Skip to main content
back to List back
on this page

From Signals to Actions: Building SIEM+SOAR Playbooks with Safe, Measured SOC AI

live online
price $1,400
Adeel
Intermediate / Advanced
2 Days
Sun 22 Nov - Mon 23 Nov
price $1,400
Register


Online, Available in English and Arabic

Topics:

  • SIEM foundations + detection quality 
  • Telemetry mapping (ATT&CK-driven) + parsing/normalisation patterns
  • Lab 1: Ingest dataset, validate fields, build parsers
  • Detection engineering: Sigma logic, correlations, risk scoring
  • Lab 2: Write/tune detections; measure signal-to-noise
  • Enrichment: identity/asset context + TI + case creation
  • Lab 3: Correlate alerts → cases; triage workflow
  • SOAR + SOC AI + safety hardening 
  • SOAR design: playbooks, approvals, least-privilege actions
  • Lab 4: Phishing-to-containment playbook (ticket + block + notify)
  • SOC AI: local LLM assistant for triage, queries, report drafting
  • Lab 5: Build RAG runbook assistant; measure hallucination & leakage
  • Adversarial lab: prompt-injection via logs/retrieval; observe unsafe actions
  • Hardening lab: guardrails + re-test and re-score
  • Capstone: end-to-end incident; score speed/safety improvements
     


Overview

Modern SOCs rely on SIEM and SOAR, but telemetry is noisy and AI copilots can introduce new failure modes. This hands‑on course teaches analysts and engineers to build a vendor‑neutral SecOps pipeline: ingest and normalise logs, write and test detections, enrich alerts, and automate response playbooks. 

On day two, students add a locally‑run LLM assistant for triage and querying, then learn how to measure and harden it against prompt‑injection and unsafe tool actions using practical guardrails. Every module includes labs and a capstone incident where teams reduce time‑to‑triage while maintaining safety and least privilege. Security operations are changing fast: SIEM and SOAR are essential, and AI is being added to speed up triage; often without clear benchmarks or safety controls. This 2‑day, vendor‑neutral training shows how to build an end‑to‑end SecOps workflow that is both faster and safer.

Students work in an isolated lab on a realistic incident storyline. Day 1 focuses on SIEM fundamentals that matter in practice: telemetry mapping, parsing and normalisation, detection engineering (Sigma‑style rules and correlations), enrichment, and measurable quality checks (false positives, missed detections, and signal‑to‑noise).

Day 2 turns detections into response: students design SOAR playbooks, safe containment actions, and human‑approval gates. Then we add an offline/local LLM assistant to summarise alerts, generate investigation queries, and draft response notes. Students attack their own assistant with prompt‑injection via logs and retrieved artefacts, then implement guardrails (instruction/data separation, allowlisted retrieval, identity‑scoped tool access, and output verification) and re‑measure results.

Participants leave with a reusable lab stack (VM/containers), datasets, playbook templates, and a benchmarking rubric to continuously test SIEM detections and SOC AI safety as tools evolve.

Target audience and Prerequisites

Target audience: SOC analysts, detection engineers, security architects, DFIR practitioners, SecOps/SIEM engineers, SOC leaders modernising operations.

Prerequisites: comfort with logs and basic querying; familiarity with Linux basics; basic Python helpful (not required). No ML background required.

By the end of this course, the participant will be able to: 

  • Ingest and normalize multi‑source telemetry into a SIEM and validate parsing quality
  • Author, test and tune detection rules/correlations with measurable signal‑to‑noise targets 
  • Build SOAR playbooks with least‑privilege actions and approval checkpoints 
  • Integrate an offline/local LLM assistant for triage and query generation
  • Run a repeatable safety test suite for prompt‑injection/unsafe actions and apply guardrails to reduce failure rates