SEC573: AI-Powered Security Automation: Building Tools with Python, LLMs, and MCP

CRITICAL NOTE: Apple Silicon devices cannot perform the necessary virtualization and cannot be used for this course.

Laptop Required

Students are required to bring their own laptop so that they can connect directly to the workshop network we will create, and thus get the most value out of the course. It is the student's responsibility to make sure that the system is properly configured and capable of running both a Windows and Linux VMWare compatible virtual machines at the same time.

Some of the course exercises are based on Windows, while others focus on Linux. VMware Player or VMware Workstation is required for the course. If you plan to use an Intel based Mac, please make sure you bring VMware Fusion, along with a Windows guest virtual machine. All of the VMware products are available at www.vmware.com.

Important Note: You may also be required to disable your anti-virus tools temporarily for some exercises, so make sure you have the anti-virus administrator permissions to do so. Do not plan on just killing your anti-virus service or processes, because most anti-virus tools still function even when their associated services and processes have been terminated. For many enterprise-managed clients, disabling your anti-virus tool may require a different password than the Administrator account password. Please bring that Administrator password for your anti-virus tool.

Enterprise VPN clients may interfere with the network configuration required to participate in the course. If your system has an enterprise VPN client installed, you may need to uninstall it for the course exercises.

• Mandatory Laptop Hardware Requirements
• CPU: 64-bit Intel i5/i7 (8th generation or newer), or AMD equivalent. A x64 bit, 2.0+ GHz or newer processor is mandatory for this class.
• CRITICAL: Apple Silicon devices cannot perform the necessary virtualization and therefore cannot in any way be used for this course.
• BIOS settings must be set to enable virtualization technology, such as "Intel-VTx" or "AMD-V" extensions. Be absolutely certain you can access your BIOS if it is password protected, in case changes are necessary.
• 16GB of RAM or more is required.
• 200GB of free storage space or more is required.
• At least one available USB 3.0 Type-A port. A Type-C to Type-A adapter may be necessary for newer laptops. Some endpoint protection software prevents the use of USB devices, so test your system with a USB drive before class.
• Wireless networking (802.11 standard) is required. There is no wired Internet access in the classroom.

If you have additional questions about the laptop specifications, please contact customer service.

SEC573 training is recommended for a diverse range of individuals, including:

• Security professionals who benefit from automating routine tasks so they can focus on what's most important
• Forensic analysts who can no longer wait on someone else to develop a commercial tool to analyze artifacts
• Network defenders who sift through mountains of logs and packets to find evil-doers in their networks
• Penetration testers who are ready to advance from script kiddie to professional offensive computer operations operator
• Security professionals who want to evolve from security tool consumer to security solution provider

The GIAC Python Coder (GPYC) certification validates a practitioner's understanding of core programming concepts, and the ability to write and analyze working code using the Python programming language. GPYC certification holders have demonstrated knowledge of common python libraries, creating custom tools, collecting information about a system or network, interacting with websites and databases, and automating testing.

• Python language essentials
• Packet and data analysis
• Website and database interaction
• Regular expressions
• Exception handling and debugging

More Certification Details

• A USB containing a virtual machine filled with sample code and working examples
• MP3 audio files of the complete course lecture

A basic understanding of any programming or scripting language is highly recommended but not required for this course. SEC573 starts with the most basic fundamentals of Python programming. There is no aspect of programming or Python that must be understood before attending this course. The lab environment is self-paced and this allows students who have had some experience coding to advance more quickly than those who have not. You are provided a Virtual Machine that gives you the ability to complete the labs that are in your course book after the live course or your OnDemand access has finished.

The SEC573 course is a part of the “Advanced Cyber Defense” Learning Path, which aims to equip security professionals with the skills to harden specific defenses.

The following SANS courses contain small sections that teach aspects of Python coding. The skills taught in SEC573 will prepare you to take full advantage of the following courses:

• SEC503: Network Monitoring and Threat Detection In-Depth
• SEC542: Web App Penetration Testing and Ethical Hacking
• SEC545: GenAI and LLMs Application Security
• SEC555: SIEM with Tactical Analysis
• SEC560: Enterprise Penetration Testing
• SEC587: Advanced Open-Source Intelligence (OSINT) Gathering and Analysis
• SEC595: Applied Data Science and AI/Machine Learning for Cybersecurity Professionals
• SEC598: AI and Security Automation for Red, Blue, and Purple Teams
• SEC673: Advanced Information Security Automation with Python
• FOR10: Reverse-Engineering Malware: Advanced Code Analysis

Additionally, this course teaches the automation of skills that are taught in these SANS courses, making this a great follow on to these courses.

• SEC511: Cybersecurity Engineering: Advanced Threat Detection and Monitoring
• SEC555: Detection Engineering and SIEM Analytics
• FOR500: Windows Forensics Analysis
• FOR508: Advanced Incident Response, Threat Hunting, and Digital Forensics
• FOR572: Advanced Network Forensics: Threat Hunting, Analysis, and Incident Response

AI-Powered Information Security Automation integrates artificial intelligence with automation tools to enhance cybersecurity operations, enabling systems to detect, respond to, and mitigate threats in real-time without constant human intervention. Using LLMs and the power of Python, you can develop tools to handle a variety of information security tasks from processing data from logs, networks, and endpoints to identifing anomalies, predict attacks, and automate defenses. This approach, emphasized in SEC573: AI-Powered Information Security Automation, leverages "Vibe coding" that makes development accessible even for non-experts, allowing quick creation of custom agents and integrations via protocols like MCP (Message Context Protocol) and OpenAI agents.

Key benefits include:

• Faster Response: Automates repetitive tasks like system monitoring, enabling quicker detection and response to threats.
• Consistency: Ensures that security procedures are executed in a consistent and error-free manner.
• Scalability: Allows for easy scaling of security measures across large networks and systems.
• Customizability: Python’s extensive libraries and frameworks make it easy to tailor automation to specific security needs.
• Ultimately, automation helps reduce the workload on security professionals while improving the organization’s resilience to cyber threats.

SEC573 is a crucial course for anyone looking to advance in cybersecurity, particularly in the areas of automation and threat defense. By focusing on automated methods for defending IT infrastructure, this course equips professionals with the skills needed to efficiently manage and protect systems at scale.

Key benefits for your career include:

• Enhanced Skillset: Learn how to design and implement automated defenses, improving your ability to mitigate cyber threats quickly and effectively.
• Industry-Relevant Knowledge: The course covers modern attack vectors and automated defense tools, preparing you for the latest trends in cybersecurity.
• Improved Efficiency: Mastering automation allows you to handle complex environments with greater speed, precision, and fewer errors, making you an asset to any team.
• Career Advancement: With the growing demand for cybersecurity professionals skilled in automation, SEC573 can open doors to more advanced roles and opportunities in the field.
• This course will make you more competitive and capable in the ever-evolving cybersecurity landscape.