AI for Cybersecurity Operations is a course in bringing AI and LLMs into SOC work on top of Wazuh, covering alert triage, threat intelligence enrichment, automated pipelines in n8n, threat hunting and safe AI-assisted incident response. It suits SOC analysts, Wazuh administrators and incident responders who want to cut repetitive work while keeping people in charge of decisions.
Most SOC teams are not short of data. They are buried in alerts that must be opened one at a time, switching screens to look up IPs or hashes, rewriting queries for every hunt and spending hours turning incidents into reports. AI and LLMs can take a lot of this work off their hands, but used without a framework they bring their own risks: answers that sound right but are wrong, logs full of personal data leaking to external services, and attackers who plant instructions in logs to mislead the AI.
This course builds on SOC and SIEM with Wazuh. It does not repeat Wazuh installation or basics, and instead shows learners how to bring AI into every stage of SOC work. Learners connect Wazuh to a locally run LLM, design alert triage prompts that return structured, measurable output, enrich alerts with threat intelligence and build an automated triage pipeline in n8n. They then use AI to hunt for threats, connect Wazuh to an AI agent through MCP, draft incident timelines and reports, and find detection gaps against MITRE ATT&CK. A human reviews every step before a decision is made, and the course closes with a capstone in a simulated AI-assisted SOC. (2 days, 6 hours per day, 12 hours in total, Intermediate level.)
Course Details
A 2-day course, 6 hours per day (12 hours in total, 09:00-16:00), alternating lectures with labs. Intermediate level. The course builds on SOC and SIEM with Wazuh and does not repeat Wazuh installation or basic rule writing. Instead it starts straight away on bringing AI into SOC work, from alert triage, threat intelligence enrichment and threat hunting to incident response and detection engineering. Every lab runs on the learner's own machine with Docker, using simulated log data. Learners use a local LLM through Ollama, or their own or company API key, with API usage billed by actual use, and free accounts of their own for threat intelligence services. Learners take home a lab guide, a set of SOC prompts, n8n workflow files and Python scripts.
Section 1: AI in the SOC: Where It Helps and Where It Hurts
Section 2: Lab: Connecting Wazuh to a Local LLM
Section 3: Lab: Prompts for Alert Triage
Section 4: Lab: Enrichment with Threat Intelligence
Section 5: Lab: An Automated Triage Pipeline with n8n
Section 6: Lab: AI-Assisted Log Analysis and Rule Writing
Section 7: Lab: Threat Hunting in Natural Language
Section 8: Lab: Connecting Wazuh to an AI Agent through MCP
Section 9: Lab: AI-Assisted Incident Response
Section 10: Lab: Detection Engineering with AI
Section 11: Governing the Risks of AI in the SOC
Section 12: Workshop: Capstone AI-Assisted SOC
No public rounds are open right now. Join the waiting list and we will contact you first when the next round opens, or ask us on LINE. Or call 02-570-8449 or 088-807-9770
Built for Tier 1 and Tier 2 SOC analysts who want to cut the time spent triaging and investigating alerts · Wazuh or SIEM administrators who want LLMs to help with detection and log analysis · Incident responders and threat hunters who want AI to help with analysis and reporting Background you should have: Working knowledge of Wazuh agents, decoders, rules and the dashboard, or completion of SOC and SIEM with Wazuh · A basic understanding of SOC workflows and MITRE ATT&CK Not sure the fit is right? Talk to our team on LINE @itgenius or call 02-570-8449.
THB 8,900 (currently THB 8,010 on promotion). The course runs 12 hours. The price excludes 7% VAT (for payment in a company's name). Pay by bank transfer to the company account, confirm it on our payment page, and we can issue the receipt or tax invoice in your company's name.
Yes. Everyone who completes the course receives a Certificate of Completion from IT Genius Institute. Each certificate carries its own number, and anyone holding that number can verify it online on our certificate page, so you can add it to your portfolio or pass it to HR as evidence of training.
You can attend onsite at IT Genius Institute or arrange to join online, and we also run it as a private in-house session for your team. Ask about dates and venues on LINE @itgenius or call 02-570-8449.
Yes. You may retake the same course free of charge in a later round, under the institute's conditions. Tell our team which course and round you attended, and we will check it and offer you the rounds that still have seats. Ask us on LINE @itgenius or call 02-570-8449.
Enrol online with the registration form on this page. You can register several attendees at once and enter your tax ID and billing address for the tax invoice. Or request a company quotation straight from the quote button. For anything else call 02-570-8449 or reach us on LINE @itgenius.
LLM applications, from chatbots and RAG systems to AI agents that call tools on their own, are moving into real business systems. Their weaknesses are unlike those of ordinary web applications. Plain text in an email or a document can instruct the model to do…
Many organisations already have firewalls and antivirus, yet they still cannot see what is happening on their own machines and servers from day to day. Logs are scattered in many places and nobody looks at them until something breaks, so when a real incident…
Traditional automation follows conditions written in advance, so it stalls on a message that does not fit the pattern or a question that needs data from several places. Agentic AI changes this by letting an LLM interpret the request, plan, and choose which…
