MGT551 Building and Leading Security Operations Centers


hide_responciveBundle AddonPriceAdd to Cart
Sans October Netwars BundleSGD$2,247.00
Sans October OnDemand BundleSGD$1,272.23

What You Will Learn

Information technology is so tightly woven into the fabric of modern business that cyber risk has become business risk. SOC teams are facing more pressure than ever before to help manage this risk by identifying and responding to threats across a diverse set of infrastructures, business processes, and users. Furthermore, SOC managers are in the unique position of having to bridge the gap between business processes and the highly technical work that goes on in the SOC. Managers must show alignment to the business and demonstrate real value – a challenge when the threats are constantly changing and sometimes unseen. How do we know our security teams are aligned to the unique threats facing our organization? How do we get consistent results and prove that we can identify and respond to threats in time to minimize business impact? And how can we build an empowering, learning environment where analysts can be creative and solve problems while focusing on the mission at hand?

MGT551 bridges this gap by giving students the technical means to build an effective defense and the management tools to build an effective team. From section one of this training, students will learn how to design their defenses around their unique organizational requirements and risk profile. They will learn how to combine SOC staff, processes, and technology in a way that promotes measurable results and covers all manner of infrastructure and business processes. Most importantly, they will learn how to keep the SOC growing, evolving, and improving over time.

Throughout this course, students can expect to learn key factors for success in managing a Security Operations Center (SOC), including:

  • Collecting the most important logs and network data
  • Building, training, and empowering a diverse team
  • Creating playbooks and managing detection use cases
  • Using threat intelligence to focus your budget and detection efforts
  • Threat hunting and active defense strategies
  • Efficient alert triage and investigation workflow
  • Incident response planning and execution
  • Choosing metrics and long-term strategy to improve the SOC
  • Team member training, retention, and prevention of burnout
  • SOC assessment through capacity planning, purple team testing, and adversary emulation


  • MGT551 has expanded from 2 days to 5 days. Days 1 & 2 remain largely the same with Days 3-5 being additional content.
  • We are often asked how SEC450 and MGT551 are different. Here are the primary differences:


While this course is focused on management and leadership, it is by no means limited to non-technical processes and theory. Throughout the five days of instruction, students will work on fifteen hands-on exercises covering everything from playbook implementation to use case database creation, attack and detection capability prioritization and visualization, and purple team planning, threat hunting, and reporting. Plus, students will have the opportunity to participate in a brand new iteration of Cyber42 Cybersecurity Leadership Simulation built specifically for MGT551! Attendees will leave with a framework for understanding where their SOC should be focusing its efforts, how to track and organize defensive capabilities, and how to drive, verify, and communicate SOC improvements.


  • Custom distribution of the Linux Virtual Machine containing free open-source SOC tools
  • MP3 audio files of the complete course lecture
  • Printed and Electronic Courseware
  • A digital download package that includes the above and more




This course does not have any specific prerequisites, but it is suggested that students have some experience in an operational security role. SANS courses such as SEC450: Blue Team Fundamentals: Security Operations and Analysis or MGT512: Security Leadership Essentials for Managers will give students a solid base-level understanding of the concepts that will be discussed.

Laptop Requirements

Important! Bring your own system configured according to these instructions!

A properly configured system is required to fully participate in this course. If you do not carefully read and follow these instructions, you will likely leave the class unsatisfied because you will not be able to participate in hands-on exercises that are essential to this course. Therefore, we strongly urge you to arrive with a system meeting all the requirements specified for the course.

Your host operating system must be either the latest version of Windows 10, macOS 10.15.x or later, or Linux that also can install and run VMware virtualization products described below. You also must have 8 GB of RAM or higher for the VM to function properly in the class.

It is critical that your CPU and operating system support 64-bit so that our 64-bit guest virtual machine will run on your laptop.

In addition to having 64-bit capable hardware, AMD-V, Intel VT-x, or the equivalent must be enabled in BIOS/UEFI.

Please download and install either VMware Workstation Pro 15.5.X+, VMware Player 15.5.X+ or Fusion 11.5+ on your system prior to the beginning of class. If you do not own a licensed copy of VMware Workstation or Fusion, you can download a free 30-day trial copy from VMware. VMware will send you a time-limited serial number if you register for the trial on its website.


CPU: 64-bit 2.0+ GHz processor or higher-based system is mandatory for this class (Important – Please Read: a 64-bit system processor is mandatory)

BIOS/UEFI: VT-x, AMD-V, or the equivalent must be enabled in the BIOS/UEFI

RAM: 8 GB (gigabytes) of RAM or higher is mandatory for this class (Important – Please Read: 8 GB of RAM or higher is mandatory)

Disk: 25 gigabytes of free disk space


  • Wireless Ethernet 802.11 B/G/N/AC
  • USB-A ports or an adapter to use a USB-A thumb drive if in person (version 3.0 compatibility highly recommended)


  • VMware Workstation, Workstation Player, or Fusion
  • The Linux virtual machine will be provided to students


Please verify before coming to class that you have the administrative permissions required to transfer a virtual machine from a USB drive to your hard disk and start it. Also verify that Windows Device Guard, DLP, or other host-based protections will not interfere with the USB transfer or VM startup. (This is a common issue with company-built PCs, so if you intend to bring a corporate laptop, please test this before the event.)

Your course media will now be delivered via download. The media files for class can be large, some in the 40 – 50 GB range. You need to allow plenty of time for the download to complete. Internet connections and speed vary greatly and are dependent on many different factors. Therefore, it is not possible to give an estimate of the length of time it will take to download your materials. Please start your course media downloads as you get the link. You will need your course media immediately on the first day of class. Waiting until the night before the class starts to begin your download has a high probability of failure.

SANS has begun providing printed materials in PDF form. Additionally, certain classes are using an electronic workbook in addition to the PDFs. The number of classes using eWorkbooks will grow quickly. In this new environment, we have found that a second monitor and/or a tablet device can be useful by keeping the class materials visible while the instructor is presenting or while you are working on lab exercises.

Author Statement

“Written to compliment my first SOC course (SEC450: Blue Team Fundamentals), MGT551 completes the security operations picture by introducing the best higher-level frameworks and organization tactics I’ve discovered throughout my career as a SOC analyst and manager for a large pharmaceutical company. By including hands-on application with state of the art open-source tools and methods for security operations, MGT551 delivers the complete package for SOC leaders. This course condenses years of knowledge and real-life experience with months of additional research to bring you the most important information to effectively and efficiently lead your security team to success.” – John Hubbard

“As someone who has been the victim of less than ideal processes, tools, and team structure, my goal with this course is to help ensure every organization’s blue team runs at peak efficiency and capability regardless of size and resources, and that no one must suffer through repeating mistakes so commonly made within the industry. This course is the culmination of 20 years of supporting, building, and leading security operations and I am incredibly excited to bring it to the SANS community.” – Mark Orlando

“[I] would and will recommend this course to some of my peers. I have been a security sales engineer for so many years, but was missing customer pain or customer side knowledge. This course has been spot on so far!” – Moises Acevedo, Recorded Future