Training
Featured Course View All Courses
Get a Free Hour of SANS Training

Experience SANS training through course previews.

Learn More
Learning Paths
FeaturedView all Focus Areas
NEW - AI Security Training
Can't find what you are looking for?

Let us help.

Contact us
Free Resources

SANS Community Benefits

Connect, learn, and share with other cybersecurity professionals

Customer Case Studies

Discover how organizations and individual cyber practitioners use SANS training and GIAC certifications

AI Risk & Readiness

Explore expert-driven guidance, training, and tools to help defend against AI-powered threats and adopt AI securely

Join the SANS Community

Become a member for instant access to our free resources.

Sign Up
For Organizations

Public Sector

Mission-focused cybersecurity training for government, defense, and education

Partnerships

Explore industry-specific programming and customized training solutions

Sponsorship Opportunities

Sponsor a SANS event or research paper

Interested in developing a training plan to fit your organization’s needs?

We're here to help.

Contact Us
Group Purchasing
Group Purchasing

SEC555 Live Online February

  • Mon, Feb 8 - Fri, Feb 12, 2027
  • 1 Course
  • English
Virtual (ET)
SEC555: SIEM with Tactical Analytics
  • 5-Day Course: February 8 – 12, 2027

    Earn 30 CPEs.

  • GIAC Certified Detection Analyst

    (GCDA)

    Learn about certification.

  • Intermediate Skill Level

    Course material is geared for cybersecurity professionals with hands-on experience.

  • 18 Hands-On Labs

    Apply what you learn with hands-on exercises and labs.

Jump to:

SEC555: Detection Engineering and SIEM Analytics - Live Online with Course Author Nick Mitropoulos

Security operations does not have a data problem. It has an analysis problem. The logs are already flowing; the question is whether anything in them would tell you an attack was underway.

SEC555 is five days of live, virtual instruction on building detections that answer that question. You construct your own detection lab, learn to read logs for what they actually contain, write rules that fire on the behavior you meant to catch, and build a pipeline that gets new content into production without a six-week wait. Cloud and on-premises sources are treated as one problem, because that is how they arrive.

During the week, you'll work through:

  • 18 hands-on labs
  • A team-based Defend the Flag capstone
  • DeTTECT data source gap analysis and honeypot deployment
  • DNS, HTTP, Windows, and auditd log investigation exercises
  • Cobalt Strike beaconing detection and malicious PowerShell identification
  • Microsoft Sentinel, KQL, CloudTrail, and CloudWatch configuration and testing

AI-Assisted Detection Engineering

The final section covers automated detection engineering pipelines, CI/CD workflows for detection content, and using large language models to assist rule authoring without handing over the judgment. 30 CPE credits, aligned to the GIAC Certified Detection Analyst (GCDA) certification.

Who Should Take This Course?

Detection engineers and detection analysts, SOC and security analysts, security engineers, threat hunters, incident responders, and security architects who own monitoring coverage. A working understanding of TCP/IP, logging methods, and operating system fundamentals is the baseline.

Students Say

  • Slide 1 of 4
    SEC555 teaches excellent, pertinent information along with practical, easy-to-follow lab exercises. A tremendously valuable course!
    Travis LogueCoinstar
  • Slide 2 of 4
    This course uses real-world events and hands-on training to allow me to immediately improve my organization’s security stance. Day one back in the office I was implementing what I learned.
    Frank Giachino Bechtel
  • Slide 3 of 4
    The course content is simply incredible, and I will likely be referencing it for years to come! Also, the provided VM is top notch. The labs were really informative.
    Joseph R.U.S. Army
  • Slide 4 of 4
    Overall, this course taught me so much about using a SIEM. I had limited knowledge and skill on using our Security Onion setup, but this course helped developed them with the techniques and concepts taught. It also told me about tools I didn't know we had in our setup. Everyone I work with is rather new to the defensive cybersecurity realm, so there's been a lot to learn.
    Oscar G.U.S. Army
Slide 1 of 0

Download the Course Syllabus or Letter to Justify this Training to Your Manager

To learn more about SEC555, business takeaways, laptop requirements and more, please visit the course page.

Early Bird Offer

Save $500 USD using the code "EarlyBirdNA" and pay for any 4-6 day course (excluding Beta Courses and 300 Level Courses) by December 24, 2026.

Courses

Looking for Group Purchasing? Contact Sales

GIAC Certification Exam Attempt

2 Free practice tests when you add a certification exam attempt to your course. Available for select courses below.

Extra 120 Days of Course Access

Add OnDemand Extended Access for 120 days to help you prepare for your GIAC exam. Available for select courses below.

Featured Speaker

Nick Mitropoulos
Nick Mitropoulos

Nick Mitropoulos

CEO at Scarlet Dragonfly

Nick Mitropoulos is a SANS Certified Instructor and author of SEC555: Detection Engineering and SIEM Analytics. As CEO of Scarlet Dragonfly and a veteran of SOC and incident response leadership, he equips students with real-world skills in detection engineering. Nick also serves on the GIAC Advisory Board, SANS CISO Network, and faculty of the SANS Technology Institute.

Read more about Nick Mitropoulos

Three Reasons to Train Virtually

  • Ultimate Convenience

    Eliminate the hassle of daily commutes and wasted travel time. You’ll have everything you need right from your home.

  • Personalization

    Hands-on learning with the opportunity to ask questions and receive instant feedback from world-renowned experts. Afterward, reinforce your skills with 4-months of access to daily course lecture archives.

  • Hands-On Labs

    Learn cutting-edge cybersecurity knowledge with hands-on labs that provide you with techniques you can immediately use in your organization.

Woman at Laptop

Frequently Asked Questions

SEC555 Live Online February is taught live in Eastern Time from February 8-12, 2027. Seven days before class, download your digital materials and run the Test Connection check under SANS Live Online in your SANS Account; printed books ship to your registration address about 14 days ahead. Class chat and help run through your course Slack channel.

Other questions are answered in the SANS Live Training FAQ.

Yes. Course author Nick Mitropoulos, CEO of Scarlet Dragonfly, teaches SEC555 live online February 8-12, 2027, in Eastern Time: five days and 30 CPEs, aligned with GIAC Certified Detection Analyst (GCDA).

How to tell whether the logs you already collect would reveal an attack, and how to write detections that would, across Microsoft Sentinel, KQL, CloudTrail, CloudWatch, and on-premises sources.

The final section covers CI/CD pipelines for detection content and using large language models to help write rules, while the analyst keeps the judgment calls.

Detection engineers, SOC analysts, threat hunters, incident responders, and architects who own monitoring coverage. A working understanding of TCP/IP, logging, and operating systems is the baseline.