SIEM products are constantly being pushed yet often fail to deliver due to lack of training and processes. Vendor specific training unfortunately tends to focus on \how to use a product" rather than "how to use a SIEM tactically". SEC555, a new SANS course coming out in 2017, is slated to be the industry's first vendor neutral course designed specifically on building, developing, and maintaining a tactical SIEM. The course will build core analyst thought processes and skills by using open source big data technologies. The end goal is to operationalize whatever SIEM solution you already have or if you do not have a SIEM, to show you how to deploy an open source big data solution that will go toe to toe with commercial SIEMs.