Teach on Udemy

Turn what you know into an opportunity and reach millions around the world.

Learn More

Your cart is empty.

Keep shopping

Security Automation with SOAR & Python (2026 Edition)

Name: Security Automation with SOAR & Python (2026 Edition)
Rating: 1.2 (2 reviews)

Build a working SOC automation rig in Python: triage, threat intel, phishing, guarded containment and audit trails

Created byNEXUS ACADEMY

Last updated 9/2026

English

What you'll learn

Build a reproducible Docker automation rig: alert source (Wazuh), threat intel (MISP, TAXII 2.1), orchestrator (Shuffle), case sink (DFIR-IRIS)
Write Python that survives real security data: pydantic validation, structured logging, honest exit codes and dry-run flags
Call security APIs safely: authentication, pagination, rate limits with backoff, idempotent retries and least-privilege tokens
Normalise and correlate alerts, extract and defang indicators, write Sigma rules and score severity you can defend in a review
Automate threat intelligence with STIX 2.1, TAXII 2.1 and PyMISP while respecting TLP 2.0 handling rules
Design playbooks before code (including CACAO 2.0) and run them in an open-source orchestrator and in plain Python
Automate phishing triage end to end: safe .eml parsing, SPF/DKIM/DMARC results, scoring and a close/escalate/contain decision
Contain with guardrails: dry-run, protected-asset allowlists, approval gates, expiry, rollback and a kill switch
Keep an audit trail, open cases with evidence and draft incident notifications from the case record, aligned to NIST SP 800-61r3
Run automation in production with tests, a CI pipeline, packaging and health checks, and decide where AI assistance may and may not act

Course content

14 sections • 130 lectures • 12h 46m total length

Course Documents and How to Use Them7:00
Section 1 Intro: The Job You Are Automating3:03
What SOAR Actually Means: Orchestration, Automation, Response6:25
SIEM, EDR, SOAR and the Ticket Queue: Who Does What6:01
The Clocks That Force the Work: NIS2, DORA, SEC and CIRCIA8:33
NIST SP 800-61r3 and the Controls That Name Automation7:37
What Automation Must Never Do6:10
The Landscape, Without Picking a Winner — and the Agentic Question7:32
What This Course Records, What It Cannot, and Why4:52
The Rig and the Repo You Walk Away With3:53
Section 1 Wrap: The Shape of the Work2:52

Section 2 Intro: Build It Before You Automate It2:57
[LAB] The Bench Blueprint: What Runs Where5:40
[LAB] The Python Workspace: A Project That Installs, Under Version Control7:43
[LAB] The Alert Source: Real Events From a Real Sensor6:30
[LAB] The Case Sink and the Notification Sink6:55
[LAB] Configuration and Secrets: One Place, Zero Hardcoded Keys7:14
Lab Safety: Nothing Here Ever Points at Production4:54
state the rules every lab obeys and evaluate a command's blast radius before running it. keep the bench isolated and reproducible, and never point at systems you do not own.
[LAB] Snapshot, Teardown, Rebuild: Proving It Is Reproducible6:06
Section 2 Wrap: The Rig Is Up3:01

Section 3 Intro: The Language as a Tool, Not a Subject2:52
[LAB] The Shape of Security Data: Dicts, Lists and Nested JSON6:57
[LAB] Files and Streams: Handling Event Data Without Losing Any7:47
Functions, Modules and the Layout of an Automation Package4:54
[LAB] Type Hints and pydantic: Rejecting a Malformed Alert Early7:04
[LAB] Exceptions, Timeouts and Exit Codes That Tell the Truth5:51
[LAB] Structured Logging: Logs an Auditor Can Read6:47
[LAB] A Command-Line Tool With a Dry-Run Flag5:51
[LAB] Your First Real Automation: One Alert, End to End7:59
Section 3 Wrap: The Toolkit Has a Spine3:05

Section 4 Intro: Everything Is an API Call2:53
[LAB] HTTP for Security Engineers: Verbs, Status Codes and Idempotency6:58
Explore how to validate HTTP responses in security automation by enforcing correct status codes, media types, and parseable bodies, and test idempotency across create and read operations.
Authentication: API Keys, Bearer Tokens and OAuth 2.06:06
[LAB] Building a Real Client by Hand: Wazuh, JWT and a Session8:07
[LAB] Pagination and Rate Limits: 429, Retry-After and Backoff7:48
[LAB] Retries That Do Not Double-Fire6:00
Secrets Management: Environment, Keychain, Vault5:10
[LAB] Least-Privilege Tokens: Proving the Key Cannot Do Too Much6:14
[LAB] Testing API Code Without Touching the API6:58
Section 4 Wrap: The Tools Are Reachable3:12

Section 5 Intro: The Part Everyone Skips3:09
Why Every Tool Speaks a Different Dialect — and What OCSF Does About It6:09
[LAB] Writing a Field Map: One Shape From Three Sources6:56
[LAB] Extracting Indicators — and Defanging Them7:07
[LAB] Deduplication and Correlation: One Incident, Not Forty Alerts7:03
[LAB] Sigma: One Rule, Two Backends, No Product Lock-In8:01
[LAB] A Severity Score You Can Defend in a Review7:00
[LAB] Allowlists and Suppression Without Going Blind6:03
Section 5 Wrap: The Alert Is Now a Decision3:10

Section 6 Intro: Context, Not Collection3:05
The Intelligence Lifecycle and What Automation Can Actually Do5:03
TLP 2.0: Handling Rules Your Code Has to Respect5:25
STIX 2.1: Indicators, Observables and Relationships6:22
[LAB] Reading a Real STIX Bundle in Python7:06
[LAB] TAXII 2.1: Standing Up a Server and Pulling a Collection7:05
[LAB] MISP and PyMISP: Events, Attributes and Warninglists7:21
[LAB] A Local Indicator Cache With Expiry5:43
[LAB] Matching Alerts Against Intel Without Drowning in Hits6:59
Section 6 Wrap: The Rig Knows Things Now3:04

Section 7 Intro: The Design Is the Hard Part2:53
Anatomy: Trigger, Enrich, Decide, Act, Record6:03
[LAB] The One-Page Playbook Spec, Written Before Any Code6:01
Create a one-page playbook design in your repository and run a checker to verify it against the actual code and data, surfacing five faults in a first draft before coding.
Where a Human Must Stand in the Path6:06
Idempotency, Timeouts and the Resume Problem5:53
CACAO 2.0: A Vendor-Neutral Playbook Format7:04
[LAB] Walking a CACAO Playbook Graph in Python6:46
Walk a CACAO playbook graph in Python to read a vendor-neutral playbook, inspect its metadata, workflow logic, and 8 step types, and uncover structural faults through tests.
[LAB] From Script to Playbook: Making the Steps Inspectable6:56
Turn automation steps into data and run them with a separate runner and a readable playbook, enabling visibility, recording, and an approval gate edited by file rather than code. Embrace a design-centric workflow with a plan, read, validate, decide, act, and record, plus idempotent resuming.
Section 7 Wrap: A Plan You Could Hand Over2:54

Section 8 Intro: Where the Platform Earns Its Place2:54
Anatomy of a SOAR Platform: Connectors, Actions, Cases6:06
[LAB] Standing Up an Open-Source Orchestrator7:00
[LAB] A Webhook Trigger That Fires on a Real Alert7:01
[LAB] Calling Your Own Python From the Platform7:20
Run a scoring module this course wrote inside an orchestration platform to evaluate a real alert with Python, reveal thresholds and what travels with code.
[LAB] The Same Playbook Twice: Workflow Canvas vs Code7:09
Portability: What Travels Between Platforms and What Locks You In6:24
When Not to Use the Platform at All4:58
Section 8 Wrap: The Rig Has a Conductor3:00

Section 9 Intro: If It Is Not Recorded, It Did Not Happen3:06
Case Management: The Automation's Memory4:59
[LAB] Opening a Case From a Playbook, With the Evidence Attached7:15
[LAB] Notifications People Actually Read6:01
[LAB] The Audit Trail: Proving What the Robot Did, and Why6:59
Build a tamper-evident audit trail for automation that proves what the robot did and did not do, with a linked row chain and a head digest.
[LAB] Drafting the 24-Hour Notification From the Case Record7:33
Metrics: Measure Your Own Baseline, Quote Nobody Else's6:08
[LAB] The Weekly Report Nobody Has to Write6:16
Section 9 Wrap: The Paper Trail Builds Itself3:12

Section 10 Intro: The Queue Everyone Drowns In3:11
A Reported Phish, From the Defender's Side5:09
Learn how security automation with SOAR and Python handles reported phishing by examining report shapes, triage questions, and what automation must never do with a message.
[LAB] Parsing .eml Safely: Headers, Bodies, Attachments7:11
[LAB] Reading the Authentication Results: SPF, DKIM, DMARC7:17
[LAB] Extracting and Defanging URLs, Domains and Attachment Hashes6:12
Detonation and Sandboxing: What We Can and Cannot Show5:07
[LAB] Scoring the Report: Close, Escalate or Contain7:08
[LAB] The Whole Phishing Playbook Running on the Rig7:57
Section 10 Wrap: One Queue, Handled3:09

Requirements

Basic security familiarity: what an alert, an indicator of compromise and an incident are. Python is taught as a tool, so prior Python helps but is not required
A computer that can run Python 3 and Docker for the lab bench; all tools used in the labs are free to install

Description

“This course contains the use of artificial intelligence.”

This is the rebuilt, hands-on edition of Security Automation with SOAR & Python. Instead of a slide tour of platforms, you build one working automation rig on your own machine and keep extending it until the end of the course. Most content lectures are screen-recorded labs marked [LAB]: every command is run on camera, and the output you see is the output it really printed.

The rig is a Docker bench with an alert source (Wazuh), threat-intelligence sources (MISP and a TAXII 2.1 server), an open-source orchestrator (Shuffle), a case-management sink (DFIR-IRIS) and a notification sink. Alongside it you write the toolkit: your own installable, tested Python package. By the capstone it is a version-controlled, scheduled automation with an audit trail and a rollback path.

You start with what automation is for and what it must never do, using NIST SP 800-61 Revision 3 as the incident-response spine. Then Python is taught as a tool for security data: nested JSON, streams, pydantic validation, honest exit codes, structured logging and a command-line tool with a dry-run flag. You call real APIs safely, with authentication, pagination, rate limits and backoff, retries that do not double-fire, secrets kept out of code and least-privilege tokens, and you test API code without touching the API.

From there you turn raw events into decisions: field maps, indicator extraction and defanging, deduplication and correlation, Sigma rules, a severity score you can defend, and allowlists that do not blind you. Threat intelligence is automated with STIX 2.1, TAXII 2.1 and PyMISP while respecting TLP 2.0 handling rules. Playbooks are designed before they are coded, including the vendor-neutral CACAO 2.0 format, then run both in the orchestrator and in plain Python.

The applied sections cover end-to-end phishing triage (safe .eml parsing, SPF, DKIM and DMARC results, scoring to close, escalate or contain), containment with the guardrails on (dry-run, protected-asset allowlists, approval gates with timeouts, expiry, rollback and a kill switch), case records that draft the notification from the evidence, where AI assistance fits and where it must not act, and running automation in production with tests, a CI pipeline, packaging and health checks.

The course is defensive end to end and vendor-neutral. Commercial SOAR and EDR consoles are discussed as concepts only, and it says so on screen; every lab runs on the course's own bench. Regulatory reporting clocks (NIS2, DORA, SEC Item 1.05, CIRCIA) are explained with their scope stated precisely, and the course is not legal advice.

You also get thirteen downloadable working documents, from the playbook design spec and the automation guardrail checklist to the phishing triage runbook and the human-oversight policy, plus the course repository as a download, so the artefacts you build are ones you can take to work.

Who this course is for:

SOC analysts and incident responders who want to automate repetitive triage without losing control of what the automation does
Security and detection engineers who want portable Python automation instead of skills tied to one vendor's playbook canvas
IT and security staff building their first SOAR playbooks who want a vendor-neutral, hands-on foundation

Security Automation with SOAR & Python (2026 Edition)

What you'll learn

Explore related topics

Course content

Section 1: What Automation Is For11 lectures • 1hr 4min

Section 2: The Rig — A Bench You Can Rebuild From Nothing9 lectures • 51min

Section 3: Python That Survives Contact With Security Data10 lectures • 59min

Section 4: Talking to Security Tools Without Surprises10 lectures • 59min

Section 5: From Raw Event to Decision9 lectures • 55min

Section 6: Threat Intelligence, Automated10 lectures • 57min

Section 7: Playbooks — Design Before Code9 lectures • 51min

Section 8: The Orchestrator9 lectures • 52min

Section 9: Cases, Evidence and the Reporting Clock9 lectures • 51min

Section 10: Phishing Triage, End to End9 lectures • 52min

Requirements

Description

Who this course is for: