$400 Amazon Gift Card with OnDemand Training through March 10 - Learn More!

Instructor-Led Training | Aug 10 ET - Live Online

Virtual, US Eastern | Mon, Aug 10 - Sat, Aug 15, 2020

MGT551: Building and Leading Security Operations Centers Waitlist

Mon, August 10 - Tue, August 11, 2020

Because this course is offered as a beta including discounted pricing, seating is limited to a maximum of two seats per organization. No additional discounts apply.

Are you looking to build, grow, or sharpen your cyber defense team? If so, the new MGT551: Building and Leading Security Operations Centers course is for you. MGT551 is a highly focused two-day crash course in planning, organizing, and improving your security operations. Throughout this course students can expect to learn key factors for success in managing a Security Operations Center (SOC), including:

  • Collecting the most important logs and network data
  • Creating playbooks and using case organization and storage
  • Using threat intelligence to focus your budget and detection efforts
  • Threat hunting and active defense strategies
  • Efficient alert triage and investigation workflow
  • Incident response planning
  • Choosing metrics and goals to improve the SOC
  • Team member hiring, training, retention, and prevention of burnout
  • SOC assessment through purple team testing and adversary emulation

While this course is focused on management and leadership, it is by no means theory only. Throughout the two days of instruction students will work on six hands-on exercises covering everything from playbook implementation to use case database creation, attack and detection capability prioritization and visualization, and purple team planning, execution, and reporting. Attendees will leave with a framework for understanding where their SOC should be focusing its efforts, how to track and organize defensive capabilities, and how to drive, verify, and communicate SOC improvements.


  • Defining Your Assets and Adversaries
  • Developing and Implementing SOC Playbooks
  • Structuring, Documenting, and Organizing Use Cases
  • Prioritizing and Visualizing Attack Techniques and Security Controls
  • Creating, Classifying, and Communicating Your Metrics
  • Purple Team Assessment Planning, Execution, and Tracking


  • Collect the most important logs and network data
  • Create playbooks and use cases
  • Use threat intelligence to focus your budget and detection efforts
  • Implement threat hunting and active defense strategies
  • Develop efficient alert triage and investigation workflow
  • Create effective incident response processes
  • Implement metrics and goals to improve the SOC
  • Conduct effective team member hiring, training, and retention, and prevent burnout
  • Assess your SOC through purple team testing and adversary emulation


  • Custom distribution of the Linux Virtual Machine containing free open-source SOC tools
  • MP3 audio files of the complete course lecture
  • Electronic Courseware
  • A digital download package that includes the above and more

Course Syllabus

John Hubbard
Mon Aug 10th, 2020
9:00 AM - 12:15 PM ET
1:30 PM - 5:00 PM ET


MGT551 starts with the critical elements necessary to build your Security Operations Center: understanding your enemies, planning your requirements, making a physical space, building your team, and planning important data collection. Throughout this course section, students will learn how to build a strong foundation upon which an SOC can operate, including focusing defense on the most important users and data, and tailoring defense plans to high-risk threat groups. Through optimization of workflow, information organization, and data collection, you will learn how to ensure that your security operations will hit the ground running as efficiently as possible. Exercises show how to implement these concepts through threat group and asset profiling, playbook workflow creation and implementation, and the generation and organization of use cases for the SOC.

  • Defining Your Assets and Adversaries
  • Developing and Implementing SOC Playbooks
  • Structuring, Documenting, and Organizing Use Cases

CPE/CMU Credits: 6



  • What we are up against/industry surveys
  • The average SOC
  • What top-performing SOCs have in common
  • SOC trends
  • Class goals

SOC Functions

  • High-level SOC diagram
  • SOC functions
  • Core activities
  • Auxiliary functions

SOC Planning

  • Do you need a dedicated internal SOC?
  • What is and what is not a SOC?
  • Mission and purpose
  • Requirements
  • Standards and frameworks
  • Policies
  • Roles
  • Staffing levels
  • Constituency
  • Steering committee
  • Services/Capabilities
  • Charter

Building the SOC

  • Physical space
  • Analyst/SOC IT considerations
  • Protecting SOC data

SOC Tools and Technology

  • Foundational network and endpoint collection and detection technologies
  • "Next-gen" must-have capabilities
  • Advanced detection technologies
  • Analyst core toolset
  • Playbooks and SOAR

Team Creation, Hiring, and Training

  • Organizational charts
  • Choosing a tiered vs. tierless SOC
  • Building a dream team
  • Interviewing tips and techniques
  • Interviewing mistakes and avoiding bias
  • Training plans

Mental Models for SOC Operations

  • Ops Tempo and the OODA Loop
  • Threat modeling
  • MITRE ATT&CK/Kill Chain
  • Threat Intel - F3EAD
  • Pyramid of pain and analytic types
  • The SOC as an "infinite game"

Data Collection

  • The SOC data collection system
  • Open-source NSM and host-data tools
  • Collection issues
    • Tactical log collection
    • Audit policy flexibility
    • Most important data sources
    • How to collect data
    • Parsing, filtering, enrichment, and storage

Use Case Development and Storage

  • Analytic rule types
  • Analytic rule life cycle
  • Use case organization and storage

John Hubbard
Tue Aug 11th, 2020
9:00 AM - 12:15 PM ET
1:30 PM - 5:00 PM ET


The second day of MGT551 focuses on understanding and improving everyday SOC activities such as detection design, investigation and triage, threat hunting, active defense, and incident response. We'll look at all the exciting new tools in the blue team space that can improve your team in these areas. Additionally, we'll tackle common concerns such as employee retention and the prevention of burnout, as well as improvement measures such as analytic testing and false positive reduction, measurement and execution of SOC growth initiatives, adversary emulation, and purple team testing. Exercises include attack technique prioritization with MITRE ATT&CK Navigator, a guided exercise on how to define, derive, and track the most important metrics for your SOC, and a walk-through with examples of how to plan and track a purple team assessment to ensure your SOC is delivering on its goal of improving cyber defense and resiliency.

  • Prioritizing and Visualizing Attack Techniques and Security Controls
  • Creating, Classifying, and Communicating Your Metrics
  • Purple Team Assessment Planning, Execution, and Tracking

CPE/CMU Credits: 6


Detection and Analytic Design

  • SOC threat detection systems
  • Analytic outcomes and tuning
  • Writing high-fidelity rules
  • Dealing with high-volume alerts
  • Risk-based scoring and alert aggregation

Analytic and Analysis Frameworks and Tools

  • Blue team knowledge standardization and upcoming tools
  • ATT&CK Navigator
  • Yara
  • Sigma
  • Jupyter notebooks
  • Detection testing labs

Threat Hunting

  • What is threat hunting and why is it needed?
  • Scheduling
  • Data quality
  • Hunting process and techniques
  • Hunting maturity model
  • Showing the value of threat hunting

Active Defense

  • What is active defense/deception?
  • Active defense techniques and goals
  • Tooling

Alert Triage and Investigation

  • Tiered vs. tierless SOC triage process
  • Where to triage alerts
  • Software for triage and desired features
  • Prioritization of alerts
  • Investigation issues and tactics
    • Structured analysis - brainstorming, ACH, externalization, decomposition

Incident Response (IR) Planning

  • IR policy, plans, and procedures
  • Staffing for IR
  • Communication guidelines and methods
  • IR go bags
  • Live IR - Guarding your credentials
  • Malware analysis sandboxes and analysis methods
  • Containment procedures
  • Eradication
  • Watch and learn
  • Recovery
  • Post-incident activity
  • Lessons learned

Staff Retention and Mitigation of Burnout

  • Cultivating intrinsic motivation in your team
  • SOC human capital model
    • Growth, skills, empowerment, and creativity
    • Automation, Ops efficiency, management/metrics
  • Burnout mitigation tactics for new and experienced analysts
  • Optimizing tasks for analyst growth
  • Performance management

Metrics, Goals, and Effective Execution

  • Daily Ops vs. initiatives
  • Metrics vs. KPIs. vs. OKRs
  • Selecting metrics
    • Metrics sampling rates
  • Selecting KPIs
    • Organizing operational measures
  • Creating OKRs
  • Successful execution
    • Metrics types
    • Goal setting
    • Acting on the right metrics
    • Scoreboards
    • Keeping a cadence of accountability

Analytic Testing and Adversary Emulation

  • Analytic testing
    • Analytic testing tools
    • Automated assessments
  • Penetration resting, red teaming, and adversary emulation
  • Purple team vs. red team execution and benefits
  • Purple teaming
    • Benefits
    • Methodology and execution
    • Reporting and tracking tools

Additional Information


A properly configured system is required for each student participating in this course. Before coming to class, carefully read and follow these instructions exactly.

You can use any 64-bit version of Windows, Mac OSX, or Linux as your core operating system that also can install and run VMware virtualization products. You also must have 8 GB of RAM or higher for the VM to function properly in the class.

It is critical that your CPU and operating system support 64-bit so that our 64-bit guest virtual machine will run on your laptop.

In addition to having 64-bit capable hardware, AMD-V, Intel VT-x, or the equivalent must be enabled in BIOS/UEFI.

Please download and install the most recent version of VMware Workstation, VMware Fusion, or VMware Workstation Player (VirtualBox and other virtualization platforms are not supported) on your system prior to the beginning of class. If you do not own a licensed copy of VMware Workstation or Fusion, you can download a free 30-day trial copy from VMware. VMware will send you a time-limited serial number if you register for the trial on its website.


CPU: 64-bit 2.0+ GHz processor or higher-based system is mandatory for this class (Important - Please Read: a 64-bit system processor is mandatory)

BIOS/UEFI: VT-x, AMD-V, or the equivalent must be enabled in the BIOS/UEFI

RAM: 8 GB (gigabytes) of RAM or higher is mandatory for this class (Important - Please Read: 8 GB of RAM or higher is mandatory)

Disk: 25 gigabytes of free disk space


  • Wireless Ethernet 802.11 B/G/N/AC
  • USB-A ports or an adapter to use a USB-A thumb drive (version 3.0 compatibility highly recommended)


  • VMware Workstation, Workstation Player, or Fusion
  • The Linux virtual machine will be provided to students


Please verify before coming to class that you have the administrative permissions required to transfer a virtual machine from a USB drive to your hard disk and start it. Also verify that Windows Device Guard, DLP, or other host-based protections will not interfere with the USB transfer or VM startup. (This is a common issue with company-built PCs, so if you intend to bring a corporate laptop, please test this before the event.)

If you have additional questions about the laptop specifications, please contact√¬†laptop_prep@sans.org.

If you have additional questions about the laptop specifications, please contact laptop_prep@sans.org.

This course is intended for those who are looking to build a Security Operations Center for the first time or improve the one their organization is already running.

Ideal student job roles for this course include:

  • Security Operations Center Managers
  • New Security Operations Team Members
  • Lead / Senior SOC Analysts
  • Technical CISOs and Security Directors

This course does not have any specific prerequisites, but it is suggested that students have some experience in an operational security role. SANS courses such as SEC450 or MGT512 will give students a solid base-level understanding of the concepts that will be discussed.

Author Statement

"Written to compliment my first SOC course (SEC450: Blue Team Fundamentals), MGT551 completes the security operations picture by introducing the best higher-level frameworks and organization tactics I've discovered throughout my career as a SOC analyst and manager for a large pharmaceutical company. By including hands-on application with state of the art open-source tools and methods for security operations, MGT551 delivers the complete package for SOC leaders. This course condenses years of knowledge and real-life experience with months of additional research to bring you the most important information to effectively and efficiently lead your security team to success.

As someone who has been the victim of less than ideal data collection and workflow, my goal with this course is to help ensure every organization's blue team runs at peak efficiency and capability, and no one has to suffer through repeating mistakes so commonly made within the industry. This course is the culmination of years of teaching, leading, and researching security operations and I am incredibly excited to bring it to the SANS community."

- John Hubbard