Learning path
Building an AI Security Analyst from Scratch
Skill Level
Intermediate
Duration 3 hours 20 minutes
Updated May 6, 2026
About this learning path
Transform an empty AI platform into a working SOC analyst across four hands-on labs. Build Red Team skills for reconnaissance and credential attacks, Blue Team skills for endpoint and network investigation, and Correlation skills that tie six data sources into a unified threat timeline. Implement Human-in-the-Loop governance and learn why how you prompt matters more than which model you use.
Your instructors
Prerequisites
- Basic SOC experience — understanding of alert triage workflows, SIEM concepts, and familiarity with the MITRE ATT&CK framework
- Linux command line comfort — navigating directories, running scripts, editing files in VS Code or similar editor
- Windows and Active Directory fundamentals — event logs (logon, process creation), domains, users, groups, and privilege concepts
- Networking basics — understanding of common protocols (SMB, DNS, HTTP, RDP, Kerberos) and what network traffic reveals
- No prior AI, LLM, or OpenClaw experience required — the learning path teaches this from scratch
What you'll learn
- Build a dual-persona AI security assistant (Red Team + Blue Team) with human-in-the-loop governance controls that prevent unintended execution
- Create AI skills that wire into 6 live data sources — Wazuh XDR, Security Onion, Windows Events, Sysmon, Active Directory, and Suricata
- Investigate real security alerts using AI-powered multi-source correlation — querying all data sources simultaneously instead of one at a time
- Diagnose and fix broken AI configurations — the practical debugging skills needed for real-world AI tool deployment
- Apply prompt engineering to transform raw security data into actionable intelligence — detecting automation signatures, timing anomalies, and behavioral patterns that no static SIEM rule can catch
- Produce structured, executive-ready security assessments from self-directed investigations — the same output expected of a senior SOC analyst