SEC555 Live Online February

SEC555: Detection Engineering and SIEM Analytics - Live Online with Course Author Nick Mitropoulos

Security operations does not have a data problem. It has an analysis problem. The logs are already flowing; the question is whether anything in them would tell you an attack was underway.

SEC555 is five days of live, virtual instruction on building detections that answer that question. You construct your own detection lab, learn to read logs for what they actually contain, write rules that fire on the behavior you meant to catch, and build a pipeline that gets new content into production without a six-week wait. Cloud and on-premises sources are treated as one problem, because that is how they arrive.

During the week, you'll work through:

• 18 hands-on labs
• A team-based Defend the Flag capstone
• DeTTECT data source gap analysis and honeypot deployment
• DNS, HTTP, Windows, and auditd log investigation exercises
• Cobalt Strike beaconing detection and malicious PowerShell identification
• Microsoft Sentinel, KQL, CloudTrail, and CloudWatch configuration and testing

AI-Assisted Detection Engineering

The final section covers automated detection engineering pipelines, CI/CD workflows for detection content, and using large language models to assist rule authoring without handing over the judgment. 30 CPE credits, aligned to the GIAC Certified Detection Analyst (GCDA) certification.

Who Should Take This Course?

Detection engineers and detection analysts, SOC and security analysts, security engineers, threat hunters, incident responders, and security architects who own monitoring coverage. A working understanding of TCP/IP, logging methods, and operating system fundamentals is the baseline.

Download the Course Syllabus or Letter to Justify this Training to Your Manager

• Syllabus
• Course justification letter

To learn more about SEC555, business takeaways, laptop requirements and more, please visit the course page.