Engineer the operation
Build connectors, parsers, custom detections and automation rather than learning each tool in isolation.
ADVANCED SECURITY ENGINEERING & AI SECURITYEngineer the
Engineer the
security operation.
Secure what’s next.
Go beyond monitoring alerts. Build data pipelines, detections and response workflows across Microsoft and CrowdStrike, with AI security built in.
Live instruction. Guided practice in every session.
40 hoursFocused, hands-on training
14 modulesConcept + guided live lab
5 platformsMicrosoft & CrowdStrike
24/7Real-time lab access
The programme
One complete workflow.
Two enterprise stacks.
Every session pairs a concept with a guided live lab. Apply the same investigation across Microsoft and CrowdStrike, and build work you can explain and demonstrate.
Practise from day one
Work in a live lab environment prepared by CyberDefend, with guided exercises and additional challenges.
Bring AI into the workflow
Use AI to accelerate investigations, verify its output and practise defending AI applications.
Your lab environment
Five platforms.
Real engineering practice.
24/7 access to the programme’s prepared lab environment. Explore realistic simulations safely, from phishing and credential abuse to ransomware behaviour and exfiltration.
Microsoft
Sentinel
Connect sources, write KQL, normalize logs, engineer detections and automate with Logic Apps.
Microsoft
Defender for Endpoint
Investigate device timelines and process trees, use Live Response and contain devices.
Microsoft
Defender XDR
Investigate unified incidents and hunt across endpoint, identity, email and cloud apps.
CrowdStrike
Falcon EDR
Triage detections, contain hosts and remediate with Real Time Response.
CrowdStrike
Falcon Next-Gen SIEM
Onboard and parse data, query with CQL, correlate events and automate with Falcon Fusion.
Product names identify the platforms covered in training; they do not imply vendor endorsement or accreditation.
The 40-hour curriculum
Four tracks.
One end-to-end capstone.
Open each module to see the topics and the practical work. The four learning tracks total 38 hours, followed by a 2-hour capstone.
19hSIEM engineering
12hEndpoint, XDR & CrowdStrike
3hIR & threat hunting
4hAI security
2hCapstone
01 / SIEM engineering with Microsoft Sentinel
01Security Engineering Foundations2 hours
- Modern SOC architecture: SIEM, XDR, EDR and SOAR
- Security engineering lifecycle and roles
- MITRE ATT&CK, Cyber Kill Chain and NIST CSF in practice
GUIDED LIVE LAB
Explore the live Microsoft and CrowdStrike environment.
02SIEM Architecture & Data Connectors3 hours
- Workspace design, data tiers, retention and cost
- Microsoft, Content Hub and third-party connectors
- Azure Monitor Agent and Data Collection Rules for Windows, Linux and Syslog/CEF
- Ingestion-time transformations and log validation
GUIDED LIVE LAB
Onboard endpoint, Linux and identity logs; verify ingestion.
03KQL for Security Engineering4 hours
- Filter, project, extend and summarize
- Joins, unions, watchlists and reusable functions
- Time-based analysis, baselines and rare-event detection
- Queries for sign-ins, processes, network and PowerShell
GUIDED LIVE LAB
Build an investigation and hunting query pack.
04Log Parsing & Normalization2 hours
- Parse, extract, regex and JSON
- Custom logs, tables and parser functions
- ASIM normalization across data sources
GUIDED LIVE LAB
Parse a raw custom log and normalize it to ASIM.
05Analytical Rules & Custom Detections4 hours
- Detection hypothesis to KQL, rule and incident
- Scheduled and near-real-time analytical rules
- Entity mapping and alert enrichment
- MITRE mapping, incident grouping and false-positive reduction
GUIDED LIVE LAB
Build, test and tune custom rules against controlled attack simulations.
06SOAR: Automation Rules & Logic Apps4 hours
- Triage, assignment and suppression rules
- Logic Apps triggers, connectors and managed identities
- Threat intelligence enrichment, approvals and Teams notifications
- User and device containment with human approval
GUIDED LIVE LAB
Automate alert enrichment, approval and containment end to end.
02 / Endpoint, XDR & CrowdStrike
07Microsoft Defender for Endpoint3 hours
- Endpoint architecture, onboarding and policies
- Device timelines and parent-child process analysis
- Attack Surface Reduction, indicators and response actions
- Live Response and Automated Investigation & Remediation
GUIDED LIVE LAB
Investigate a malicious PowerShell chain and isolate the lab device.
08Microsoft Defender XDR2 hours
- Unified endpoint, identity, email and cloud-app incidents
- Cross-domain advanced hunting and custom detections
- Automatic attack disruption and unified SecOps with Sentinel
GUIDED LIVE LAB
Trace a phishing-to-endpoint attack and turn the hunt into a detection.
09CrowdStrike Falcon EDR3 hours
- Falcon sensor, host groups and prevention policies
- Process trees and ATT&CK context
- Real Time Response, host containment and IOC management
GUIDED LIVE LAB
Triage simulated ransomware behaviour, contain and remediate the host.
10CrowdStrike Falcon Next-Gen SIEM4 hours
- Architecture, data onboarding and parsers
- CrowdStrike Query Language (CQL) for search and correlation
- Custom correlation rules and Falcon Fusion workflows
- Compare KQL and CQL across the two SIEM platforms
GUIDED LIVE LAB
Onboard a source, write a parser, build a correlation rule and automate response.
03 / Incident response & threat hunting
11Incident Response & Threat Hunting3 hours
- Triage, scoping, containment, eradication and recovery
- Investigation timelines, root cause analysis and reporting
- Hypothesis-driven and ATT&CK-led hunting in KQL and CQL
- Turn hunt findings into permanent detections
GUIDED LIVE LAB
Run a cross-platform incident and convert a hunt into a detection rule.
04 / AI security
12AI-Powered Security Operations2 hours
- Microsoft Security Copilot and CrowdStrike Charlotte AI
- Natural language to KQL/CQL and AI-assisted detection engineering
- Validate AI output for hallucinations, incorrect queries and overreliance
GUIDED LIVE LAB
Investigate an incident with AI, then verify every generated answer.
13Securing AI Systems2 hours
- OWASP Top 10 for LLM Applications and MITRE ATLAS
- Prompt injection, jailbreaks and sensitive data leakage
- Shadow AI discovery and AI workload monitoring
- AI governance: NIST AI RMF and ISO/IEC 42001
GUIDED LIVE LAB
Test prompt injection against a sample lab LLM application, then detect and block it.
Bring it all together
14Capstone: Defend a Live Attack2 hours
- Connect data engineering, detection, investigation and response
- Work across the Microsoft and CrowdStrike stacks
- Detect AI assistant abuse and validate AI-supported analysis
- Present a security engineering briefing
GUIDED LIVE LAB
Deliver an end-to-end response to a simulated multi-stage attack.
THE CAPSTONEFollow the attack.
Follow the attack.
Own the response.
A simulated phishing email leads to a compromised identity, suspicious sign-in, endpoint execution, an exfiltration attempt and AI assistant abuse.
Connect the full lifecycle and present your decisions as a security engineering briefing.
- Build the evidence
Onboard and parse data in both SIEMs. Test your threat hypothesis using KQL and CQL.
- Find and contain the threat
Build rules, investigate across Defender and Falcon, hunt for missed activity, then automate containment.
- Defend the AI layer
Detect and block prompt injection. Use AI to support analysis and validate every output.
- Present your engineering
Explain the evidence, detection logic, response choices and opportunities to improve.
Who it’s for
Build on your experience.
Designed for security and IT professionals developing practical security engineering capability.
A good fit for
- SOC analysts moving into engineering
- Security engineers developing multi-platform skills
- Incident responders and threat hunters
- Cloud and infrastructure teams taking on SecOps
- IT professionals moving into security
- Security leads building AI capability
BEFORE YOU START
Your foundation
- Networking and operating-system fundamentals
- Cybersecurity awareness
- A problem-solving mindset
- Commitment to hands-on practice
No prior KQL or scripting experience is required.
Your portfolio
Finish with work
you can demonstrate.
Build evidence of your skills through practical outputs, from your first query pack to your final engineering briefing.
KQL & CQL query library
Custom detection rules
SOAR playbooks & workflows
Incident & hunt reports
AI security assessment
Capstone briefing
Support for your next step
Resume and LinkedIn profile preparation, scenario-based interview practice, and certification path guidance for SC-200, CrowdStrike Falcon certifications and AI security credentials.
Explore certification offersBefore you join
A clear picture of the programme.
How is the programme delivered?
The planned programme contains 40 hours across 14 modules. Each session combines concepts with a guided live lab. Contact us for the next cohort’s timetable and delivery arrangements.
How does 24/7 lab access work?
The programme includes a prepared real-time lab environment accessible around the clock. Confirm the access period, technical requirements and support arrangements for your cohort before enrolling.
Do I need KQL or scripting experience?
No prior KQL or scripting experience is required. Networking, operating-system fundamentals and cybersecurity awareness are expected. Share your background if you would like help assessing the fit.
Does the programme include a vendor certification or exam?
The programme includes certification path guidance. Ask which completion credential, assessments or exam benefits are included in your offer. Vendor certification and discounted exam offers have their own requirements and terms.
What are the fees and start dates?
Contact the Academy team for current fees, upcoming cohort dates and enrolment terms. An enquiry does not commit you to a booking.
YOUR NEXT STEPBuild the skills.
Build the skills.
Show the work.
Tell us your background. Get the next cohort dates, fees and lab access terms from the Academy team.
Ask about the next cohort · WhatsApp
Prefer to call? 080 74426200