systemdesign.academya hands-on course, built on a real attack in a real lab
Hands-On AI SOC Analyst: Build AI Agents for Security Operations
- a real attack in your AWS lab
- AI agents in LangGraph
- you approve every change
- ₹3,333 or $100, lifetime access
- early access: 12 of 77 pages ready
You start by doing the job yourself. You watch a real password-guessing attack hit a machine in your own lab, find it in the logs by hand, and write the ticket. Then you build AI agents that do the same investigation, show you their evidence, and wait for you to approve anything they want to change. Finally you measure how often they are right.
One payment, lifetime access. It rises to ₹7,777 or $177 once every part is released, and everything published later is included.
Early access: 12 of the 77 pages are ready to read today. New pages are added as they are finished, and you get each one the day it is published, at no extra cost. The price rises to ₹7,777 or $177 when the course is complete.
Written by Roni Das. Every number on this page comes from a recorded run, and each one says when it was measured.
- lab tested
- 13 November 2026
- SIEM
- Wazuh 4.14.10, on its own server in your AWS lab
- attack
- 10 wrong SSH passwords, then the right one
- time
- 36 seconds from the first wrong password to the login
- result
- Wazuh's most serious alert fired: the attacker got in
Try the job on real alerts from our lab
Triage a real attack yourself, then decide whether the AI agent's proposal may go ahead
These are the alerts Wazuh raised in our own cloud lab when an attacker guessed a password. Make the call an analyst makes, then see what the AI agent proposes and decide whether it may go ahead. As you work, the MITRE ATT&CK techniques behind each alert light up, and the attack graph grows, the way the course builds it in Part 7.
The simulator loads as you reach it: seven kinds of alert from our lab, your call on each, and the agent's proposal for you to approve.
Try a free exercise first
Each one is a real situation with a hint and a full worked answer, built from the same Wazuh lab as the course.
The attacks you run on your own lab, so the agents have something real to find
Every attack runs only inside your own lab, against machines you own, using public tools. Each one has a known answer, so you can check what Wazuh caught and what the agents said.
- Password guessing against SSH, then one successful login.
- A new user account created quietly, and a scheduled task that keeps the attacker in.
- A file changed in a folder that should never change.
- Discovery commands an attacker runs after getting in.
- An outdated package with a known vulnerability.
- A log line that carries a hidden instruction for the AI agent.
- A recorded multi-step attack from the public OTRF Security-Datasets project, which you hunt for step by step.
your own AWS account · a private network
- The attackera Kali Linux machine in the same lab12 SSH tries
- The lab serverUbuntu, with the Wazuh agent watching its logsevents, port 1514
- The Wazuh managerturns the events into alerts17 alerts
- The Wazuh indexerbuilt on OpenSearch: every alert, searchablea read-only account
- The triage agent you buildreads the alerts and proposes what to doa proposal
- A person approvesnothing changes until you say yes
Part 7: the same alerts become an attack graph in Neo4j, so you can see the whole attack at once.
What Wazuh raised when we ran a real password-guessing attack on our own course lab
This is the attack the whole course is built on, run for real in our own AWS lab before the page went up. Wazuh flagged each wrong guess, then the pattern of guessing, and then, when the right password followed the wrong ones, rule 40112 fired at level 12. Two details are lessons in themselves. There were 10 wrong passwords but 11 failed logins in the server's log, because the server hangs up after six tries and the tool tried that password again. And there were only 10 "sshd: authentication failed" alerts, because the eighth failure crossed Wazuh's brute-force threshold and was reported as rule 5763 instead. The course also checks the tactic names that Wazuh attaches to each technique against the current ATT&CK release, because they lag behind it.
17 alerts from the attacker, 13 November 2026, in our AWS lab
1First, each wrong password is flagged
- rule 5760level 510 alerts“sshd: authentication failed.”
- rule 5503level 52 alerts“PAM: User login failed.”
The server logged 11 failures for 10 passwords, because it hung up after six tries and one password was tried again.
MITRE ATT&CK T1110.001, password guessing
2Next, the repeated failures are flagged as brute force
- rule 5763level 101 alert“sshd: brute force trying to get access to the system. Authentication failed.”
- rule 2502level 102 alerts“syslog: User missed the password more than one time.”
- rule 5758level 81 alert“Maximum authentication attempts exceeded.”
MITRE ATT&CK T1110, brute force
3Last, one success after many failures
- rule 40112level 121 alert“Multiple authentication failures followed by a success.”
- rule 5501level 32 alerts“PAM: Login session opened.”
MITRE ATT&CK T1078, valid accounts, and T1110 on rule 40112
Why an AI agent for alert triage is the right first security agent to build
Hands-On AI SOC Analyst is a self-paced, hands-on course by Roni Das on systemdesign.academy. A security operations centre, or SOC, is the team that watches a company's computers for signs of attack. In this course you first learn the analyst's job yourself, on your own lab in your own AWS account, built around Wazuh, a free tool that collects logs and raises alerts: you run a real attack against a machine you own, find it in the logs by hand and write the ticket. Then you build AI agents with LangGraph, a Python library for building agents, that investigate alerts with read-only tools, check public threat intelligence (shared lists of addresses and files known to be malicious) and draft the incident report, while a person approves every action. Finally you measure how often the agents are right. It is for people who are comfortable with the terminal and a little Python. No security experience is needed.
Analysts in a SOC spend most of their day on one question: is this alert real? Most alerts turn out to be harmless, and the few that matter look almost the same as the rest. That repetitive, careful checking is exactly the kind of work an AI agent can help with, as long as a person stays in charge.
Alert triage is also an honest place to learn about agents. The agent has real evidence to read, every verdict can be checked against what really happened, and a wrong action, such as blocking the wrong address, has a real cost. So the design in this course never lets the model change anything by itself. It reads, it explains, and it asks.
There is one danger that is special to security. The logs the agent reads are partly written by the attacker. A username in a login log can contain an instruction aimed at the agent. You will send that attack against your own agent on purpose, watch a simple agent fall for it, and then build the defence.
What you build in this course: a working security lab and a small AI SOC team
The lab runs in your own AWS account: a Wazuh server, an Ubuntu practice server, a Kali Linux attacker and the administrator's computer, in a private network that nothing on the internet can reach. It costs about 18 cents an hour while it runs and about 1 cent an hour while it is stopped. You set a budget alert before anything is built, but an alert only sends an email, so the course has you stop the lab after every session; one command deletes everything and checks that nothing is left.
- Your own security lab in the cloud. Wazuh, a free and open source SIEM, on its own server, with a Linux practice server, a Kali Linux attacker and, if you want, a Windows server that records its activity with Sysmon.
- Detections you wrote yourself. Wazuh rules and Sigma rules, each mapped to MITRE ATT&CK, tested against attacks you ran with Atomic Red Team, and kept in Git with an automatic check.
- The AI SOC team. A triage agent, an enrichment agent, a hunting agent and a report writer, built with LangGraph, each with narrow read-only tools, and a supervisor that runs the case.
- Human approval for every action. The agents may propose blocking an address. A person sees the evidence and approves, edits or refuses it, and only then does Wazuh act.
- An attack graph. Hosts, users, addresses and ATT&CK techniques in Neo4j, so you can see the path an attacker took and the agent can ask the graph questions.
- Honest numbers. An evaluation on a labelled set of real alerts from your lab: missed attacks, false alarms, wrong actions, time and cost per alert, including where the agents still fail.
What you leave the course with
- A working lab and a small AI SOC team in your own GitHub repository, which you can show in an interview.
- The skills a tier 1 SOC analyst and a junior detection engineer use every day.
- A clear answer to a question many security teams now ask: what can an AI agent safely do here, and how do we know it works?
your path through the course
From building your own lab to running a team of AI agents with a person in charge
Each step below is a real part of the course, with its page count. You do every job by hand before an agent does it, and the last part is a capstone and the interview preparation.
- StartStart here3 pages
- Part 1The SOC from zero8 pages
- Part 2Wazuh, a real SIEM, hands-on10 pages
- Part 3MITRE ATT&CK and detection engineering9 pages
- Part 4Threat intelligence and threat hunting, by hand6 pages
- New partVulnerabilities and the software supply chain9 pages
- Part 5AI agents from zero, for analysts8 pages
- Part 6The AI SOC team9 pages
- Part 7Attack graphs with Neo4j6 pages
- You are an AI SOC analystProve it, and get the job: 9 pages, with the capstone and interview preparation.
Who this SOC analyst course is for, and what you should know before you start
- People who want their first SOC analyst job and want to learn the work from the beginning, on real tools, with a portfolio to show at the end
- Working SOC analysts who want to understand AI SOC tools from the inside, and to build and measure agents themselves
- Software and DevOps engineers moving into security who already write code and want to learn how detection and incident response really work
Before you start, you should know
- The terminal: you can move around and run commands
- Python: you can read and change a short program
- An AWS account: you can sign in and paste a command we give you
You do not need to know
- Any security experience: every security idea is explained from zero before it is used
- Any AI experience: Part 5 starts from what a language model really does
Roni Das writes the System Design Masterclass and the AI Engineering course on systemdesign.academy, 989 lessons in all, as well as AIOps on AWS and two full-length handbooks on freeCodeCamp. Every run, screenshot and number in each published page comes from a real run, and each page says when it was recorded.
How the course is delivered: written pages, a lab you run yourself, and a check after each idea
A written page for every lesson
Each page starts with a real problem from a shift in a SOC, explains why it matters, shows the idea in a diagram, and then has you run it on your own lab.
Real screenshots and code you can download
What you see on the page comes from a real run. Each page with code comes with a zip of its code and a start-here note.
A knowledge check after each idea
A short check follows each idea and each page, so you know you have it before you move on.
Free and public tools only
Wazuh, Sigma, MITRE ATT&CK, LangGraph and Neo4j are free or open source. Free threat-intelligence services are used with your own free keys and within their terms.
The contents of AI SOC Analyst, part by part, and which pages will be free
The course is laid out like a book: 77 pages, made of 3 opening pages and 9 parts. Pick a part, then open any page to see what it teaches and where its lab runs.
The 4 free pages
- Introduction: what this course buildsfree, read now
- Before you startfree, read now
- What a security operations centre does all dayfree, read now
- What an AI agent isfree, read now
How the course is released. The course is released part by part, in book order. 12 of its 77 pages are published so far, and every new page appears here as soon as it is out, at no extra cost to anyone who has bought the course.
What a SOC is for, what an alert and a log really are, and how a junior analyst works through the queue, all done by hand before any tool helps.
Who works in a SOC, what tier 1, tier 2 and tier 3 analysts do, and why most of the day is deciding which alerts matter.
Open this pageTrue and false positives in plain words, alert fatigue, and why a quiet SOC is not the same as a safe one.
Where the lab runs: hands-on in your own AWS account
Open this pageWhere logs come from on Linux, Windows, macOS and the network, and why the time, the host and the user matter in every line.
Where the lab runs: hands-on in your own AWS account
Open this pageRunning a real SSH password-guessing attack against a lab machine and finding it in the auth log with grep before any tool helps.
Where the lab runs: hands-on in your own AWS account
Open this pageThe event IDs an analyst learns first (4624, 4625, 4688, Sysmon 1 and 3), read from public sample logs and from the Windows server in your own lab.
Where the lab runs: hands-on in your own AWS account
Open this pageThe stages of a real intrusion, so that every alert later in the course has a place in a story.
Where the lab runs: hands-on in your own AWS account
Open this pageOne alert worked from start to finish by hand, with the questions an experienced analyst asks every time.
Where the lab runs: hands-on in your own AWS account
Open this pageWhat goes in a ticket (what happened, the evidence, the impact and the next step), and the habits that make a ticket useful at 3 in the morning.
Where the lab runs: reading, plus small scripts on your own computer
Open this page
The early-access price of AI SOC Analyst, and why it is lower now
The course is released part by part, so it sells at an early-access price today. Once every part is released, the price rises to ₹7,777 or $177. If you buy now, you pay once and get every part as it comes out, at no extra cost.
Early access: 12 of the 77 pages are ready to read today. New pages are added as they are finished, and you get each one the day it is published, at no extra cost. The price rises to ₹7,777 or $177 when the course is complete.
Not sure yet? Read the free pages first.
See every page in the contentssystemdesign.academy
receipt · AI SOC Analyst
- 77 pages in 9 parts
- included
- Parts published later
- included
- Code zips
- included
- Full price, later
- ₹7,777 or $177
- You save today
- ₹4,444 or $77
Total, one payment₹3,333 or $100
lifetime access
Buy early accessIn India you pay in rupees through Razorpay, by UPI, card or netbanking. Outside India you pay in US dollars by card through Razorpay, or with PayPal.
Questions people ask before buying the AI SOC Analyst course
What do I need to know before I start this SOC analyst course?
You should be comfortable with the terminal and able to read and change a short Python program, and you need an AWS account of your own for the lab. You do not need any security experience: every security idea is explained from zero before it is used, and the AI agents only arrive in Part 5, after you have triaged alerts by hand.
Are all the parts of AI SOC Analyst available on the day I buy?
No. The course has 77 pages. The course is released part by part, in book order. 12 of its 77 pages are published so far, and every new page appears here as soon as it is out, at no extra cost to anyone who has bought the course. That is why it sells at an early-access price, ₹3,333 in India or $100 elsewhere, which rises to ₹7,777 or $177 once every part is released. Everything published later is included in the one payment.
Do I need a powerful computer for the lab?
No. The lab runs in your own AWS account, and your computer only runs VS Code, Python and the AWS command-line tool. The lab costs about 18 cents an hour while it runs, about 1 cent an hour while it is stopped, and roughly $5 to $7 of AWS time for the whole course. The page "Before you start" sets a $10 budget alert before anything is built, and one command deletes everything and checks that nothing is left.
What if my AWS account is not allowed to run the lab yet?
The lab needs your account to allow 12 virtual CPUs of ordinary EC2 machines, and some new accounts start with less. You can check this for free before you pay: the page "Before you start" gives the one command that checks it, and asking AWS for more is a free request. While you wait, the free pages "What a security operations centre does all day" and "What an AI agent is" work from the real alerts saved in their zips, with no lab running.
Do I need to pay for an AI model?
Yes, a small amount: you need an API key for one model provider. On the free page "What an AI agent is", one agent run cost us between $0.00025 and $0.00046. The page "Knowing what each investigation costs" builds a cost log, so you see the tokens, the money and the seconds every investigation took.
Is this a certification?
No. It teaches the job and gives you a portfolio in your own GitHub repository. It pairs well with an entry-level certification if your target employer asks for one.
Will I attack real systems?
You attack only the servers in your own lab, which are real machines in your own AWS account, using public tools. You never point a tool at anyone else's machine, and the lab's attacker cannot reach SSH on any machine outside your lab.
Is the course tied to one vendor?
No. Wazuh, Sigma, MITRE ATT&CK, LangGraph and Neo4j are all free or open source, and Sigma rules work in many SIEMs. The course uses no material from any employer and no private data.
Is AI SOC Analyst a video course or a text course?
It is a written course, laid out like a book of parts and pages. Every page is a written lesson with real screenshots from real runs, a diagram for each idea and a short knowledge check, and each page with code comes with a zip of that code. If videos are added to the pages later, they are included at no extra cost.
Is AI SOC Analyst included in the System Design, AI Engineering or AIOps courses?
No. It is its own course with its own price. Buying it gives lifetime access to all of its pages and code, including every part published later.
How do I pay for AI SOC Analyst?
In India you pay in rupees through Razorpay, by UPI, card or netbanking. Everywhere else you pay in US dollars by card through Razorpay, or with PayPal. The course unlocks on your account as soon as the payment is confirmed.