Course · Training · Workshop

Agentic Blue Teaming

Two days hands-on: detection, triage, threat hunting and incident response with LLM agents — so your blue team keeps pace with GenAI-assisted attacks.

Attackers work with GenAI and LLM agents: phishing scales in any language, recon takes minutes and the window between CVE and exploitation shrinks to hours. A blue team that works every alert by hand loses this race. In this course you build agentic workflows for defense: LLM agents connected via MCP to SIEM, EDR, threat intelligence and ticketing that enrich alerts, propose threat hunting hypotheses, write and test detection rules and prepare incident response. The human decides, the agent does the legwork. Just as important: where agents fail in the SOC. You learn to spot hallucinations and prompt injection via log data, run agents with minimal privileges and make their work measurable. At the end you have an agentic blue team stack you can transfer to your own environment.

Course content details ↓

In-house course

Tailored for your team.

Request

No suitable date?

Request a new public date.

Request a date

What participants say

The course was highly educational. I discovered many tools and found the integration of these tools with AI into a developer environment extremely fascinating. I learned a lot about cutting-edge topics, which is especially impressive given the rapid evolution of the AI landscape. The knowledge I gained has already helped me improve and accelerate my own processes, significantly enhancing my daily workflow.

Achim
Cloud Platform Solution Architect, Helvetia Versicherungen Schweiz

* Voices from this or related courses.

These customers booked courses in the same topic cluster.More customers →

Content

This training is for engineers who want to bring their blue team up to the pace of GenAI-assisted attacks with LLM agents. You work in a lab environment with realistic telemetry and simulated attacks.

The course consists of the following topics and can be extended or adapted to the audience. For in-house courses we can work with your SIEM and EDR stack on request.

Understanding GenAI attack patterns

How LLM agents accelerate the cyber kill chain
GenAI phishing, voice cloning and deepfake fraud: which traces remain?
Threat modeling with MITRE ATT&CK and MITRE ATLAS
Hands-On: analyze the telemetry of a GenAI-assisted attack in the lab

The agentic blue team stack

Agent architecture: planning, tool use, context and memory
MCP integration with SIEM, EDR, threat intelligence and ticketing
Cloud vs. local models: data protection for log and customer data
Hands-On: set up an agent harness connected to the lab SIEM

Alert triage and enrichment

Agents enrich alerts with asset, identity and threat intel context
Summaries and prioritization for analysts
Spotting hallucinations: back every statement with evidence
Hands-On: build a triage agent and test it against an alert flood

Detection engineering with agents

Write, test and tune Sigma rules with LLM assistance
Detection as code: tests, coverage against ATT&CK, CI pipeline
Hands-On: build and validate detections for the lab attacks

Threat hunting

Generate hypotheses and test them agentically across logs
Natural language to query (KQL, SPL, SQL) — and where it goes wrong
Hands-On: hunt for a hidden attacker in the lab

Incident response with agents

Timeline reconstruction, scoping and report drafts
Response actions with human-in-the-loop and approval levels
Hands-On: work an incident as a team with agent support

Securing the agents themselves

Prompt injection via logs, emails and tickets
Least privilege, sandboxing, audit trail and kill switch
Measuring effectiveness: MTTD, MTTR, false positive rate
Hands-On: attack and harden your own triage agent

At the end of the two days you have built a working agentic blue team stack, know its limits and know how to bring it safely into your environment.

The actual course content may differ from the above depending on the trainer, delivery, duration and the composition of participants.

Goal

Participants can use LLM agents productively and safely in the blue team. They build agentic workflows for alert triage, enrichment, threat hunting, detection engineering and incident response, connect security tooling via MCP and run the agents with least privilege, human-in-the-loop and an audit trail. They know the patterns of GenAI-assisted attacks and can build and validate detections for them.

Duration

2 days

Format

Consistently hands-on in an isolated lab environment with SIEM, EDR telemetry and simulated attacks. Short technical inputs, then implementation. The trainer demonstrates proven agent setups and prompt and context strategies from real-world practice.

Target group

Security engineers, SOC analysts, detection engineers, incident responders and platform and system engineers with security responsibility. For leadership there is the course Defense in the Age of Agentic Attacks.

Prerequisites

Experience with Linux, networking and logs. Basic knowledge of a SIEM or detection rules is helpful. Scripting basics (e.g. Python or Bash). No LLM experience required.

Preparation

Every participant receives a questionnaire and instructions for accessing the course infrastructure after registration. We provide each participant with a lab environment with SIEM, telemetry, an agent harness and access to cloud and local LLMs.

Request this course in-house

Request a public date

No suitable public date? Register without obligation — once there is enough interest we schedule a new public date and let you know first.

More about agentic blue teaming

LLM agents connect language models to real tools and work through multi-step tasks on their own. In the SOC this means enrichment, correlation and summaries take seconds instead of minutes. To do this safely you need clear guardrails — minimal privileges, traceable decisions and protection against manipulated input from logs and tickets.

Further resources:

History and development

The SOC evolved from manual log review through SIEM correlation to SOAR playbooks. Playbooks automated fixed procedures but failed at anything unpredictable — the work stayed with the analysts.

With capable LLMs and tool integration via protocols like MCP from 2024, agents emerged that understand context and plan investigation steps on their own. At the same time attackers use the same technology — the blue team has to catch up without creating new attack surface.