Course syllabus:
This Live Virtual Class consists of 14 Modules in terms of AI Agents for Attack Investigation. They include essential theory combined with individual practice during the exercises as well as loads of hands-on tools and real-case scenarios.
Module 1: APT Attacks & MITRE ATT&CK
- 1. Understanding the advanced persistent threats
- 2. The attacker's tactics, techniques & procedures (MITRE ATT&CK)
- 3. The Incident Response Process for malware attacks
- 4. The APT Attack Vectors
- 5. Types of malware
- 6. Malware analysis process
Module 2: Introduction to AI
- 1. Fundamentals of AI and machine learning
- 2. Supervised vs. unsupervised learning approaches
- 3. Deep learning and neural network architectures
- 4. Generative AI and large language models
- 5. Diffusion models and image generation
- 6. Hands-on Lab: Exploring different LLMs for malware analysis and threat hunting
Module 3: Python Fundamentals for Security
- 1. Basic Python syntax and data structures
- 2. Working with files and python libraries
- 3. Security-focused Python libraries
- 4. Hands-on Lab: Writing simple Python scripts to parse pcap files
Module 4: Log Analysis with Sysmon
- 1. Initial Access & Log Analysis
- 2. Spearphishing attack detection
- 3. Detecting execution techniques
- 4. Analysis with Sysmon & Splunk
- 5. Writing SIGMA rules
Module 5: Building Your First AI Model with LangChain
- 1. LangChain framework overview
- 2. Prompt engineering and prompt templates
- 3. Creating simple chains for analysis
- 4. Hands-on Lab: Building a AI Agent for basic security analysis chain for alert triage
Module 6: Introduction to RAG
- 1. Retrieval-Augmented Generation fundamentals
- 2. Vector databases and embeddings
- 3. ChromaDB implementation
- 4. Hands-on Lab: Building a RAG system for APT malware analysis using security PDFs
Module 7: Advanced RAG Methodologies
- 1. Iterative retrieval techniques
- 2. Self-questioning and query refinement
- 3. Document relationship mapping
- 4. Hands-on Lab: Implementing an agent that generates follow-up questions based on initial document retrieval
Module 8: Tool Calling & Memory Management
- 1. Tool integration architecture
- 2. Custom tool development
- 3. MCP (Modular Capability Provider) tools and frameworks
- 4. Memory mechanisms in LLM applications
- 5. Conversation history management
- 6. Hands-on Lab: Building tools for IOC extraction and threat intelligence lookup
Module 9: Domain Investigation Agent
- 1. Building specialized security agents
- 2. Integrating OSINT tools (WHOIS, IP geolocation)
- 3. Domain reputation analysis
- 4. Hands-on Lab: Creating a comprehensive domain investigation agent with multiple tools
Module 10: LangChain & ReAct Model
- 1. ReAct pattern implementation
- 2. Reasoning and action cycles
- 3. Agent decision-making processes
- 4. Hands-on Lab: Building a security investigation agent using the ReAct pattern
Module 11: CrewAI and Multi-Agent Models
- 1. Multi-agent architecture design
- 2. Agent specialization and roles
- 3. Inter-agent communication
- 4. Hands-on Lab: Developing a security investigation team with specialized agent roles
Module 12: Introduction to n8n
- 1. n8n automation platform overview
- 2. Self-hosted deployment for secure environments
- 3. Security tool integrations (CrowdStrike, Splunk, etc.)
- 4. Data sovereignty and privacy considerations
- 5. Workflow automation for security tasks
- 6. Hands-on Lab: Setting up a self-hosted n8n instance and creating a basic workflow that integrates with AI agents
Module 13: Multimodal AI Agents
- 1. Vision capabilities for security applications
- 2. Screenshot analysis for phishing detection
- 3. Multimodal prompt engineering
- 4. Hands-on Lab: Building a phishing detection agent using browser screenshots and vision models
Module 14: AI Red Teaming & Security
- 1. Prompt injection vulnerabilities
- 2. Jailbreaking techniques and prevention
- 3. Data poisoning attacks
- 4. Security considerations for AI deployments
- 5. Hands-on Lab: Testing prompt injection attacks against security agents and implementing defenses
FAQ – AI Agents for Attack Investigation
How much does the course cost?
The course costs NOK 32,000 for three days of intensive, instructor-led training. Course materials, practical lab exercises and lifelong CQURE certification are included. Lunch and refreshments are included for classroom events only.
How long is the course?
The course runs over three days, with 24 hours of intensive cybersecurity training. The published course hours are 09:00–16:00 every day.
How is the course delivered?
The course is led by the CQURE experts in classroom, including practical exercises, hands-on tools and realistic cybersecurity investigation scenarios. The course material and instruction are in English.
Who should attend this course?
The course is designed for cybersecurity professionals who want to use AI agents and automation to improve security investigations, detection and response.
- Security analysts and threat hunters
- Security Operations Center (SOC) teams
- Incident responders and digital investigators
- Red team and purple team professionals
- Security engineers and developers
- Security architects and technical leaders
- Professionals developing AI-powered cybersecurity tools
What prerequisites are required?
The course is intended for professionals interested in applying AI to real-world cybersecurity challenges. The published description does not specify formal technical prerequisites. Previous experience with cybersecurity investigations, scripting or security tools will help participants benefit from the practical exercises.
What will I learn during the course?
You will learn how to develop and apply AI agents, Retrieval-Augmented Generation (RAG) and automated workflows to cybersecurity investigations. Key learning outcomes include:
- Understanding Advanced Persistent Threats (APTs) and MITRE ATT&CK
- Analysing security logs and investigating suspicious activity
- Developing AI-powered investigation agents using LangChain
- Building RAG systems for threat intelligence and malware analysis
- Creating investigation tools for IOC extraction and intelligence lookups
- Developing multi-agent security investigation workflows with CrewAI
- Automating security processes using n8n
- Applying multimodal AI to phishing investigations
- Identifying and mitigating AI-specific security vulnerabilities
Is the course hands-on?
Yes. Practical exercises are central to the course. Participants work with security logs, threat intelligence, AI agents, RAG systems and workflow automation through CQURE's custom lab exercises.
Which topics are covered?
The course includes 14 modules covering:
- APT attacks and MITRE ATT&CK
- AI and machine learning fundamentals
- Python fundamentals for security
- Log analysis with Sysmon and Splunk
- AI agents and LangChain
- Retrieval-Augmented Generation (RAG)
- Advanced RAG methodologies
- Tool calling and agent memory management
- Domain investigation agents and OSINT
- ReAct-based investigation agents
- Multi-agent orchestration with CrewAI
- Security automation with n8n
- Multimodal AI agents for phishing detection
- AI red teaming, prompt injection and security controls
Will I learn to build AI agents for security investigations?
Yes. You will build specialised agents for alert triage, domain investigation, IOC extraction, threat intelligence lookups and structured security analysis. The course also introduces tool integration, agent memory and decision-making using the ReAct pattern.
Does the course cover multi-agent systems?
Yes. Participants explore multi-agent architecture, agent specialisation, communication and coordination using CrewAI. Practical exercises include developing a security investigation team consisting of agents with different responsibilities.
Does the course cover RAG and knowledge management?
Yes. The course covers Retrieval-Augmented Generation, embeddings, vector databases and ChromaDB. Participants build RAG-based workflows for analysing security documents and supporting malware investigations.
Does the course include security automation with n8n?
Yes. Participants learn how to deploy n8n in self-hosted environments and create automated workflows that integrate AI agents with security tools. The course also addresses data privacy and data sovereignty considerations.
Does the course cover AI security and prompt injection?
Yes. The final module addresses prompt injection, jailbreaking, data poisoning and security controls for AI deployments. Participants practise assessing AI agent vulnerabilities and implementing defensive measures.
Which operating systems are used in the labs?
The exercises use Windows Server, Windows 10, Kali Linux and Ubuntu, providing practical experience with different security investigation environments.
Will I have access to the labs after the course?
Yes. The online lab environment remains available for an additional three weeks after the training, allowing participants to repeat exercises and consolidate their skills.
What language is the course delivered in?
Both the course materials and instructor-led training are in English.
Does the course include certification?
Yes. The course includes a lifelong CQURE certification awarded upon successful course completion, as described in the course information.
What makes this course valuable?
The course combines traditional cybersecurity investigation techniques with modern AI engineering. Participants gain practical experience building agents, integrating threat intelligence, coordinating multi-agent systems and automating investigations while learning to secure the AI systems they deploy.
Target audience
