AI for Cybersecurity Operations is a course in bringing AI and LLMs into SOC work on top of Wazuh, covering alert triage, threat intelligence enrichment, automated pipelines in n8n, threat hunting and safe AI-assisted incident response. It suits SOC analysts, Wazuh administrators and incident responders who want to cut repetitive work while keeping people in charge of decisions.
Most SOC teams are not short of data. They are buried in alerts that must be opened one at a time, switching screens to look up IPs or hashes, rewriting queries for every hunt and spending hours turning incidents into reports. AI and LLMs can take a lot of this work off their hands, but used without a framework they bring their own risks: answers that sound right but are wrong, logs full of personal data leaking to external services, and attackers who plant instructions in logs to mislead the AI.
This course builds on SOC and SIEM with Wazuh. It does not repeat Wazuh installation or basics, and instead shows learners how to bring AI into every stage of SOC work. Learners connect Wazuh to a locally run LLM, design alert triage prompts that return structured, measurable output, enrich alerts with threat intelligence and build an automated triage pipeline in n8n. They then use AI to hunt for threats, connect Wazuh to an AI agent through MCP, draft incident timelines and reports, and find detection gaps against MITRE ATT&CK. A human reviews every step before a decision is made, and the course closes with a capstone in a simulated AI-assisted SOC. (2 days, 6 hours per day, 12 hours in total, Intermediate level.)
Course Details
A 2-day course, 6 hours per day (12 hours in total, 09:00-16:00), alternating lectures with labs. Intermediate level. The course builds on SOC and SIEM with Wazuh and does not repeat Wazuh installation or basic rule writing. Instead it starts straight away on bringing AI into SOC work, from alert triage, threat intelligence enrichment and threat hunting to incident response and detection engineering. Every lab runs on the learner's own machine with Docker, using simulated log data. Learners use a local LLM through Ollama, or their own or company API key, with API usage billed by actual use, and free accounts of their own for threat intelligence services. Learners take home a lab guide, a set of SOC prompts, n8n workflow files and Python scripts.
Section 1: AI in the SOC: Where It Helps and Where It Hurts
Section 2: Lab: Connecting Wazuh to a Local LLM
Section 3: Lab: Prompts for Alert Triage
Section 4: Lab: Enrichment with Threat Intelligence
Section 5: Lab: An Automated Triage Pipeline with n8n
Section 6: Lab: AI-Assisted Log Analysis and Rule Writing
Section 7: Lab: Threat Hunting in Natural Language
Section 8: Lab: Connecting Wazuh to an AI Agent through MCP
Section 9: Lab: AI-Assisted Incident Response
Section 10: Lab: Detection Engineering with AI
Section 11: Governing the Risks of AI in the SOC
Section 12: Workshop: Capstone AI-Assisted SOC
No public rounds are open right now. Join the waiting list and we will contact you first when the next round opens, or ask us on LINE. Or call 02-570-8449 or 088-807-9770
Design prompts so the LLM returns a fixed structure, such as JSON with severity, reasoning and evidence from the logs, rather than free text. Enrich alerts with threat intelligence before sending them to the model, and measure accuracy against a set of alerts analysts have already judged. Decisions with real impact, such as closing a case or isolating a host, should still require human approval.
Logs contain text attackers control, such as user agents, file names or email content. An attacker can plant instructions there so that an LLM reading the logs decides an event is harmless, or so an agent takes actions it should not. To reduce the risk, always treat log content as data rather than instructions, limit the agent's permissions and require human approval before any action that changes systems.
Start by sending Wazuh alerts into an n8n workflow. Enrich them, for example by checking IPs or hashes against threat intelligence services, then pass them to an LLM with a prompt that returns structured output. Route the results by severity, send any case that needs action through an analyst approval step first, and post a summary to the team's channel.
It suits tier 1 and tier 2 SOC analysts who want to cut alert triage time, Wazuh or SIEM administrators, and incident responders or threat hunters who want AI help with analysis. You should be able to use Wazuh and understand agents, decoders and rules, or have completed the SOC and SIEM with Wazuh course, know MITRE ATT&CK basics, and write basic Python and use the Linux command line.
You will be able to connect Wazuh to a local or API-based LLM, design alert triage prompts with measurable accuracy, build automated triage and enrichment pipelines in n8n, use AI to draft threat hunting queries, incident timelines, reports and new detection rules, and put controls in place for the risks of AI in the SOC. Participants who complete the training receive a Certificate of Completion with its own number, which can be verified online.
Bring a laptop with at least 16 GB of RAM that can run Docker Desktop, with permission to install software, because every lab runs on your machine in Docker with simulated logs. You can use a local LLM through Ollama or your own or your company's API key, with API usage charged according to actual use, and threat intelligence services are used with your own free accounts.
LLM applications, from chatbots and RAG systems to AI agents that call tools on their own, are moving into real business systems. Their weaknesses are unlike those of ordinary web applications. Plain text in an email or a document can instruct the model to do…
Many organisations already have firewalls and antivirus, yet they still cannot see what is happening on their own machines and servers from day to day. Logs are scattered in many places and nobody looks at them until something breaks, so when a real incident…
Traditional automation follows conditions written in advance, so it stalls on a message that does not fit the pattern or a question that needs data from several places. Agentic AI changes this by letting an LLM interpret the request, plan, and choose which…
