Trainer Bio: Sindre Breda is a Solutions Architect at Graphistry; former Chief Inspector at Kripos (Norwegian National Criminal Investigation Service); former senior analyst at the Defendable MSSP. Expert in SOC automation, security graph intelligence, and GenAI for investigations.

Leo Meyerovich, PhD is Founder and CEO of Graphistry and co-creator of Louie.ai; pioneer in GPU-accelerated visual graph intelligence. Leo led the teams that won the US Cyber Command AI Alert RPE, created the first OSS GPU graph query language, and helped launch open-source ecosystems including Apache Arrow and NVIDIA RAPIDS. He works closely with government agencies, major enterprises, and financial institutions on data-intensive investigation technology across cybersecurity, fraud, and national intelligence. Leo holds a PhD in Computer Science from UC Berkeley, where his work was awarded two SIGPLAN 10-Year Test of Time awards, multiple best paper awards, and contributed to R&D at Microsoft, Mozilla, Qualcomm, and Adobe.

The instructor team also includes additional Louie.ai staff – senior practitioners with backgrounds across enterprise SOCs, MSSPs, SIEMs, genAI, ML/AI, GPU computing, and government agencies..

Full Course Description:
Most teams can already get useful help from tools like Claude or ChatGPT on isolated tasks. Few can run a multi-step investigation across logs, tools, and incidents without the system breaking down. If your AI is 70% accurate per task, a 10-step investigation lands around 3%, and this course shows how to build an agent that beats that math. The problem is not model quality alone: investigations are multi-step, ambiguous, and tool-heavy, so small errors compound, and you cannot simply carry over AI coding practices because assumptions like unit tests no longer apply.

Over two days you work alongside leaders in generative AI for security through primers, hands-on labs, and open discussion. In a cyber range you choose a prompt-first or code-first path and apply AI to core workflows – contextualization, timelining, deep investigation, triage, and reporting – against a real multi-domain CTF spanning endpoint, cloud, identity, and email incidents. You build practical fluency with LLMs, agents, MCPs, skills, memory, self-planning, semantic layers, and evals, and you run an eval-driven loop where you watch your own accuracy score move because of a change you made. Every technique uses free and open-source tools you can keep using on Monday (for example Claude Code and OpenCode), with an optional hosted environment and API credits provided.

You leave with a working investigation agent, a reusable timelining skill, an eval loop you have run yourself, and a defensible, evidence-based opinion about what AI can and cannot do in your SOC.

Knowledge/Experience/Prerequisites: Basic familiarity with security operations (logs, alerts, investigations). Helpful but not required: comfort reading or writing a little Python. The course has a full no-code (prompt-first) path, so non-coding analysts can complete every lab. No prior AI, ML, or agent experience needed; the course builds from fundamentals. No GPU required. Suggested pre-work (sent before class): a modern browser and, optionally, an agent harness such as Claude Code or OpenCode installed if you want to use the bring-your-own path

What attendees need to bring: A laptop with a modern web browser and WiFi, plus its power adapter. No GPU required. Optional for the code-first path: a working Python 3 environment, or use the provided hosted notebooks. Optional: a preinstalled agent harness (Claude Code or OpenCode) to use your own tooling; free hosted access and API credits are provided during class

Trainer Bio: David Formby is co-founder and CEO/CTO of Fortiphyd Logic, a cybersecurity company specializing in OT/ICS security training through realistic virtual industrial environments. He holds a PhD in Electrical and Computer Engineering from Georgia Tech, where his research focused on offensive and defensive security for industrial control systems, including demonstrating the first proof-of-concept ransomware attack on a PLC. He went on to create GRFICS, an open-source 3D ICS simulation now used by thousands of practitioners for hands-on training. David has presented research on securing PLCs and ICS security training at both industry and academic conferences including S4, RSA, and Black Hat. He currently leads Fortiphyd Logic in innovating cyberphysical ranges.

Full Course Description:
Using GRFICSv3, a free open-source ICS simulation, students deploy a working chemical plant environment on their own laptop at the start of the session. The rest of the day runs a single unified scenario from two perspectives.

In the morning, students work through a structured attack chain: network reconnaissance, protocol-level abuse, and lateral movement into the control network, culminating in causing the simulated reactor to explode in the 3D simulation.

In the afternoon, students switch sides. Using Suricata IDS, Wazuh SIEM/EDR, and router/firewall capabilities including DNS logging and ARP monitoring, they detect and mitigate the attack chain they just executed.

OT professionals will recognize the environments and the consequences. IT and general security professionals will find the tooling familiar and the industrial context new. Both groups leave with skills they can apply immediately.

The lab runs on Docker, costs nothing, and belongs to the student after the course.

Knowledge/Experience/Prerequisites: Some Linux experience is helpful but not necessary.

What attendees need to bring: Students are required to bring a laptop.

Trainer Bio: Security Onion Solutions instructors have years of experience in threat hunting, enterprise security monitoring, and log management. They have worked in real-world operational security roles, engineered monitoring strategies and solutions, and handled real-world incidents. They bring their practical experience to the classroom, enabling students in both theory and hands-on application to hunt adversaries in environments large and small.

Full Course Description:

Students in this class will also receive a FREE voucher to take the Security Onion Certified Professional (SOCP) Exam!

The class will cover the following topics:

• Security Onion Console
• Security Onion System Architecture
• Security Onion Workflows
  • Alert Triage & Case Creation with SOC Alerts and Cases
  • Threat Hunting with SOC Hunt and Dashboards
  • Detection Engineering
• Grid Management
  • Users
  • Firewalls
  • Monitoring
  • Troubleshooting
• Tuning the Grid
  • Berkeley Packet Filters
  • Performance Tuning – Zeek and Suricata
  • Data Pipeline Tuning – Logstash and Elasticsearch
  • Alert Tuning
• Customizing Security Onion Console
• Integrating Endpoint Telemetry
• Capstone Capture the Flag Event
• Multiple Labs and Case Studies

Knowledge/Experience/Prerequisites:
Security Onion Essentials Training Course – Available Here (2 hours; free)
Students should also have a basic understanding of networks, TCP/IP, and standard protocols such as DNS, HTTP, SSL, etc. Knowledge/experience with Linux is recommended, but not required.

What attendees need to bring: Students may want to bring writing utensils to take notes in their provided course books. Security Onion Solutions will provide a training laptop to each student.