SEC598: AI and Security Automation for Red, Blue, and Purple Teams

Overview

This section establishes the strategic and technical foundation of the course. We explore why AI and automation have become essential to modern security operations and how they enable security teams to move from reactive to proactive, adaptive operations. You will learn how AI impacts security both defensively and offensively, and how automation frameworks can be applied across enterprise SOCs.

A major highlight of this section is the Globex Automation environment, which simulates hybrid cloud environments, SOC workflows, and automation infrastructure at scale. Students will implement Ansible for policy-as-code to manage configuration baselines, build CI/CD pipelines for detection-as-code, and create initial automation triggers to kickstart AI-driven workflows. In the last modules, SEC598 covers the foundations of detection-as-code, Generative AI, and LLMs to enhance your security capabilities.

Full Lab Details

• Lab 1.1: One Bucket Is All It Takes: Execution of offensive techniques and cloud misconfiguration detections
• Lab 1.2: OS Hardening Baselines with Ansible: Deploy security configuration at scale
• Lab 1.3: Link Triggers to Automation Script: Build automated security workflows
• Lab 1.4: Intro to LLM and RAG: Explore large language models in enrichment workflows
• Lab 1.5: Detection as Code I: Write a Detection Rule Using LLM

Full Topics Details

• Why Security Automation and AI Matter
• Drivers behind SOC automation and AI adoption
• Challenges in scaling security operations and talent gaps
• Policy-as-Code and Secure Configuration Management
• Automating baselines with Ansible
• Enforcing consistent security policies across hybrid environments
• Define desired state configuration and monitor compliance
• CI/CD for Security Engineering
• Introduction to DevOps for Cyber Security
• Version-controlled detection logic and deployment pipelines
• Automating detection and response workflows at scale
• Triggers for automation
• Standardized automation workflows
• Common triggers used for automation
• Automation Playbooks:
• Introduction to modular, reusable automation workflows
• Integrating APIs and security platforms for automated orchestration
• Foundations of GenAI and LLMs
• Applying LLMs for enrichment, detection, and purple teaming use cases
• Understanding the different LLM models and RAG-based solutions
• Detection Engineering for Purple Teams
• Leveraging offensive insights for defensive detection logic
• Building and deploying detection-as-code pipelines at scale

Overview

Section 2 builds on foundational automation principles and applies them across multiple technologies commonly used in modern SOCs. Students start with PowerShell to automate baseline configuration and extend its application to both blue team hardening and red team simulation tasks. The module then moves to Infrastructure as Code (IaC) using Terraform, focusing on secure cloud provisioning and repeatable deployments that integrate easily into CI/CD pipelines.

To validate automation workflows, students will build firing ranges using Terraform and Ansible, enabling safe, repeatable testing of detection pipelines and security controls. Next, students leverage Python and Jupyter notebooks to build flexible security automation scripts for enrichment, analysis, and incident response, emphasizing modular and reusable code.

The section concludes with an exploration of SOAR tooling and agentic AI Engineering, demonstrating how to build and automate SOAR playbooks while integrating AI-powered reasoning agents that can autonomously investigate and respond to incidents, closing the gap between detection and response with human-in-the-loop controls.

Full Lab Details

• Lab 2.1: OS Hardening Baselines with PowerShell: Automate Windows host baseline enforcement
• Lab 2.2: Cloud Management with Terraform: Deploy secure hybrid cloud resources
• Lab 2.3: Deploy a Firing Range with Terraform and Ansible: Build repeatable testing environments for SOC workflows
• Lab 2.4: Email Threat Analysis with Jupyter Notebook: Automate phishing email analysis and IOC extraction
• Lab 2.5: Create a Tines Story: Build and automate a SOAR workflow using Tines

Full Topics Details

• Automated Workflows with PowerShell
• Blue team automation for baseline hardening
• Red team use cases for offensive testing
• The Power of Infrastructure as code (IaC)
• Secure, repeatable cloud provisioning with Terraform
• Infrastructure provisioning and configuration management
• Define desired state configuration and monitor compliance
• Building Firing Ranges
• Building your firing range
• Terraform and Ansible-based emulation environments
• Security Automation with Python and Jupyter Notebook
• Enrichment and investigation workflows
• Visualization and modular notebook-driven SOC automation
• SOAR playbook automation engineering
• Define automation workflows
• Comparing current SOAR platforms and their capabilities
• The future of Hyperautomation
• Agentic AI engineering
• Design and define agentic workflows
• Integrating agentic AI for autonomous decision support and response

Overview

Section 3 focuses on building, securing, and automating cloud operations. Students begin with cloud security fundamentals and move to Microsoft Azure, learning to implement Azure Policy and Blueprints to enforce governance and compliance through automation. Azure monitoring, SOAR orchestration with Logic Apps and Functions, and Microsoft AI services are introduced to enhance enrichment and automated decision-making.

For AWS, the section covers AWS Config, Security Hub, Lambda, and Step Functions to enable automated governance, incident response, and integration with third-party APIs. Students explore AWS Bedrock for AI-powered insights and implement continuous security testing using AI-driven automation pipelines.

Finally, students gain offensive perspectives by deploying AI-driven attack agents against Kubernetes environments, providing insights into cloud-native threat simulation and defense validation. This section bridges operational security and offensive simulation, delivering a complete view of how AI and automation are transforming cloud security operations.

Full Lab Details

• Lab 3.1: Create Automated Actions in Azure: Build and trigger automated SOC response workflows using Logic Apps
• Lab 3.2: Cloud-Native IR for Compromised Systems: Automate incident response in Azure and AWS cloud workloads
• Lab 3.3: Integrate AWS with Third-Party API: Extend AWS automation with external data and workflows
• Lab 3.4: Continuous Security Testing Enhanced with AI: Implement GenAI-powered security control validation
• Lab 3.5: Kubernetes Takedown with Offensive AI Agents: Deploy AI-driven attack agents to simulate Kubernetes threats

Full Topics Details

• Cloud Security Fundamentals
• Core cloud security architecture and detection capabilities
• Securing hybrid and multi-cloud environments with automation
• Azure Policy and Blue Printing
• Governance-as-code using Azure Policy and Blueprints
• Infrastructure as code with cloud templates stacks
• Enforcing compliance and deploying secure baseline configurations
• Security Monitoring and Automation in Azure
• Using cloud-native logs, detection tools, and Sentinel
• Building automated detection and response workflows
• SOAR Azure Logic Apps & Functions
• Orchestrating SOC response workflows with native Azure services
• Automated workflows using Azure Logic Apps and Functions
• Intelligent Automation with Microsoft AI Services
• GenAI-powered SOC enhancements for incident investigation
• Azure AI Foundry and agentic AI
• Enrichment and decision support with Microsoft AI and Copilot
• AWS Config and Infrastructure Governance
• Continuous configuration monitoring and compliance enforcement
• Policy-as-code using AWS Config rules and remediations
• Security Monitoring and Automation within AWS
• AWS Security Toolset
• Automating detection and response within AWS
• AWS Lambda and Step Functions
• Serverless orchestration for security automation pipelines
• Event-driven workflows for threat detection and response
• Intelligent Automation with AWS Bedrock
• Leveraging LLMs for threat detection and analysis in AWS
• Building AI-enhanced investigative workflows
• Offensive AWS Agents: Attacking Kubernetes
• Using AI-driven agents to simulate attacks
• Testing defensive readiness and validating detection pipelines

Overview

This section builds a practical skillset for automating offensive security operations and continuously validating defenses. Starting with Introduction to Adversary Emulation & Purple Teaming, students learn how collaborative offensive and defensive testing increases SOC maturity and detection resilience.

Offensive Frameworks & the Power of MITRE ATT&CK demonstrates how ATT&CK provides a structured foundation for adversary emulation, detection mapping, and capability measurement. Adversary Emulation Tooling focuses on operationalizing common frameworks like Atomic Red Team and Caldera to create repeatable and scalable attack simulations.

Technique Chaining with Atomic extends this approach to simulate realistic kill chain scenarios, and Breach and Attack Simulation Tools demonstrate how modern BAS platforms provide continuous and production-safe control validation. The section progresses to Autonomous Adversaries and AI-Powered Attacks, where students learn how attackers are leveraging generative AI for adaptive attacks.

In agentic AI Frameworks: Red Team Agents, students develop CrewAI-based agents capable of autonomous decision-making and execution. Cloud Adversary Emulation focuses on AI-driven offensive operations in cloud-native environments, testing hybrid detections. The final module, Continuous Adversary Emulation via CI/CD, integrates offensive testing into DevSecOps pipelines to create persistent and automated purple teaming feedback loops.

Full Lab Details

• Lab 4.1: Fully Automate Adversary Techniques with Atomic: Build and chain ATT&CK techniques into automated, repeatable attack flows
• Lab 4.2: Using Caldera to Run a Breach Exercise: Execute and orchestrate breach simulation exercises to evaluate SOC detection and response
• Lab 4.3: Red Team Agents with CrewAI: Design and deploy AI-powered red team agents for autonomous offensive testing
• Lab 4.4: Cloud Adversary Simulation with Automated Detections: Launch automated cloud-native attacks to validate detection pipelines
• Lab 4.5: Adversary Emulation as Code using Tines: Embed adversary emulation into CI/CD for continuous testing and validation

Full Topics Details

• Introduction to Adversary Emulation & Purple Teaming
• Fundamentals of adversary emulation and collaborative purple teaming
• Building continuous improvement loops between offensive and defensive teams
• Offensive Frameworks & the Power of MITRE ATT&CK
• Using ATT&CK as a common language for emulation and detection mapping
• Prioritizing emulation activities based on threat intelligence
• Adversary Emulation Tooling
• Overview of Atomic Red Team, Caldera, and BAS platforms
• Creating repeatable emulation campaigns
• Technique Chaining with Atomic
• Automating complex multi-stage attack paths
• Building modular, reusable offensive playbooks
• Breach and Attack Simulation Tools
• Continuous validation of detection and response pipelines
• Leveraging BAS for production-safe testing
• Autonomous Adversaries and AI-Powered Attacks
• Using AI to enhance offensive operations
• Examples of generative AI-driven attack automation
• Agentic AI Frameworks: Red Team Agents
• Building CrewAI agents for autonomous offensive actions
• Enhancing offensive simulation with AI reasoning and tool integration
• Cloud Adversary Emulation
• Simulating attacks on cloud-native platforms and workloads
• Testing cloud detection engineering against modern threats
• Continuous Adversary Emulation via CI/CD
• Automating adversary simulation within DevSecOps pipelines
• Building always-on purple teaming practices

Overview

This section explores how to transform defensive security operations using automation and AI. Introduction to the Modern SOC highlights the evolution of SOC operations and the growing need for automated triage, detection, and response workflows. Automation Priorities in Defensive Security provides a framework for identifying high-value automation opportunities.

Defensible Architectures with Automation focuses on building resilient SOC environments with security automation as a core component, while Detection Engineering and Incident Response demonstrate how detection-as-code and rapid incident handling improve response speed and quality. How to Apply SOAR and SOEL teaches the design of end-to-end security automation pipelines aligned to operational and business processes.

The section also introduces Incident Response Automation Phases and Building Modular Incident Response Playbooks, enabling teams to design reusable, scalable playbooks. AI-infused Detection as Code covers how LLMs accelerate detection engineering pipelines, and operationalizing agentic AI in the SOC demonstrates how autonomous agents can execute enrichment, triage, and decision-support tasks. Finally, Automated Defense vs. Adversarial Automation explores strategies to combat AI-powered adversaries through continuous purple teaming and adaptive response.

Full Lab Details

• Lab 5.1: Automated Triage and Analysis with Velociraptor and Timesketch: Automate forensic triage and timeline analysis workflows.
• Lab 5.2: Create an Incident Response Playbook in PowerShell: Build IR automation using native PowerShell workflows.
• Lab 5.3: Create an Incident Response Playbook in Tines: Implement modular IR workflows using a cloud-native automation platform.
• Lab 5.4: Detection as Code II: LLM-Assisted Detection Testing: Use LLMs to generate and validate detection logic in CI/CD pipelines.
• Lab 5.5: Create an Adversary Emulation & Detection Playbook: Combine offensive simulation with automated defensive response.

Full Topics Details

• Introduction to the Modern SOC
• SOC evolution and intelligence-driven automation
• Overcoming alert fatigue and skill shortages
• Automation Priorities in Defensive Security
• Identifying high-impact automation targets
• Aligning automation to mission objectives
• Defensible Architectures with Automation
• Designing resilient SOC architectures
• Embedding automation for scalable operations
• Detection Engineering and Incident Response
• Implementing detection-as-code pipelines
• Connecting detection to automated IR workflows
• How to Apply SOAR and SOEL
• Building end-to-end incident response workflows
• Aligning automation with business processes
• Incident Response Automation Phases
• Automating enrichment, triage, containment, and recovery
• Leveraging orchestration for rapid response
• Building Modular Incident Response Playbooks
• Creating modular, reusable playbooks
• Designing nested workflows for complex scenarios
• AI-infused Detection as Code
• Accelerating rule generation with LLMs
• Integrating AI logic into CI/CD detection pipelines
• Operationalizing agentic AI in the SOC
• Building autonomous AI-driven SOC agents
• Multi-agent collaboration for triage and decision support
• Automated Defense vs. Adversarial Automation
• Countering AI-enabled adversaries
• Leveraging continuous purple teaming for resilience

Full Topic Details

• Applying Previously Covered Security Controls In-depth
• Applying and fine-tuning detection capabilities and using automation to reduce false/positive ratio
• Configuration management tools
• Infrastructure as code templates
• Tines playbook development
• AWS Configuration rules & ARM templates