Teach on Udemy

Turn what you know into an opportunity and reach millions around the world.

Learn More

Your cart is empty.

Keep shopping

Cybersecurity Tools Bootcamp 2026: SIEM, EDR, SOAR+DevSecOps

Name: Cybersecurity Tools Bootcamp 2026: SIEM, EDR, SOAR+DevSecOps
Rating: 2.9 (5 reviews)

Build and run a real open-source SIEM, EDR, SOAR and DevSecOps bench: Wazuh, Suricata, Sigma, Velociraptor, Shuffle

Created byNEXUS ACADEMY

Last updated 9/2026

English

English [Auto],

What you'll learn

Build and operate a complete open-source detection and response stack (Wazuh, OpenSearch, Suricata, Zeek, osquery, Velociraptor, Shuffle) on one machine
Decide what telemetry to collect, ship Linux, Windows, application and network logs into a SIEM and normalise them to a common schema
Write, test and version detection rules with Sigma, map them to MITRE ATT&CK and cut false positives with measured evidence
Detect persistence, credential access and living-off-the-land activity on endpoints, then contain and investigate hosts with live forensics
Put security gates into a CI pipeline: secret scanning, SAST, IaC scanning, SBOM and signing, container and Kubernetes hardening, runtime detection
Design and build SOAR playbooks that enrich, query, contain with human approval and open cases automatically
Prove the programme works with coverage maps, time metrics and audit-ready evidence exports

Course content

21 sections • 298 lectures • 28h 39m total length

Course Documents and How to Use Them6:21
Section 1 Intro: The Map Before the Tools3:05
Place security tools into the four jobs—collect, detect, investigate, respond—and map a tool chain as a pipeline, prioritizing interfaces over brochures.
What a Security Tool Chain Actually Is4:49
[LAB] One Event, Six Stations: Following a Single Log Line7:17
The Four Job Families: Collect, Detect, Investigate, Respond4:50
SIEM in One Lecture: What It Is and What It Is Not4:48
Describe how a siem ingests events, normalizes data, indexes, evaluates rules, and presents dashboards; clarify it is not a detector, not a compliance certificate, and not a replacement for telemetry.
[LAB] Ingest, Index, Search: Standing Up a Live Store7:58
EDR in One Lecture: Agents, Telemetry and Containment5:01
Understand how an endpoint agent watches process creation and parent processes, file changes, and network connections, decides on the host versus backend, and enables containment.
[LAB] Endpoint Telemetry Without a Vendor: osquery on a Live Host6:49
SOAR in One Lecture: Playbooks, Not Magic4:56
[LAB] The Simplest Honest Playbook: Enrichment, Not Containment6:41
Design a simple enrichment playbook that enriches one alert with three lookups, records a full case history in dry run and real mode, and embraces enrichment not containment.
DevSecOps in One Lecture: Moving the Gate, Not the Blame4:53
[LAB] A Gate That Actually Fails: Scanning an Image on Camera6:47
Where the Four Overlap and Where Teams Get It Wrong4:44
Open Source vs Commercial: What This Course Can and Cannot Show You4:38
Understand what this course can and cannot show about open source versus commercial security tooling, and learn six essential vendor questions to separate transferable skills from non-transferables.
Reading a Tool's Documentation Like an Engineer4:54
Learn to read a tool's documentation like an engineer by following six deliberate passes: data model, configuration precedence, release notes, limits, version reality check, and distinguishing specifications from local conventions.
[LAB] The Half-Hour Documentation Routine, On Camera7:08
How This Course Works: The Bench, the Labs, the Artefact4:29

Section 1 Wrap: The Shape of the Stack3:00
Section 2 Intro: Build It Before You Learn It2:44
Why You Build the Lab Before You Learn the Tool4:47
[LAB] Containers for Security Tooling: The Ten Commands You Need6:52
Learn ten container commands for security tooling: pull and pin tags, start services, inspect logs, exec inside, and network containers on a private network by name before tearing down.
[LAB] Standing Up the Lab Network and the Victim Hosts7:45
[LAB] Installing the Wazuh Manager and Indexer6:40
[LAB] Enrolling Your First Agent and Proving It Reports6:43
[LAB] Bringing Up the OpenSearch Dashboards Console6:39
Resource Budgets: Running a SOC Stack on One Machine5:00
[LAB] Generating Safe, Repeatable Attack Traffic7:55
Generate safe, contained, repeatable attack traffic from a bench file with a fixed list of requests, proving containment before firing and producing verifiable receipts in logs and the store.
Snapshots, Teardown and Rebuilding From Nothing4:56
Explore tearing down and rebuilding lab environments at four depths, preserve state in volumes and files, and use snapshots and a build file to manage the bench.
Lab Safety: What You Must Never Run on a Real Network5:14
State the one rule: only test on systems you own or with explicit written permission, keep the lab isolated from real networks, and use safe stand-ins with clear documentation.
Your Running Artefact: The Bench Build Log4:49
Section 2 Wrap: The Bench Is Up3:00

Section 3 Intro: No Tool Detects What You Never Collected3:05
The Only Question That Matters: What Do You Want to Detect?5:02
Log Sources Ranked by What They Actually Catch5:15
[LAB] Linux Telemetry: auditd, journald and the Wazuh Decoder7:07
Turn on auditd and journald on a real Linux machine, configure the Wazuh decoder to convert raw telemetry into named fields, and verify arrival and counting in the store.
[LAB] Windows Telemetry: Event Logs and a Sysmon Configuration8:19
Write and validate a Sysmin configuration to parse Windows event records on Linux, then create a custom rule for process creation and test negatives.
[LAB] Shipping Application and Cloud-Style Logs Into the Stack6:59
Timestamps, Time Zones and the Clock Problem5:02
Log Volume: Sampling, Filtering and What You Give Up5:06
[LAB] Measuring Your Own Ingest Rate6:53
Retention: Hot, Warm, Cold and the Compliance Floor5:00
Coverage Gaps: Finding the Hosts That Never Report5:09
[LAB] Building a Telemetry Inventory You Can Defend7:13
Telemetry Debt and How It Quietly Kills Detections5:09
Section 3 Wrap: What the Bench Can Now See3:06

Section 4 Intro: Why Raw Logs Cannot Be Correlated3:12
Parsing, Decoders and the Real Cost of Regex5:09
[LAB] Writing a Wazuh Decoder and Rule for a Custom Log7:08
Write a Wazuh decoder and rule for a custom log, test it with the tester against good and broken lines, and validate field extraction in the live pipeline.
OCSF: Categories, Classes and the Shape of an Event5:13
Describe how the Open Cybersecurity Schema Framework organizes events into categories and classes, uses identifying attributes and numeric identifiers for cross-vendor mapping and reliable definitions.
[LAB] Browsing the OCSF Schema and Mapping a Real Event8:14
ECS and the Other Schemas You Will Meet5:01
Choosing a Schema and Living With the Choice5:11
[LAB] Normalising Suricata and Wazuh Events to One Field Set7:38
Enrichment at Ingest: Asset, Identity and Location Context5:15
[LAB] Adding Asset Criticality to Every Event7:01
Schema Drift: What Breaks When a Vendor Renames a Field5:04
Field Discipline as a Team Habit5:05
Normalisation Anti-Patterns That Cost You Later5:08
Section 4 Wrap: One Vocabulary Across the Bench3:03

Section 5 Intro: Living Inside the Search Bar3:01
Inside a SIEM: Index, Shard, Query, Dashboard4:59
[LAB] Index Templates and Mappings, and Why They Bite7:53
Search Languages: The Shapes They All Share5:09
[LAB] Your First Real Investigation Query7:08
[LAB] Aggregations: Counting Your Way to a Finding8:02
Pivoting: From One Field to the Whole Story5:01
[LAB] Building a Saved Search Library the Team Can Use7:03
Performance: Why Your Query Timed Out5:01
[LAB] Time Ranges, Sampling and Honest Results7:01
Access Control Inside the SIEM5:17
[LAB] Exporting Evidence That Survives Review7:14
Export evidence with provenance by bundling rows, the query, and the window. Verify the bundle has not changed since written using a manifest and checksums, and rerun the store.
Data Quality Checks You Run Every Week5:00
The SIEM Anti-Patterns That Waste Budgets5:15
Section 5 Wrap: You Can Now Ask the Data Questions3:07

Section 6 Intro: What the Wire Knows3:00
What the Network Sees That the Endpoint Cannot5:06
Suricata: Architecture, Modes and Where to Place It5:12
[LAB] Installing Suricata and Reading Your First eve.json7:13
Anatomy of a Suricata Rule5:05
[LAB] Writing a Rule and Watching It Fire on Real Traffic7:54
[LAB] Tuning a Noisy Rule Without Going Blind7:16
Tune noisy rules by measuring what triggers alerts, narrow matches to what you mean, and hold alert rate with threshold files while ensuring traffic is still recorded.
Rulesets: Sources, Update Cadence and Trust5:21
IDS or IPS: The Decision and What It Costs You5:23
Zeek: Protocol Logs Instead of Alerts5:11
Learn how Zeek uses protocol logs instead of alerts and connects records via a connection identifier. Decide what to keep with health logs and volume, balancing recorder and detector roles.
[LAB] Zeek Logs in the SIEM Alongside Suricata Alerts8:21
Encrypted Traffic: What Still Survives TLS5:24
[LAB] Correlating a Network Alert With an Endpoint Event7:08
Network Telemetry at Scale: Taps, SPANs and Sampling5:13
Section 6 Wrap: The Bench Now Watches the Wire3:08

Section 7 Intro: Detections Are Code2:57
Detection Engineering as a Discipline, Not a Hobby4:57
Anatomy of a Sigma Rule5:12
[LAB] Writing Your First Sigma Rule8:15
[LAB] Converting Sigma to Your Backend and Running It7:25
Logsource, Taxonomy and the Portability Promise5:11
Sigma Correlation Rules: Beyond a Single Event5:14
Master sigma correlation rules to detect detections that cannot be written as a single event, choose among seven correlation types, define five attributes, use aliases, and set a time window.
[LAB] A Correlation Rule That Catches a Multi-Step Attack8:37
Learn to build a two-rule correlation that groups events by host, enforces step order within a 15-minute window, and detects multi-step attacks even when the backend cannot correlate.
Sigma Filters and Environment-Specific Exceptions5:19
MITRE ATT&CK: Tactics, Techniques and Detection Strategies5:14
[LAB] Mapping Your Rules to ATT&CK and Finding the Holes7:29
False Positives: Measure Before You Delete5:05
[LAB] Rule Testing With Replayed Attack Data8:30
Version Control and Peer Review for Detection Content5:13
Section 7 Wrap: A Rule Set You Can Defend2:59

Section 8 Intro: Making Weak Signals Add Up3:05
Correlation: The Three Patterns Worth Knowing5:13
[LAB] Building a Chained Correlation in the SIEM7:27
Risk Scoring Instead of Alerting on Everything5:18
[LAB] A Risk-Based Alert That Beats Five Single Rules8:33
Threat Intelligence: Feeds, Formats and Half-Lives5:17
Clarify what a threat intelligence feed delivers using STIX indicators and expiry decisions at ingest. Explore how collections, Taxii, and decay mechanics shape reliable, time-bound indicators in security tooling.
[LAB] Ingesting an Indicator Feed and Matching Against It7:30
Why Indicator Matching Alone Always Fails5:19
MISP and Structured Intelligence Sharing5:11
[LAB] Enriching an Alert With Reputation and Asset Context7:26
Behavioural Baselines and the Anomaly Trap5:22
[LAB] A Baseline Detection That Does Not Cry Wolf8:32
Deciding What Never Deserves an Alert5:10
Section 8 Wrap: Fewer, Better Alerts3:17

Section 9 Intro: The Screen the Team Stares At3:03
Dashboards People Actually Use5:02
[LAB] Building the SOC Shift Dashboard7:04
[LAB] A Detection Health Dashboard for the Engineers7:57
Alert Design: Title, Context, Next Action5:01
[LAB] Wiring Alerts to a Real Notification Channel7:16
Alert Fatigue: Diagnosing It With Numbers5:07
[LAB] Measuring and Then Cutting Your Alert Volume7:15
Severity, Priority and the Triage Queue5:06
Runbooks: The Document Every Alert Needs4:45
[LAB] Writing a Runbook and Testing It Against a Live Alert7:56
On-Call Reality: Escalation and Handover5:12
What to Report Upward and What to Keep Internal5:09
Section 9 Wrap: The Bench Now Tells You Things2:57

Section 10 Intro: Standing on the Endpoint3:05
What an EDR Agent Actually Does on the Host5:08
Kernel, User Space and the Visibility Trade-Off5:17
Prevention, Detection and Response Inside One Agent5:07
Commercial EDR: What This Course Cannot Show You, and Why5:03
Open-Source Equivalents and Their Honest Limits5:16
[LAB] Wazuh Agent Deep Dive: Modules and Configuration7:17
[LAB] osquery: Treating the Endpoint as a Database8:28
[LAB] Scheduled Queries and Differential Results7:26
[LAB] Endpoint Inventory You Can Query in Seconds7:12
Process Trees: The Analyst's Most Useful Picture5:02
[LAB] Reconstructing a Process Tree From Real Telemetry8:31
Agent Health: The Silent Failure Mode5:12
Endpoint Coverage as a Managed Metric5:15
Section 10 Wrap: Eyes on Every Host3:12

Requirements

A computer that can run Docker with roughly 8 GB of RAM free for the lab stack; all tools used are free and open source
Basic Linux command-line comfort and general IT or networking knowledge; no prior SIEM, EDR or SOAR experience is required

Description

This course contains the use of artificial intelligence.

This is a hands-on rebuild of the Cybersecurity Tools Bootcamp. Instead of touring dozens of products from the outside, you build one working security stack, called the bench, in Section 2 and keep operating it for the rest of the course. Every tool is installed, configured and exercised on screen, with real commands and real output. More than a hundred lectures are screen-recorded labs marked [LAB].

The course follows the order a security team actually works in. You start with telemetry: deciding what to collect, shipping Linux, Windows, application and network logs into a SIEM, and normalising them to a common schema so events become comparable. You then move into the SIEM core: indexing, searching, pivoting and exporting evidence that survives review. Network telemetry follows with Suricata and Zeek on the wire, then detection engineering with Sigma, correlation, enrichment and threat intelligence, and dashboards and alerting that cut noise rather than add to it.

On the endpoint side you learn what an EDR agent really does on a host and then build the open-source equivalent with the Wazuh agent and osquery: file integrity monitoring, persistence and credential-access detection, living-off-the-land detection and automated containment. Velociraptor gives you live forensics and hunting across the fleet, and case management brings alerts into a real analyst workflow with templates, timelines and reports.

Automation comes last, on purpose. You learn when a playbook is worth building, then build six real ones in Shuffle: phishing triage, alert enrichment, fleet queries, containment with human approval, automatic case creation and a daily detection-health report. Three DevSecOps sections put gates into a pipeline you are allowed to break: secret scanning with Gitleaks, static analysis with Semgrep, infrastructure-as-code scanning, SBOMs, signing and provenance with cosign, container and Kubernetes hardening, runtime detection with Falco and DAST with OWASP ZAP.

The final sections show the compliance pressure behind the tooling, how to measure detection coverage and programme health, and a capstone that chases a single incident end to end through the whole bench. Commercial EDR and SOAR consoles are discussed as concepts only; every lab runs on open-source tools you can install yourself.

Twelve downloadable working documents accompany the course, from the bench build log to the pipeline gate charter, so the artefacts you produce are ones you can reuse at work.

Who this course is for:

Security analysts, SOC joiners and IT engineers who have read about SIEM, EDR, SOAR and DevSecOps but have never built or operated the stack
System administrators moving into security and developers being handed pipeline security who want hands-on, tool-by-tool practice

Cybersecurity Tools Bootcamp 2026: SIEM, EDR, SOAR+DevSecOps

What you'll learn

Explore related topics

Course content

Section 1: What the Tool Chain Is Actually For18 lectures • 1hr 40min

Section 2: The Bench — Building the Lab You Will Use All Course14 lectures • 1hr 16min

Section 3: Telemetry First — Deciding What to Collect14 lectures • 1hr 18min

Section 4: Normalisation and Schema — Making Events Comparable14 lectures • 1hr 17min

Section 5: SIEM Core — Index, Search, Pivot, Prove15 lectures • 1hr 26min

Section 6: Network Telemetry — Suricata and Zeek on the Wire15 lectures • 1hr 26min

Section 7: Detection Engineering with Sigma15 lectures • 1hr 28min

Section 8: Correlation, Enrichment and Threat Intelligence14 lectures • 1hr 23min

Section 9: Dashboards, Alerting and Cutting the Noise14 lectures • 1hr 19min

Section 10: EDR — Concepts, and the Open-Source Endpoint Stack15 lectures • 1hr 27min

Requirements

Description

Who this course is for: