{"product_id":"ai-soc-101-bootcamp-building-modern-security-operations-skills-with-ai-integration-rod-soto-sg2027","title":"AI + SOC 101 Bootcamp: Building Modern Security Operations Skills with AI Integration - Rod Soto - DCTSG2027","description":"\u003cp\u003e\u003cstrong\u003eName of Training:\u003c\/strong\u003e AI + SOC 101 Bootcamp: Building Modern Security Operations Skills with AI Integration\u003cbr\u003e\u003cstrong\u003eTrainer(s):\u003c\/strong\u003e Rod Soto\u003cbr\u003e\u003cstrong\u003eSkill Level:\u003c\/strong\u003e Intermediate\u003cbr\u003e\u003cstrong\u003eDates:\u003c\/strong\u003e March 5 – March 6, 2027\u003cbr\u003e\u003cstrong\u003eTime:\u003c\/strong\u003e 9 am to 5 pm\u003cbr\u003e\u003cstrong\u003eVenue:\u003c\/strong\u003e TBD\u003cbr\u003e\u003cstrong\u003eEarly Bird Cost:\u003c\/strong\u003e S$3,700 \u003cmeta charset=\"utf-8\"\u003e(incl. GST, until Dec 31, 2026)\u003cbr\u003e\u003cstrong\u003eRegular Cost:\u003c\/strong\u003e S$4,000 (incl. GST)\u003c\/p\u003e\n\u003ch3\u003eShort Summary\u003c\/h3\u003e\n\u003cp\u003eLearn core Security Operations Center (SOC) skills enhanced with AI-powered tooling in an intensive, lab-driven bootcamp. Students will work through realistic SOC analyst workflows—log analysis, detection, investigation, and response—while integrating modern AI\/LLM tools into their processes. This course is designed to bridge traditional SOC fundamentals with AI-driven detection, analysis, and automation, preparing participants for today’s rapidly evolving security landscape.\u003c\/p\u003e\n\u003ch3\u003eCourse Description\u003c\/h3\u003e\n\u003cp\u003eLearn core Security Operations Center (SOC) skills enhanced with AI-powered tooling in an intensive, lab-driven bootcamp. Students will work through realistic SOC analyst workflows—log analysis, detection, investigation, and response—while integrating modern AI\/LLM tools into their processes. This course is designed to bridge traditional SOC fundamentals with AI-driven detection, analysis, and automation, preparing participants for today’s rapidly evolving security landscape.\u003c\/p\u003e\n\u003ch3\u003eCourse Outline\u003c\/h3\u003e\n\u003cp\u003e\u003cstrong\u003eDay 1 - Morning\u003c\/strong\u003e\u003c\/p\u003e\n\u003cp\u003e\u003cstrong\u003eModern SOC Architecture and Detection Engineering\u003c\/strong\u003e\u003c\/p\u003e\n\u003cul\u003e\n\u003cli\u003eEvolution from conventional SIEM\/EDR\/SOAR to AI-assisted and agentic SOC workflows  \u003c\/li\u003e\n\u003cli\u003eSOC telemetry pipelines, incident triage, threat hunting, and detection lifecycle  \u003c\/li\u003e\n\u003cli\u003eMITRE ATT\\\u0026amp;CK, adversarial behaviors, and detection coverage  \u003c\/li\u003e\n\u003cli\u003eHuman-in-the-loop (HITL), human-on-the-loop (HOTL), and autonomy boundaries\u003c\/li\u003e\n\u003c\/ul\u003e\n\u003cp\u003e\u003cstrong\u003eSecurity Telemetry and Investigation\u003c\/strong\u003e\u003c\/p\u003e\n\u003cul\u003e\n\u003cli\u003eWindows Security Events, Sysmon, Linux logs, and process\/network activity  \u003c\/li\u003e\n\u003cli\u003eNetwork telemetry: Zeek, Suricata, DNS, HTTP, and packet evidence  \u003c\/li\u003e\n\u003cli\u003eSplunk ingestion, searches, correlation, and evidence normalization  \u003c\/li\u003e\n\u003cli\u003eDetection engineering: SPL searches, validation, and false-positive reduction  \u003c\/li\u003e\n\u003cli\u003e\u003cstrong\u003eHands-on Exercise: Investigate suspicious endpoint and network activity in Splunk\u003c\/strong\u003e\u003c\/li\u003e\n\u003c\/ul\u003e\n\u003cp\u003e\u003cstrong\u003eDay 1 - Afternoon\u003c\/strong\u003e\u003c\/p\u003e\n\u003cp\u003e\u003cstrong\u003eLLM Integration for Security Operations\u003c\/strong\u003e\u003c\/p\u003e\n\u003cul\u003e\n\u003cli\u003eLLM inference, context windows, prompting, structured outputs, and limitations  \u003c\/li\u003e\n\u003cli\u003eRunning local models with Ollama; privacy, accuracy, and data-handling tradeoffs  \u003c\/li\u003e\n\u003cli\u003eEvidence-grounded summarization and retrieval-augmented security context\u003c\/li\u003e\n\u003c\/ul\u003e\n\u003cp\u003e\u003cstrong\u003eAgent Architecture and Model Context Protocol\u003c\/strong\u003e\u003c\/p\u003e\n\u003cul\u003e\n\u003cli\u003eAgent models, instructions, memory, tools, harnesses, hooks, and skills  \u003c\/li\u003e\n\u003cli\u003eMCP servers, tool invocation, permissions, and trust boundaries  \u003c\/li\u003e\n\u003cli\u003eSingle-agent versus multi-agent investigation and orchestration patterns  \u003c\/li\u003e\n\u003cli\u003eAgent identity, audit traces, telemetry, and tool execution controls  \u003c\/li\u003e\n\u003cli\u003e\u003cstrong\u003eHands-on Exercise: Connect a local LLM to SOC telemetry and produce a structured investigation\u003c\/strong\u003e\u003c\/li\u003e\n\u003c\/ul\u003e\n\u003cp\u003e\u003cstrong\u003eDay 2 - Morning\u003c\/strong\u003e\u003c\/p\u003e\n\u003cp\u003e\u003cstrong\u003eBuilding Agentic SOC Investigation Workflows\u003c\/strong\u003e\u003c\/p\u003e\n\u003cul\u003e\n\u003cli\u003eConnecting AI agents to Splunk APIs and MCP-enabled security tools  \u003c\/li\u003e\n\u003cli\u003eTriage, investigation, enrichment, detection, and response agent roles  \u003c\/li\u003e\n\u003cli\u003eInvestigation planning, evidence retrieval, correlation, and ATT\\\u0026amp;CK mapping  \u003c\/li\u003e\n\u003cli\u003eReusable agent skills, structured tool results, and evidence provenance  \u003c\/li\u003e\n\u003cli\u003e\u003cstrong\u003eHands-on Exercise: Build an agent that queries telemetry and drafts an evidence-based investigation report\u003c\/strong\u003e\u003c\/li\u003e\n\u003c\/ul\u003e\n\u003cp\u003e\u003cstrong\u003eMulti-Agent SOC Architecture and Orchestration\u003c\/strong\u003e\u003c\/p\u003e\n\u003cul\u003e\n\u003cli\u003eSupervisor\/orchestrator patterns, delegation, handoffs, and shared context  \u003c\/li\u003e\n\u003cli\u003eSpecialized agents for triage, investigation, threat intelligence, and response  \u003c\/li\u003e\n\u003cli\u003eCross-agent observability: traces, tool calls, decisions, and outcome validation  \u003c\/li\u003e\n\u003cli\u003ePolicy approval gates, error handling, reliability, and human oversight  \u003c\/li\u003e\n\u003cli\u003e\u003cstrong\u003eHands-on Exercise: Coordinate multiple defensive agents through a simulated incident\u003c\/strong\u003e\u003c\/li\u003e\n\u003c\/ul\u003e\n\u003cp\u003e\u003cstrong\u003eDay 2 - Afternoon\u003c\/strong\u003e\u003c\/p\u003e\n\u003cp\u003e\u003cstrong\u003eDefending Against Rogue Agents and Adversarial Agentic Swarms\u003c\/strong\u003e\u003c\/p\u003e\n\u003cul\u003e\n\u003cli\u003eLegitimate, compromised, unauthorized, and malicious AI agents  \u003c\/li\u003e\n\u003cli\u003eAdversarial swarms: coordinated reconnaissance, repeated tool use, and distributed actions  \u003c\/li\u003e\n\u003cli\u003eThreat surfaces: MCP servers, agent skills, hooks, memory, identities, credentials, and APIs  \u003c\/li\u003e\n\u003cli\u003ePrompt injection, memory poisoning, tool misuse, excessive agency, and exfiltration  \u003c\/li\u003e\n\u003cli\u003eDetection of rogue processes, anomalous MCP invocations, and unusual automation patterns  \u003c\/li\u003e\n\u003cli\u003eCross-host and cross-agent correlation with Sysmon, Zeek, Suricata, and Splunk  \u003c\/li\u003e\n\u003cli\u003eMapping observed attacker behavior to MITRE ATT\\\u0026amp;CK and MITRE ATLAS  \u003c\/li\u003e\n\u003cli\u003eContainment: tool restrictions, token revocation, isolation, approval, and rollback  \u003c\/li\u003e\n\u003cli\u003e\u003cstrong\u003eHands-on Exercise: Detect a simulated rogue-agent swarm and enforce policy-gated containment\u003c\/strong\u003e\u003c\/li\u003e\n\u003c\/ul\u003e\n\u003cp\u003e\u003cstrong\u003eAgentic SOC Observability, Governance, and Response\u003c\/strong\u003e\u003c\/p\u003e\n\u003cul\u003e\n\u003cli\u003ePrompt, response, tool-call, and agent decision telemetry in Splunk  \u003c\/li\u003e\n\u003cli\u003eAgent behavioral baselines, forensic reconstruction, and auditing  \u003c\/li\u003e\n\u003cli\u003eOWASP Agentic AI security risks and mitigation practices  \u003c\/li\u003e\n\u003cli\u003eResponse verification, risk management, and operational effectiveness metrics\u003c\/li\u003e\n\u003c\/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFinal Capstone: Defend an Agentic SOC Against an Adversarial Swarm\u003c\/strong\u003e\u003c\/p\u003e\n\u003cul\u003e\n\u003cli\u003eInvestigate simulated coordinated rogue-agent activity; correlate evidence and agent identities  \u003c\/li\u003e\n\u003cli\u003eProduce findings, propose approved containment, verify outcomes, and document rollback  \u003c\/li\u003e\n\u003cli\u003eCTF-style scenario with practical investigation artifacts and evaluation criteria\u003c\/li\u003e\n\u003c\/ul\u003e\n\u003ch3\u003eDifficulty Level\u003c\/h3\u003e\n\u003cp\u003e\u003cstrong\u003eBeginner - Intermediate\u003c\/strong\u003e — Designed for students with foundational IT knowledge, basic networking familiarity, and comfort using the Linux command line. The course builds on these skills through hands-on labs in SOC investigation, detection engineering, and AI-assisted security operations, progressing to agentic workflows and multi-agent defense. No prior SOC, Splunk, or AI experience is required.\u003c\/p\u003e\n\u003ch2\u003e\u003cstrong\u003eSuggested Prerequisites\u003c\/strong\u003e\u003c\/h2\u003e\n\u003cp\u003eStudents should have:\u003c\/p\u003e\n\u003cul\u003e\n\u003cli\u003eA basic understanding of networking concepts, including TCP\/IP, DNS, and HTTP\/HTTPS.  \u003c\/li\u003e\n\u003cli\u003eFamiliarity with basic Linux command-line operations.  \u003c\/li\u003e\n\u003cli\u003eGeneral awareness of cybersecurity threats and terminology.  \u003c\/li\u003e\n\u003cli\u003eComfort working through technical exercises and hands-on labs.\u003c\/li\u003e\n\u003c\/ul\u003e\n\u003cp\u003ePrior SOC, Splunk, scripting, or AI experience is helpful but not required.\u003c\/p\u003e\n\u003ch3\u003eSuggested Prerequisites\u003c\/h3\u003e\n\u003cul\u003e\n\u003cli\u003eStudents should have foundational IT knowledge and basic networking familiarity.  \u003c\/li\u003e\n\u003cli\u003eThe course builds on this baseline to develop practical SOC analyst skills with integrated AI tooling.  \u003c\/li\u003e\n\u003cli\u003eNo prior SOC or AI experience is required.  \u003c\/li\u003e\n\u003cli\u003eBasic understanding of networking concepts (TCP\/IP, DNS, HTTP\/HTTPS)  \u003c\/li\u003e\n\u003cli\u003eFamiliarity with Linux command-line operations  \u003c\/li\u003e\n\u003cli\u003eGeneral awareness of cybersecurity threats and terminology  \u003c\/li\u003e\n\u003cli\u003eComfort with technical content and hands-on labs\u003c\/li\u003e\n\u003c\/ul\u003e\n\u003ch3\u003eWhat Students Should Bring\u003c\/h3\u003e\n\u003cul\u003e\n\u003cli\u003eLaptop with at least 16 GB RAM (32 GB recommended)  \u003c\/li\u003e\n\u003cli\u003eAbility to run virtual machines (VMware Workstation)  \u003c\/li\u003e\n\u003cli\u003eMinimum 50 GB of free disk space; ability to plug SSD USB  \u003c\/li\u003e\n\u003cli\u003eAdministrative privileges on the laptop\u003c\/li\u003e\n\u003c\/ul\u003e\n\u003cp\u003eNote: Apple M-series laptops are not compatible with the course VMs; Intel\/AMD x86-64 architecture is required.\u003c\/p\u003e\n\u003ch3\u003eWhat the Trainer Will Provide\u003c\/h3\u003e\n\u003cp\u003ePre-configured virtual machine images with all required tools and lab environments Comprehensive course workbook with exercises and reference materials Access to lab scenarios and synthetic datasets Detection rule templates and practical examples Resource guides for continued self study after the course\u003c\/p\u003e\n\u003ch3\u003eTrainer(s) Bio\u003c\/h3\u003e\n\u003cp\u003eRod Soto has over 15 years of experience in information technology and cybersecurity, with deep expertise in Security Operations Centers. He has served as a SOC support engineer, SOC engineer, security emergency response analyst, and incident responder, and currently works as a detection engineer and researcher on Splunk’s Cisco Threat Research Team. His previous roles include positions at Prolexic\/Akamai, Splunk UBA, and JASK (SOC automation).\u003c\/p\u003e\n\u003cp\u003eRod is an accomplished cybersecurity competitor and educator. He won the Black Hat Las Vegas CTF in 2012 and the Red Alert ICS CTF at DEF CON 2022. He has presented at DEF CON, Black Hat, RSA Conference, Splunk .CONF, DerbyCon, BSides events, HackMiami, and numerous ISSA, ISC2, and OWASP chapters. His work and commentary have appeared in major media outlets including Rolling Stone, Pentest Magazine, Forbes, VICE, BBC, Univision, Fox News, and CNN.\u003c\/p\u003e\n\u003cp\u003eRod’s current research at Splunk–Cisco focuses on securing AI and LLM ecosystems, including:\u003c\/p\u003e\n\u003cul\u003e\n\u003cli\u003eDeveloping the Splunk Technology Add-on for Ollama to monitor Shadow AI deployments. LLMGateway monitoring for online model providers.  \u003c\/li\u003e\n\u003cli\u003eCreating detection frameworks for Microsoft 365 Copilot security threats.  \u003c\/li\u003e\n\u003cli\u003ePublishing on monitoring MCP servers (open-source LLM MCP Security Monitoring Tool).  \u003c\/li\u003e\n\u003cli\u003eUsing RAG with Splunk ESCU and MLTK to build AI-enhanced security detections aligned with the MITRE ATLAS framework.  \u003c\/li\u003e\n\u003cli\u003eAgentic Swarm Attacks \u0026amp; Defense\u003c\/li\u003e\n\u003c\/ul\u003e\n\u003cp\u003eHe combines frontline SOC experience, active research, and a strong teaching background to deliver training that is both practical and current.\u003c\/p\u003e\n\u003ch3\u003eProficiency Exam\u003c\/h3\u003e\n\u003cp\u003eStudents will demonstrate proficiency by accurately performing alert triage, applying threat detection techniques, conducting structured incident analysis, and completing clear response documentation; successful completion requires achieving at least 70% on practical scenario-based assessments.\u003c\/p\u003e\n\u003chr\u003e\n\u003csection class=\"registration-terms\"\u003e\n\u003ch3\u003eRegistration Terms and Conditions\u003c\/h3\u003e\n\u003cp\u003eTrainings are refundable before January 29, 2027, minus a non-refundable processing fee of $350.\u003c\/p\u003e\n\u003cp\u003eBetween January 30, 2027 and February 28, 2027 partial refunds will be granted, equal to 50% of the course fee minus a processing fee of $350.\u003c\/p\u003e\n\u003cp\u003eAll trainings are non-refundable after Feb 28, 2027.\u003c\/p\u003e\n\u003cp\u003eTraining tickets may be transferred to another student. Please email us at training@defcon.org for specifics.\u003c\/p\u003e\n\u003cp\u003eIf a training does not reach the minimum registration requirement, it may be cancelled. In the event the training you choose is cancelled, you will be provided the option of receiving a full refund or transferring to another training (subject to availability).\u003c\/p\u003e\n\u003cp\u003eFailure to attend the training without prior written notification will be considered a no-show. No refund will be given.\u003c\/p\u003e\n\u003cp\u003eDEF CON Training may share student contact information, including names and emails, with the course instructor(s) to facilitate sharing of pre-work and course instructions. Instructors are required to safeguard this information and provide appropriate protection so that it is kept private. Instructors may not use student information outside the delivery of this course without the permission of the student.\u003c\/p\u003e\n\u003cp\u003eBy purchasing this ticket you agree to abide by the \u003ca href=\"https:\/\/defcon.org\/html\/links\/dc-code-of-conduct.html\"\u003eDEF CON Training Code of Conduct\u003c\/a\u003e and the registration terms and conditions listed above.\u003c\/p\u003e\n\u003cp\u003eSeveral breaks will be included throughout the day. Please note that food is not included.\u003c\/p\u003e\n\u003cp\u003e\u003cmeta charset=\"utf-8\"\u003eAll courses come with a certificate, contingent on attendance at 75% of course sessions. Students who pass the end-of-course evaluation will be issued a certificate of proficiency. All other students with sufficient course attendance will be issued a certificate of completion. Students are responsible for making sure their attendance is recorded at the start of the day and after returning from lunch.\u003c\/p\u003e\n\u003c\/section\u003e","brand":"Singapore 2027","offers":[{"title":"Default Title","offer_id":63496773501068,"sku":null,"price":3700.0,"currency_code":"SGD","in_stock":true}],"thumbnail_url":"\/\/cdn.shopify.com\/s\/files\/1\/0750\/9042\/8044\/files\/rodsoto.jpg?v=1784252534","url":"https:\/\/sg.shop.defcon.org\/products\/ai-soc-101-bootcamp-building-modern-security-operations-skills-with-ai-integration-rod-soto-sg2027","provider":"DEF CON SG","version":"1.0","type":"link"}