AI + SOC 101 Bootcamp: Building Modern Security Operations Skills with AI Integration - Rod Soto - DCTSG2027
Description
Name of Training: AI + SOC 101 Bootcamp: Building Modern Security Operations Skills with AI Integration
Trainer(s): Rod Soto
Skill Level: Intermediate
Dates: March 5 – March 6, 2027
Time: 9 am to 5 pm
Venue: TBD
Early Bird Cost: S$3,700 (incl. GST, until Dec 31, 2026)
Regular Cost: S$4,000 (incl. GST)
Short Summary
Learn core Security Operations Center (SOC) skills enhanced with AI-powered tooling in an intensive, lab-driven bootcamp. Students will work through realistic SOC analyst workflows—log analysis, detection, investigation, and response—while integrating modern AI/LLM tools into their processes. This course is designed to bridge traditional SOC fundamentals with AI-driven detection, analysis, and automation, preparing participants for today’s rapidly evolving security landscape.
Course Description
Learn core Security Operations Center (SOC) skills enhanced with AI-powered tooling in an intensive, lab-driven bootcamp. Students will work through realistic SOC analyst workflows—log analysis, detection, investigation, and response—while integrating modern AI/LLM tools into their processes. This course is designed to bridge traditional SOC fundamentals with AI-driven detection, analysis, and automation, preparing participants for today’s rapidly evolving security landscape.
Course Outline
View full outline
Hide outline
Day 1 - Morning
Modern SOC Architecture and Detection Engineering
- Evolution from conventional SIEM/EDR/SOAR to AI-assisted and agentic SOC workflows
- SOC telemetry pipelines, incident triage, threat hunting, and detection lifecycle
- MITRE ATT\&CK, adversarial behaviors, and detection coverage
- Human-in-the-loop (HITL), human-on-the-loop (HOTL), and autonomy boundaries
Security Telemetry and Investigation
- Windows Security Events, Sysmon, Linux logs, and process/network activity
- Network telemetry: Zeek, Suricata, DNS, HTTP, and packet evidence
- Splunk ingestion, searches, correlation, and evidence normalization
- Detection engineering: SPL searches, validation, and false-positive reduction
- Hands-on Exercise: Investigate suspicious endpoint and network activity in Splunk
Day 1 - Afternoon
LLM Integration for Security Operations
- LLM inference, context windows, prompting, structured outputs, and limitations
- Running local models with Ollama; privacy, accuracy, and data-handling tradeoffs
- Evidence-grounded summarization and retrieval-augmented security context
Agent Architecture and Model Context Protocol
- Agent models, instructions, memory, tools, harnesses, hooks, and skills
- MCP servers, tool invocation, permissions, and trust boundaries
- Single-agent versus multi-agent investigation and orchestration patterns
- Agent identity, audit traces, telemetry, and tool execution controls
- Hands-on Exercise: Connect a local LLM to SOC telemetry and produce a structured investigation
Day 2 - Morning
Building Agentic SOC Investigation Workflows
- Connecting AI agents to Splunk APIs and MCP-enabled security tools
- Triage, investigation, enrichment, detection, and response agent roles
- Investigation planning, evidence retrieval, correlation, and ATT\&CK mapping
- Reusable agent skills, structured tool results, and evidence provenance
- Hands-on Exercise: Build an agent that queries telemetry and drafts an evidence-based investigation report
Multi-Agent SOC Architecture and Orchestration
- Supervisor/orchestrator patterns, delegation, handoffs, and shared context
- Specialized agents for triage, investigation, threat intelligence, and response
- Cross-agent observability: traces, tool calls, decisions, and outcome validation
- Policy approval gates, error handling, reliability, and human oversight
- Hands-on Exercise: Coordinate multiple defensive agents through a simulated incident
Day 2 - Afternoon
Defending Against Rogue Agents and Adversarial Agentic Swarms
- Legitimate, compromised, unauthorized, and malicious AI agents
- Adversarial swarms: coordinated reconnaissance, repeated tool use, and distributed actions
- Threat surfaces: MCP servers, agent skills, hooks, memory, identities, credentials, and APIs
- Prompt injection, memory poisoning, tool misuse, excessive agency, and exfiltration
- Detection of rogue processes, anomalous MCP invocations, and unusual automation patterns
- Cross-host and cross-agent correlation with Sysmon, Zeek, Suricata, and Splunk
- Mapping observed attacker behavior to MITRE ATT\&CK and MITRE ATLAS
- Containment: tool restrictions, token revocation, isolation, approval, and rollback
- Hands-on Exercise: Detect a simulated rogue-agent swarm and enforce policy-gated containment
Agentic SOC Observability, Governance, and Response
- Prompt, response, tool-call, and agent decision telemetry in Splunk
- Agent behavioral baselines, forensic reconstruction, and auditing
- OWASP Agentic AI security risks and mitigation practices
- Response verification, risk management, and operational effectiveness metrics
Final Capstone: Defend an Agentic SOC Against an Adversarial Swarm
- Investigate simulated coordinated rogue-agent activity; correlate evidence and agent identities
- Produce findings, propose approved containment, verify outcomes, and document rollback
- CTF-style scenario with practical investigation artifacts and evaluation criteria
Difficulty Level
Beginner - Intermediate — Designed for students with foundational IT knowledge, basic networking familiarity, and comfort using the Linux command line. The course builds on these skills through hands-on labs in SOC investigation, detection engineering, and AI-assisted security operations, progressing to agentic workflows and multi-agent defense. No prior SOC, Splunk, or AI experience is required.
Suggested Prerequisites
Students should have:
- A basic understanding of networking concepts, including TCP/IP, DNS, and HTTP/HTTPS.
- Familiarity with basic Linux command-line operations.
- General awareness of cybersecurity threats and terminology.
- Comfort working through technical exercises and hands-on labs.
Prior SOC, Splunk, scripting, or AI experience is helpful but not required.
Suggested Prerequisites
- Students should have foundational IT knowledge and basic networking familiarity.
- The course builds on this baseline to develop practical SOC analyst skills with integrated AI tooling.
- No prior SOC or AI experience is required.
- Basic understanding of networking concepts (TCP/IP, DNS, HTTP/HTTPS)
- Familiarity with Linux command-line operations
- General awareness of cybersecurity threats and terminology
- Comfort with technical content and hands-on labs
What Students Should Bring
- Laptop with at least 16 GB RAM (32 GB recommended)
- Ability to run virtual machines (VMware Workstation)
- Minimum 50 GB of free disk space; ability to plug SSD USB
- Administrative privileges on the laptop
Note: Apple M-series laptops are not compatible with the course VMs; Intel/AMD x86-64 architecture is required.
What the Trainer Will Provide
Pre-configured virtual machine images with all required tools and lab environments Comprehensive course workbook with exercises and reference materials Access to lab scenarios and synthetic datasets Detection rule templates and practical examples Resource guides for continued self study after the course
Trainer(s) Bio
Rod Soto has over 15 years of experience in information technology and cybersecurity, with deep expertise in Security Operations Centers. He has served as a SOC support engineer, SOC engineer, security emergency response analyst, and incident responder, and currently works as a detection engineer and researcher on Splunk’s Cisco Threat Research Team. His previous roles include positions at Prolexic/Akamai, Splunk UBA, and JASK (SOC automation).
Rod is an accomplished cybersecurity competitor and educator. He won the Black Hat Las Vegas CTF in 2012 and the Red Alert ICS CTF at DEF CON 2022. He has presented at DEF CON, Black Hat, RSA Conference, Splunk .CONF, DerbyCon, BSides events, HackMiami, and numerous ISSA, ISC2, and OWASP chapters. His work and commentary have appeared in major media outlets including Rolling Stone, Pentest Magazine, Forbes, VICE, BBC, Univision, Fox News, and CNN.
Rod’s current research at Splunk–Cisco focuses on securing AI and LLM ecosystems, including:
- Developing the Splunk Technology Add-on for Ollama to monitor Shadow AI deployments. LLMGateway monitoring for online model providers.
- Creating detection frameworks for Microsoft 365 Copilot security threats.
- Publishing on monitoring MCP servers (open-source LLM MCP Security Monitoring Tool).
- Using RAG with Splunk ESCU and MLTK to build AI-enhanced security detections aligned with the MITRE ATLAS framework.
- Agentic Swarm Attacks & Defense
He combines frontline SOC experience, active research, and a strong teaching background to deliver training that is both practical and current.
Proficiency Exam
Students will demonstrate proficiency by accurately performing alert triage, applying threat detection techniques, conducting structured incident analysis, and completing clear response documentation; successful completion requires achieving at least 70% on practical scenario-based assessments.
Registration Terms and Conditions
Trainings are refundable before January 29, 2027, minus a non-refundable processing fee of $350.
Between January 30, 2027 and February 28, 2027 partial refunds will be granted, equal to 50% of the course fee minus a processing fee of $350.
All trainings are non-refundable after Feb 28, 2027.
Training tickets may be transferred to another student. Please email us at training@defcon.org for specifics.
If a training does not reach the minimum registration requirement, it may be cancelled. In the event the training you choose is cancelled, you will be provided the option of receiving a full refund or transferring to another training (subject to availability).
Failure to attend the training without prior written notification will be considered a no-show. No refund will be given.
DEF CON Training may share student contact information, including names and emails, with the course instructor(s) to facilitate sharing of pre-work and course instructions. Instructors are required to safeguard this information and provide appropriate protection so that it is kept private. Instructors may not use student information outside the delivery of this course without the permission of the student.
By purchasing this ticket you agree to abide by the DEF CON Training Code of Conduct and the registration terms and conditions listed above.
Several breaks will be included throughout the day. Please note that food is not included.
All courses come with a certificate, contingent on attendance at 75% of course sessions. Students who pass the end-of-course evaluation will be issued a certificate of proficiency. All other students with sufficient course attendance will be issued a certificate of completion. Students are responsible for making sure their attendance is recorded at the start of the day and after returning from lunch.
