Overview What You Will Learn Curriculum Instructor

Course Overview

In today’s security operations environments, massive volumes of logs and telemetry make manual threat detection ineffective. This course focuses on applying modern machine Learning and language models to improve detection engineering and threat hunting. By combining data science techniques with real-world security use cases, learners gain practical skills to identify advanced threats, reduce false positives, and build scalable detection pipelines.

This course begins with data collection and initial log analysis, covering common log sources, formats, and hands-on data handling. It then moves into baseline and anomaly detection, followed by unsupervised clustering to extract patterns and create Sigma rules. You will explore autoencoders for detecting beaconing and command and control activity, and apply threat embeddings using transformer models like MiniLM for contextual log analysis. The course also introduces weak supervision with Snorkel for scalable labeling and classification, followed by LLM-assisted detection engineering with built-in guardrails. Finally, it covers governance, drift tracking, and operational metrics to ensure long-term reliability of deployed detection systems.

By the end of this course, you will design, build, and govern intelligent detection pipelines using machine learning and LLM techniques for modern threat detection and response operations.

What You Will Learn

  • Collect and analyze logs from Zeek and Windows Event Logs using Elastic and Splunk dashboards.
  • Apply statistical and machine learning techniques (z-scores, Isolation Forest, One-Class SVM) to detect anomalies in large datasets.
  • Use clustering methods (DBSCAN, HDBSCAN) to uncover rare events and convert them into practical Sigma detection rules.
  • Implement autoencoders, Fourier analysis, and sequence modeling to identify beaconing and command-and-control activity.
  • Leverage threat embeddings to cluster anomalies, group phishing incidents, and reduce false positives.
  • Build classifiers with weak supervision techniques using Snorkel and labeling functions without manual data annotation.
  • Enhance detection engineering with LLM-assisted Sigma rule generation and validation, ensuring safe and accurate rules.
  • Monitor drift, SOC KPIs, and retraining pipelines to sustain effective detection in evolving environments.

Program Curriculum

  • Lab Setup
  • Log Sources
  • Log Formats
  • Data Collection & Initial Analysis – Hands-on Exercise
  • Chapter 1 Quiz

  • Concepts
  • Baseline & Anomaly Detection – Hands-on Exercise
  • Chapter 2 Quiz

  • Applying Clustering
  • From Cluster Patterns to Sigma Rules
  • Unsupervised Clustering – Hands-on Exercise
  • Chapter 3 Quiz

  • Techniques
  • Autoencoders for Beaconing & C2 Detection – Hands-on Exercise
  • Chapter 4 Quiz

  • From Transformers to MiniLM for Log Analysis
  • Threat Embeddings for Contextual Linking – Hands-on Exercise
  • Chapter 5 Quiz

  • Concepts: Threat Hunting Integration
  • Build LFs, Label, Classify, & Check
  • Weak Supervision with Snorkel – Hands-on Exercise
  • Chapter 6 Quiz

  • Generate and Validate Queries/Rules with LLMs
  • Guardrails: Avoiding Drift & Unsafe Rules
  • LLM-assisted Detection Engineering – Hands-on Exercise
  • Chapter 7 Quiz

  • Drift Tracking and Retraining Pipelines
  • Chapter 8 Quiz
Load more modules

Instructor

Emre Çağlar HOŞGÖR

Emre Caglar has experience in cybersecurity for more than 10 years. Throughout his career, he worked in critical and large networks where encryption is an essential part of the security of networks. He learned cryptography and cryptanalysis by doing and excelled in his knowledge by getting a formal education from the Middle East Technical University. He is a security researcher and experienced security analyst. The author has a master’s degree in CS and is pursuing a Ph.D. in cybersecurity.

Join over 1 Million professionals from the most renowned Companies in the world!

certificate

Choose the Pro Plan That Fits Your Learning Journey

Invest in your future with flexible Pro subscription plans. Whether you're starting your cybersecurity journey or expanding your expertise, choose the membership duration that works for you and gain access to our complete learning platform.

Monthly Plans
Annual Plans
Save 20% with our annual plans!

Pro

Ideal for continuous learning, offering extensive resources with 900+ courses and diverse Learning Paths to enhance your skills.

$ 599.00
Billed annually or $69.00 billed monthly
Get Started Now
Start your 7-day trial for $1

What is included

  • Access to 900+ Premium Short Courses
  • 70+ Structured Learning Paths
  • Validation of Completion with All Courses and Learning Paths
  • New Courses Added Every Month
Early Access Offer

Pro +

Experience immersive learning with Practice Labs and CTF Challenges for comprehensive skill-building.

$ 699.00
Billed annually or $79.00 billed monthly
Get Started Now
Start your 7-day trial for $1

Everything in Pro and

  • 600+ Practice Labs with Guided Instructions
  • 400+ CTF Challenges with Detailed Walkthroughs
  • New Practice Labs and Challenges Added Every Month

Related Courses

  • Bootstrap 4 Quick Website Bootstrap Components Course
    Short Course

    Bootstrap 4 Quick Website Bootstrap Components Course

    Software Development

    Explore the basics of Bootstrap and learn to create a website...

    $49.99

    Beginner

    1 hr 30 m

  • CCNA - Understanding Routers and Switches
    Short Course

    CCNA - Understanding Routers and Switches

    Security Architecture and Operations

    A comprehensive guide to understanding the in-depth functioni...

    $49.99

    Intermediate

    2 hr 0 m

  • The Complete Full-Stack JavaScript Course
    Short Course

    The Complete Full-Stack JavaScript Course

    Software Development

    Learn full-stack web development using JavaScript (ReactJS, N...

    $79.99

    Beginner

    24 hr 17 m

  • React.JS for Ecommerce: Building a Store with React.JS
    Short Course

    React.JS for Ecommerce: Building a Store with React.JS

    DevSecOps

    From React.js Fundamentals to Crafting an Online Storefront

    $49.99

    Advanced

    3 hr 30 m

  • CISSP Certification Domains 5, 6, 7, and 8 Video Training
    Short Course

    CISSP Certification Domains 5, 6, 7, and 8 Video Training

    Cybersecurity

    This course is ideal for individuals who desire to pass the I...

    $69.99

    Intermediate

    6 hr 30 m

  • Helm 3 - Package Manager for Kubernetes
    Short Course

    Helm 3 - Package Manager for Kubernetes

    Software Development

    A must tool for every DevOps engineer

    $49.99

    Intermediate

    1 hr 27 m

  • Learn Ethical Hacking by Hacking Real Websites Legally
    Short Course

    Learn Ethical Hacking by Hacking Real Websites Legally

    Vulnerability Assessment and Pentesting

    Fun way to learn ethical hacking by playing online hacking ga...

    $69.99

    Beginner

    4 hr 18 m

  • Mastering Ansible Playbooks: Debugging and Security
    Short Course

    Mastering Ansible Playbooks: Debugging and Security

    Software Development

    Securing and Automating Linux and Windows Systems with Advanc...

    $99.99

    Advanced

    5 hr 34 m

1 50
View all