Security automation and threat intelligence with Python
You write SOAR-style playbooks in Python that handle STIX data, enrich IOCs and go from alert to action; every service is mocked in the lab.
Level 401 · 14 lessons · 12 practice labs
Lessons
Threat intelligence data
- STIX 2.1 objects and relationships
- Pulling indicators from a TAXII feed
- Handling MISP-style event data
- Short task: merge two feeds and remove duplicate indicators
Enrichment
- External API clients: keys, quotas and retries
- Testing offline with mocked services
- Caching results to protect your quota
- Short task: enrich and score an IOC from three sources
Playbooks
- Playbook design: trigger, decision, action
- Automatic review of a phishing report
- Approved containment: locking an account, blocking an IP
- Human approval, audit trail and rollback
- Short task: run an end-to-end playbook for a suspicious login alert
Wrap-up
- Capstone: a small SOAR pipeline from alert to report
Practice labs
- Indicators in a STIX bundle: Write a script that reads indicator objects from the given STIX 2.1 bundle and tables them with pattern, validity period and related threat actor.
- Merge two feeds and drop duplicates: Bring the indicators of two local feeds, one STIX and one MISP-style, into a common format and remove duplicates after normalising case and defanging differences.
- Pull only new items from a TAXII feed: Make a client that downloads the whole collection from the lab’s mock TAXII server every time incremental using paging and a last-pull timestamp, and show expired indicators drop out of the local store.
- Tests that mock the external service: Write the tests for a reputation-lookup client to run offline with mocked responses, and show they also cover quota-exceeded and timeout cases.
- Enrichment that burns the quota: Add a time-limited cache to an enrichment script that queries the same indicator repeatedly and exhausts the daily quota, and show by measurement that requests to the mock service drop.
- An IOC score from three sources: Build a tool that enriches an indicator from three local mock sources into a confidence score, returns a partial result without crashing when one source is down, and explains the score.
- First review of a phishing report: Write a script that extracts sender, links and attachment hashes from an email file forwarded by a Selvi Schools employee, compares them with the local indicator list and suggests a verdict.
- A playbook for a suspicious login: Write an end-to-end playbook that takes a suspicious-login alert, enriches it, decides severity and opens a ticket in the mock ticket system, and show two different alerts produce different outcomes.
- A playbook that runs twice: Make a playbook that opens a second ticket and repeats its action when the same alert arrives again idempotent, and show an interrupted run resumes where it stopped.
- An audit trail for every action: Add a module that records every playbook step with who, when and which input in a hash-chained, tamper-evident log.
- No account lock without approval: Add a human approval step to a playbook that locks accounts directly, and show no request reaches the mock directory service before approval and a rejected request is logged.
- Roll back a wrongly blocked address: Add rollback and a protected-address list to a playbook that wrongly blocked a partner’s address in the Windy Ridge Energy lab, and prove the state returns to the original after rollback.
About this course
You write SOAR-style playbooks in Python that handle STIX data, enrich IOCs and go from alert to action; every service is mocked in the lab.
What you will learn
- Threat intelligence data
- Enrichment
- Playbooks
- Wrap-up
Prerequisites
You should have practised the topics of the same path up to level 301.
Lab environment
Lessons run in your own Kali Linux terminal that opens in the browser. Nothing to install; the lab starts clean in every lesson.
Frequently asked questions
- Is this course right for my level?
- The course is at level 401; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.