Course Objective & Scope
While traditional SOAR playbooks handle rigid decision trees well, analysts still face bottlenecks when correlating multi-source alerts and unstructured context. This advanced course combines deterministic security automation (SOAR/webhooks/APIs) with LLM-powered security agents, RAG-backed runbook retrieval and tool-calling architectures to build a safe Agentic SOC.
Participants design an automated enrichment, log-querying and pre-triage workflow on sample alerts, embedding human-in-the-loop approval gates and guardrails against misfires and log-borne prompt injection.
Who Should Attend?
- SOC engineers, SOAR developers and senior SOC analysts
- Security automation and detection engineering teams
- Security architects designing AI/agent workflows for security operations
- Prerequisite: experience with SIEM/SOC workflows, REST APIs and basic Python/scripting
Key Takeaways
- Decide which SOC tasks belong in deterministic SOAR playbooks versus AI agent workflows
- Build automated enrichment and triage flows that call SIEM, EDR and Threat Intelligence APIs
- Design an analyst copilot that queries internal runbooks and historical cases via RAG
- Enforce human-in-the-loop approval gates and strict permission boundaries for high-impact containment actions
- Implement safeguards and evaluation metrics against indirect prompt injection carried inside log payloads
Curriculum
From Traditional SOAR to Agentic SOC Architecture
- Limits of rigid playbooks and high-value AI agent use cases in the SOC
- Architectural patterns for triage, enrichment, query generation and case summarization
Security APIs and Automated Enrichment Workflows
- Webhook and API integrations across SIEM, EDR, IAM and Threat Intelligence platforms
- End-to-end automation flows for phishing, suspicious login and malware alerts
Autonomous Alert Pre-Triage with Tool Calling and RAG
- Equipping security agents with read-only investigation tools (SIEM queries, TI lookups, asset inventory)
- Contextual analysis over internal runbooks and historical incident reports via RAG
Safety, Guardrails and Human-in-the-Loop Controls
- Indirect prompt injection via crafted log payloads and input/output isolation
- Least-privilege agent identities, approval gates for containment actions and audit trails
Evaluation Metrics and Agentic SOC Design Lab
- Measuring triage accuracy, hallucination rates, MTTR impact and token cost
- Drafting an automation and agent architecture blueprint for an internal SOC scenario
Other Courses in This Category
-
Evasion, data poisoning, backdoors, model extraction and membership inference attacks and defenses under MITRE ATLAS for data science and security teams testing ML model robustness.
- Live Course
- 5 modules
-
OWASP Top 10 for LLM & Agentic Applications, direct/indirect prompt injection, RAG data leakage, MCP/tool-calling authorization and guardrail architectures for engineers building secure AI systems.
- Live Course
- 5 modules
-
ISO/IEC 27001:2022 clauses, asset and risk assessment, Annex A controls, Statement of Applicability (SoA) and internal audit readiness for teams establishing and operating an ISMS.
- Live Course
- 5 modules
-
The Linux network stack, nftables/iptables, SSH and privilege hardening, SELinux/AppArmor, auditd and packet analysis for systems and security engineers securing production Linux servers.
- Live Course
- 5 modules
-
Static and dynamic malware analysis in isolated labs, PE/ELF inspection, behavioural monitoring, unpacking, code analysis with Ghidra and YARA rule authoring for security analysts.
- Live Course
- 5 modules
-
All 8 domains of the (ISC)² CISSP Common Body of Knowledge (CBK), risk and governance mindset, security architecture and scenario-based question analysis for experienced security professionals.
- Live Course
- 5 modules
Get in touch
