build an effective team. Common questions SOC managers face are:

  • How do we know our security teams are aligned to the unique threats facing our organization?
  • How do we get consistent results and prove that we can identify and respond to threats in time to minimize business impact?
  • How can we build an empowering, learning environment where analysts can be creative and solve problems while focusing on the mission at hand?

Whether you are looking to build a new SOC or take your current team to the next level, LDR551 will super-charge your people, tools, and processes. Each section of LDR551 is packed with hands-on labs and introductions to some of the industry's best free and open source tools, and each day concludes with Cyber42 SOC leadership simulation exercises. Students will learn how to combine SOC staff, processes, and technology in a way that promotes measurable results and covers all manner of infrastructure and business processes. Most importantly, students will learn how to keep the SOC growing, evolving, and improving over time.

"There are so many [organizations] that seem to be trying to reinvent the wheel. All they need to do is invest in this course for real world, actionable information that can put them on a solid path toward building, staffing, and leading their own SOC." - Brandi Loveday-Chelsey

Business Takeaways

  • Strategies for aligning cyber defense to organizational goals
  • Tools and techniques for validating security tools and processes
  • Methodologies for recruiting, hiring, training, and retaining talented defenders & Effective management and leadership techniques for technical teams
  • Practical approaches to optimizing security operations that can be applied immediately

Skills Learned

  • Collecting the most important logs and network data
  • Building, training, and empowering a diverse team
  • Creating playbooks and managing detection use cases
  • Using threat intelligence to focus your budget and detection efforts
  • Threat hunting and active defense strategies
  • Implementing efficient alert triage and investigation workflow
  • Effective incident response planning and execution
  • Choosing metrics and long-term strategy to improve the SOC
  • Team member training, retention, and prevention of burnout
  • SOC assessment through capacity planning, purple team testing, and adversary emulation

Hands-On SOC Manager Training

While this course is focused on management and leadership, it is by no means limited to non-technical processes and theory. The course uses the Cyber42 interactive leadership simulation game to put you in real-world scenarios that spur discussion and critical thinking of situations that you will encounter at work. Throughout the five days of instruction, students will work on fifteen hands-on exercises covering everything from playbook implementation to use case database creation, attack and detection capability prioritization and visualization, and purple team planning, threat hunting, and reporting. Attendees will leave with a framework for understanding where a SOC manager should be focusing efforts, how to track and organize defensive capabilities, and how to drive, verify, and communicate SOC improvements.

  • Section 1: Threat actor assessment, Attack path development, Developing and implementing SOC playbooks
  • Section 2: Attack tree assessment, Visualizing attack techniques and security controls, Writing priority intelligence requirements
  • Section 3: SOC capacity planning; Structuring, documenting, and organizing Use Cases; Planning a threat hunt
  • Section 4: Designing table-top exercises, Planning incident response using RE&CT, Investigating quality control
  • Section 5: Building a skills self-assessment and training plan; Creating, classifying, and communicating your metrics; Purple team assessment

"The labs are great in walking you through practical activities." - Sean Mitchell, Babcock International

"Great labs - will use these a lot." - Andrew Head, dentsu

"[I] liked the Cyber42 game activities as they enforce the concepts learned during the day." - Ilyas Khan, Ericsson

"The exercises while mostly non-technical triggered the thinking process to ensure that all aspects for the building of a SOC are in place."- Wee Hian Peck, INTfinity Consulting PL

Syllabus Summary

  • Section 1: LDR551 starts with the critical elements necessary to build your Security Operations Center: understanding your enemies, planning your requirements, making a physical space, building your team, and deploying a core toolset.
  • Section 2: Section 2 focuses on building a threat model that includes attacker tactics, techniques, and procedures and how we might identify them in our environment, as well as defensive theory and mental models that can guide our assessment and planning efforts, data collection and monitoring priorities, and cyber threat intelligence collection.
  • Section 3: Section 3 is all about utilizing the monitoring approach and threat model developed on Day 2, from alert triage to analytic design to SOC capacity planning and active defense.
  • Section 4: From toolsets to proven frameworks to tips and tricks learned in countless real-world scenarios, section four covers the full response cycle, from preparation to identification to containment, eradication, and recover, for operations managers.
  • Section 5: The fifth and final section of LDR551 is all about measuring and improving security operations. We focus on three areas: developing and improving people, measuring SOC performance, and continuous validation through assessment and adversary emulation.

Additional Free Resources

What You Will Receive

  • Custom distribution of the Linux Virtual Machine containing free open-source SOC tools
  • MP3 audio files of the complete course lecture
  • Printed and Electronic Courseware
  • A digital download package that includes the above and more

What Comes Next

Syllabus (30 CPEs)

Download PDF
  • Overview

    MGT551 starts with the critical elements necessary to build your Security Operations Center: understanding your enemies, planning your requirements, making a physical space, building your team, and deploying a core toolset. Throughout this course section, students will learn how to build a strong foundation upon which an SOC can operate, focusing first on the most important users and data, and tailoring defense plans to threats most likely to impact your organization. Through workflow optimization, information organization, and data collection, you will learn how to ensure that your security operations will hit the ground running as efficiently as possible while protecting privileged SOC users and data. Exercises show how to implement these concepts through threat group and asset profiling, mapping likely attack paths into your environment, and implementing use cases repeatable playbooks to identify the threats and attack vectors you have identified.

    • Threat actor assessment
    • Attack path development
    • Developing and implementing SOC playbooks


    • What we are up against/industry surveys
    • The average SOC
    • What top-performing SOCs have in common
    • SOC trends
    • Class goals

    SOC Functions

    • High-level SOC diagram
    • SOC functions
    • Core activities
    • Auxiliary functions

    SOC Planning

    • Do you need a dedicated internal SOC?
    • What is and what is not a SOC?
    • Mission and purpose
    • Requirements
    • Standards and frameworks
    • Policies
    • Roles
    • Staffing levels
    • Constituency
    • Steering committee
    • Services/Capabilities
    • Charter

    Team Creation, Hiring, and Training

    • Organizational charts
    • Choosing a tiered vs. tierless SOC
    • Building a dream team
    • Interviewing tips and techniques
    • Interviewing mistakes and avoiding bias
    • Training plans

    Building the SOC

    • Physical space
    • Analyst/SOC IT considerations
    • Protecting SOC data

    SOC Tools and Technology

    • Foundational network and endpoint collection and detection technologies
    • "Next-gen" must-have capabilities
    • Advanced detection technologies
    • Analyst core toolset
    • Live response tools
    • Playbooks and SOAR
    • Planning tools and frameworks

    SOC Enclave and Networking

    • Requirements for SOC connectivity
    • Protecting SOC Data
    • SOC networking
    • SOC data flow
  • Overview

    Section 2 of MGT551 focuses on expanding our understanding of attacker tactics, techniques, and procedures and how we might identify them in our environment. We will discuss defensive theory and mental models that can guide our assessment and planning efforts, data collection and monitoring priorities, and cyber threat intelligence collection. We will also cover more specialized security monitoring use cases like DevOps, supply chain, insider threat, and business e-mail compromise. Exercises include using the MITRE ATT&CK framework to plan security data collection and writing solid threat intelligence requirements for relevant, timely information that answers your most pressing defensive questions.

    • Attack Tree Assessment
    • Visualizing Attack Techniques and Security Controls
    • Writing Priority Intelligence Requirements

    Cyber Defense Theory and Mental Models

    • Ops Tempo and the OODA Loop
    • Threat modeling
    • MITRE ATT&CK/Kill Chain
    • Threat Intel - F3EAD
    • Pyramid of pain and analytic types
    • The SOC as an "infinite game"

    Prevention and the Future of Security

    • Defensible network architecture
    • Hardening at the network and host level
    • Zero trust best practices
    • Identity security
    • Balancing productivity and security

    SOC Data Collection

    • The SOC data collection system
    • Open-source NSM and host-data tools
    • Collection issues
      • Tactical log collection
      • Audit policy flexibility
      • Most important data sources
      • How to collect data
      • Parsing, filtering, enrichment, and storage
    • Secure protocols and encrypted traffic analysis

    Other Monitoring Use Cases

    • DevOps telemetry
    • Chaos engineering and security monitoring
    • Supply chain security
    • Business e-mail compromise
    • Insider threat
    • Major breach case studies

    Using MITRE ATT&CK to Plan Collection

    • Key data sources
    • Defense mapping
    • Assessing your capabilities using DETT&CT

    Cyber Threat Intelligence

    • Threat intelligence types and sources
    • Consuming and producing intelligence
    • Mental models for threat intel
    • Intel transport and use
    • Threat intelligence platforms and integration

    Practical Collection Concerns

    • Security data collection
    • Parsing, filtering, categorization, and normalization
    • Data enrichment
    • Storage and indexing
  • Overview

    Section 3 of MGT551 is all about improving detections. We begin with effective triage and analysis and then move to more effective alerting mechanisms, starting with the fundamentals of analytic design. We will discuss detection engineering as a core SOC discipline to be planned, tracked, and measured. You will learn a repeatable, data-driven approach to SOC capacity planning and apply that process in a hands-on exercise using custom tools that you can take back to your own environment. We will also cover the different types of proactive threat hunting, see a structured approach that results in measurable improvements to your detection capability, and apply that approach in a hands-on threat hunting lab. Finally, we will look at active defense concepts and their role in a mature security operations capability. Taking the tools, processes, and concepts from section 3 of MGT551 back to your SOC will ensure that no (virtual) stone in your environment remains unturned.

    • SOC Capacity Planning
    • Structuring, Documenting, and Organizing Use Cases
    • Planning a Threat Hunt

    Efficient Alert Triage

    • Triage approach in various SOC staffing models
    • Where to triage alerts
    • What analysis must know
    • Prioritizing sensitive and high-risk accounts
    • Data classification

    Capacity Planning

    • Basic and complicating factors in triage capacity planning
    • Estimating workload
    • Factors contributing to alert count
    • Determining the "right" number of alerts
    • Approaches for handling excessive alerts

    Detection Engineering

    • SOC threat detection systems
    • Analytic outcomes and tuning
    • Writing high-fidelity rules
    • Use case tracking and storage
    • Risk-based scoring and alert aggregation

    Analytic and Analysis Frameworks and Tools

    • Blue team knowledge standardization and upcoming tools
    • ATT&CK Navigator
    • Yara
    • Sigma
    • Jupyter notebooks
    • Detection testing labs

    Threat Hunting

    • What is threat hunting and why is it needed?
    • Scheduling
    • Data quality
    • Hunting process and techniques
    • Hunting maturity model
    • Showing the value of threat hunting

    Active Defense

    • What is active defense/deception?
    • Active defense techniques and goals
    • Active defense tooling

  • Overview

    From toolsets to proven frameworks to tips and tricks learned in countless real-world scenarios, section four covers the full response cycle, from preparation to identification to containment, eradication, and recovery, for operations managers. The fourth section of MGT551 begins with the fundamentals of investigation: effective triage, investigative mindset, and tools for avoiding bias. Then the focus turns to preparing your environment to be defended by deploying security controls, identifying high-value assets and users, and designing playbooks to guide your response efforts. Finally, we will review best of breed incident response tools and free frameworks to guide your planning. Lab exercises in section four include incident response playbook design using the free RE&CT framework, investigation review and quality control, and tabletop exercise development.

    • Designing Tabletop Exercises
    • Planning Incident Response Using RE&CT
    • Investigation Quality Control


    • Investigation mindset
    • Avoiding bias
    • Analysis of Competing Hypothesis
    • Useful investigative techniques

    Incident Response (IR) Planning

    • IR policy, plans, and procedures
    • Staffing for IR
    • Communication guidelines and methods
    • Incident response procedure overview


    • Defensible network architecture
    • The Center for Internet Security (CIS) Controls
    • Securing high-value assets
    • Incident response procedures
    • Developing IR playbooks using RE&CT
    • Incident response communications

    Identification, Containment, and Eradication

    • When to call incident
    • Triggering the incident response process and assembling the team
    • Incident categorization
    • Data acquisition
    • Containment procedures
    • Incident documentation
    • Preparing your IR "go bag"
    • Threat eradication
    • Preserving evidence and engaging law enforcement

    Recovery and Post-Incident

    • Writing the incident report
    • Collecting intelligence
    • Additional logging during and after incidents
    • IR plan improvement

    Incident Response in the Cloud

    • Preparing your cloud environment for detection and response
    • Containment in the cloud

    Dealing with a Breach

    • Crisis management process and key functions
    • Crisis communications
    • Breach case studies

    IR Tools

    • EDR, NDR, and XDR
    • Windows Management Instrumentation and command line incident response
    • Live response tools
    • Forensic analysis tools
    • Malware analysis tools

    Continuous Improvement

    • Collaborative problem solving
    • Improving shared knowledge
    • Designing tabletop exercises
  • Overview

    The fifth and final section of MGT551 is all about measuring and improving security operations. We focus on three areas: developing and improving people, measuring SOC performance, and continuous validation through assessment and adversary emulation. We will also cover some of the more challenging elements of managing people in a dynamic and often high-pressure environment: building the right culture, addressing damaging behaviors, and handling common pitfalls of daily operations. By demonstrating value through structured testing and fostering a culture of learning, collaboration, and continuous improvement, we can ensure long term growth and success. In section five, you'll receive the tools, techniques, and insights to do just that. Hands-on exercises will include building skills self-assessments and training plans for your analysts, designing SOC metrics, and continuous assessment and validation.

    • Building a Skills Self-Assessment and Training Plan
    • Creating, Classifying, and Communicating Your Metrics
    • Purple Team Assessment

    Staff Retention and Mitigation of Burnout

    • Cultivating intrinsic motivation in your team
    • SOC human capital model
      • Growth, skills, empowerment, and creativity
      • Automation, Ops efficiency, management/metrics
    • Burnout mitigation tactics for new and experienced analysts
    • Optimizing tasks for analyst growth
    • Performance management

    Metrics, Goals, and Effective Execution

    • Daily Ops vs. initiatives
    • Metrics vs. KPIs. vs. OKRs
    • Selecting Metrics

      • Metrics sampling rates
    • Selecting KPIs

      • Organizing operational measures
    • Creating OKRs
    • Successful execution
      • Metrics types
      • Goal setting
      • Acting on the right metrics
      • Scoreboards
      • Keeping a cadence of accountability

    Measurement and Prioritization Issues

    • Levels and types of measurement
    • The downside of risk matrices and CVSS scoring
    • The right kinds of measurements
    • Quantitative and qualitative measurement with examples

    Strategic Planning and Communications

    • Building a strategic SOC plan
    • Executing your strategic plan
    • Maintaining direction, alignment, and commitment
    • Measuring SOC maturity with SOC-CMM
    • Storytelling and visualization in security

    Analytic Testing and Adversary Emulation

    • Analytic testing
      • Analytic testing tools
      • Automated assessments
    • Penetration testing, red teaming, and adversary emulation
    • Purple team vs. red team execution and benefits
    • Purple teaming
      • Benefits
      • Methodology and execution
      • Reporting and tracking tools

    Automation and Analyst Engagement

    • Types of automation
    • A 5-step approach to applying automation in the SOC
    • Automating SOC workflows with SOAR
    • Six sigma concepts
    • Gamification of SOC tasks and workflows
    • Optimizing for continuous engagement

GIAC Security Operations Manager

The GSOM certification validates a professional’s ability to run an effective security operations center. GSOM-certified professionals are well-versed in the management skills and process frameworks needed to strategically operate and improve a SOC and its team.

  • Designing, planning, and managing an effective SOC program 
  • Prioritization and collection of logs, development of alert use cases, and response playbook generation 
  • Selecting metrics, analytics, and long-term strategy to assess and continuously improve SOC operations
More Certification Details


This course does not have any specific prerequisites, but it is suggested that students have some experience in an operational security role. SANS courses such as SEC450: Blue Team Fundamentals: Security Operations and Analysis or MGT512: Security Leadership Essentials for Managers will give students a solid base-level understanding of the concepts that will be discussed.

Laptop Requirements

Important! Bring your own system configured according to these instructions.

A properly configured system is required to fully participate in this course. If you do not carefully read and follow these instructions, you will not be able to fully participate in hands-on exercises in your course. Therefore, please arrive with a system meeting all of the specified requirements.

Back up your system before class. Better yet, use a system without any sensitive/critical data. SANS is not responsible for your system or data.

  • CPU: 64-bit Intel i5/i7 (8th generation or newer), or AMD equivalent. A x64 bit, 2.0+ GHz or newer processor is mandatory for this class.
  • CRITICAL: Apple systems using the M1/M2 processor line cannot perform the necessary virtualization functionality and therefore cannot in any way be used for this course.
  • BIOS settings must be set to enable virtualization technology, such as "Intel-VTx" or "AMD-V" extensions. Be absolutely certain you can access your BIOS if it is password protected, in case changes are necessary.
  • 8GB of RAM or more is required.
  • 80GB of free storage space or more is required.
  • At least one available USB 3.0 Type-A port. A Type-C to Type-A adapter may be necessary for newer laptops. Some endpoint protection software prevents the use of USB devices, so test your system with a USB drive before class.
  • Wireless networking (802.11 standard) is required. There is no wired Internet access in the classroom.
  • Your host operating system must be the latest version of Windows 10, Windows 11, or macOS 10.15.x or newer.
  • Fully update your host operating system prior to the class to ensure you have the right drivers and patches installed.
  • Linux hosts are not supported in the classroom due to their numerous variations. If you choose to use Linux as your host, you are solely responsible for configuring it to work with the course materials and/or VMs.
  • Local Administrator Access is required. (Yes, this is absolutely required. Don't let your IT team tell you otherwise.) If your company will not permit this access for the duration of the course, then you should make arrangements to bring a different laptop.
  • You should ensure that antivirus or endpoint protection software is disabled, fully removed, or that you have the administrative privileges to do so. Many of our courses require full administrative access to the operating system and these products can prevent you from accomplishing the labs.
  • Any filtering of egress traffic may prevent accomplishing the labs in your course. Firewalls should be disabled or you must have the administrative privileges to disable it.
  • Download and install VMware Workstation Pro 16.2.X+ or VMware Player 16.2.X+ (for Windows 10 hosts), VMware Workstation Pro 17.0.0+ or VMware Player 17.0.0+ (for Windows 11 hosts), or VMWare Fusion Pro 12.2+ or VMware Fusion Player 11.5+ (for macOS hosts) prior to class beginning. If you do not own a licensed copy of VMware Workstation Pro or VMware Fusion Pro, you can download a free 30-day trial copy from VMware. VMware will send you a time-limited serial number if you register for the trial at their website. Also note that VMware Workstation Player offers fewer features than VMware Workstation Pro. For those with Windows host systems, Workstation Pro is recommended for a more seamless student experience.
  • On Windows hosts, VMware products might not coexist with the Hyper-V hypervisor. For the best experience, ensure VMware can boot a virtual machine. This may require disabling Hyper-V. Instructions for disabling Hyper-V, Device Guard, and Credential Guard are contained in the setup documentation that accompanies your course materials.
  • Download and install 7-Zip (for Windows Hosts) or Keka (for macOS hosts). These tools are also included in your downloaded course materials.

Your course media is delivered via download. The media files for class can be large. Many are in the 40-50GB range, with some over 100GB. You need to allow plenty of time for the download to complete. Internet connections and speed vary greatly and are dependent on many different factors. Therefore, it is not possible to give an estimate of the length of time it will take to download your materials. Please start your course media downloads as soon as you get the link. You will need your course media immediately on the first day of class. Do not wait until the night before class to start downloading these files.

Your course materials include a "Setup Instructions" document that details important steps you must take before you travel to a live class event or start an online class. It may take 30 minutes or more to complete these instructions.

Your class uses an electronic workbook for its lab instructions. In this new environment, a second monitor and/or a tablet device can be useful for keeping class materials visible while you are working on your course's labs.

If you have additional questions about the laptop specifications, please contact laptop_prep@sans.org

Author Statement

"Written to compliment my first SOC course (SEC450: Blue Team Fundamentals), MGT551 completes the security operations picture by introducing the best higher-level frameworks and organization tactics I've discovered throughout my career as a SOC analyst and SOC manager for a large pharmaceutical company. By including hands-on application with state of the art open-source tools and methods for security operations, MGT551 delivers the complete package for SOC leaders. This course condenses years of knowledge and real-life experience with months of additional research to bring you the most important information to effectively and efficiently lead your security team to success." - John Hubbard

"As someone who has been the victim of less than ideal processes, tools, and team structure, my goal with this course is to help ensure every organization's blue team runs at peak efficiency and capability regardless of size and resources, and that no one must suffer through repeating mistakes so commonly made within the industry. This course is the culmination of 20 years of supporting, building, and leading security operations and I am incredibly excited to bring it to the SANS community." - Mark Orlando

"[I] would and will recommend this course to some of my peers. I have been a security sales engineer for so many years, but was missing customer pain or customer side knowledge. This course has been spot on so far!" - Moises Acevedo, Recorded Future

Register for LDR551