Private corporate batches, live online cohorts and 1-on-1 mentoring in SIEM and UEBA detection engineering — ingestion, behaviour analytics, threat chains and investigation workflow — taught by a practitioner who runs it in production.
20 years across DevOps, SRE and Security · 10,000+ engineers trained · Trained teams at JPMorgan Chase, Verizon, Nokia and the World Bank
Principal DevOps Engineer & Architect
Rajesh teaches Securonix as detection engineering rather than console navigation: how data actually arrives and gets parsed into a normalised event model, why identity and asset context determines whether behavioural baselines mean anything, and how policy types — rule-based, behavioural, rarity, land-speed and beaconing — differ in what they can and cannot catch. Sessions cover Spotter search and investigation workflow, threat chains and risk scoring, ATT&CK mapping and coverage gaps, whitelisting and tuning with a defensible false-positive budget, and the content lifecycle that keeps a detection set improving — all framed as defending an estate you own, with every lab run against attendee-provisioned data.
Twenty years across DevOps, SRE and Security, in principal and architect roles at PayPay, SoftwareAG, ServiceNow, JDA Software, Intuit, Adobe and others. He has trained engineers at JPMorgan Chase, Verizon, Nokia, the World Bank, VMware, Oracle, Mercedes-Benz and Airbus — more than 10,000 people personally. He teaches what he runs, not what he reads.
You are booked with a named engineer, and that is who turns up. Marketplaces and larger providers rotate whoever is free, so the person who sold you the agenda is rarely the person teaching it.
The same trainer is available for the next engagement, which matters when a team builds on what it learned last time.
Your batch is assigned a named trainer before it starts, and that is who teaches it. See the full faculty.
Engagements are matched on the tool, not the calendar. For Securonix that means a trainer who has run it in production — SIEM and UEBA detection engineering — ingestion, behaviour analytics, threat chains and investigation workflow — rather than whoever is free that week. You are told who is teaching before you commit, and that person is on the discovery call that shapes the agenda.
Where a batch is large enough to need a second trainer, the pairing is declared up front. The lead trainer stays accountable for the syllabus and the assessment either way.
Principal DevOps Engineer & Architect
Twenty years across DevOps, SRE and Security in principal and architect roles at PayPay, SoftwareAG, ServiceNow, JDA Software, Intuit, Adobe, IBM/Emptoris, Ness, MindTree and Accenture. He has trained more than 10,000 engineers personally, at organisations including JPMorgan Chase, Verizon, Nokia, the World Bank, VMware, Oracle, Mercedes-Benz and Airbus. He teaches what he runs, not what he reads.
Teams of 8–30
Custom agenda, your timezone, onsite or online, NDA-friendly.
Request a quoteIndividual engineers
A private instructor and a curriculum built around your goal.
₹99,999Individuals who want peers
Scheduled batch, max 8 to 10 hours of live instruction.
₹34,999A private batch starts with a discovery call. We look at the stack you actually run — the CI system, the cloud, the constraints — and map the agenda onto it, so examples use your topology rather than a generic one.
Delivery is onsite at your premises, live online, or hybrid, scheduled around your release calendar rather than ours. Batches run 8 to 30 engineers.
Every attendee leaves with recordings, slides, lab repositories and a completion certificate. You receive an attendance and assessment report. Invoicing supports PO and GST.
Talk to us about a private Securonix batchSecuronix is a security information and event management platform with user and entity behaviour analytics at its core. It collects log and event data from across an estate — identity providers, endpoints, firewalls, proxies, cloud control planes, SaaS applications, databases and custom applications — normalises it into a common event model, enriches it with identity and asset context, and then applies both signature-style rules and behavioural models to surface activity that warrants a human decision.
The behavioural half is what distinguishes Securonix from a pure log search platform. Rather than only asking whether an event matches a known-bad pattern, it builds baselines for each user, host, service account and peer group and scores deviation from them: a first-time administrative action, a login from a location that is impossible given the previous one, access to a data store the account has never touched, an outbound connection at an interval that looks like beaconing. Individual violations accumulate into a risk score on the entity, and threat chains stitch related violations into a single narrative that maps onto ATT&CK stages instead of arriving as forty separate alerts.
Operationally, Securonix is used as the detection and investigation layer of a security operations function. Analysts search normalised data with Spotter, work incidents in an investigation workbench that carries entity context with it, and drive containment through playbooks and integrations with ticketing, identity and endpoint tooling. Around that sits the work that actually determines whether the platform is useful: onboarding data sources with correct parsing, keeping identity and asset context current, writing and tuning policies, and retiring the ones that only generate noise.
Security operations teams are drowning in telemetry and short of analysts. Estates now span on-premises infrastructure, several clouds, dozens of SaaS applications and a remote workforce, and every one of those produces logs. Correlation rules alone do not scale to that, because the interesting activity is frequently a legitimate credential doing something unusual rather than a known-bad signature.
That is the gap behaviour analytics is meant to close, and it is why insider threat, compromised credentials and cloud account misuse dominate the detection roadmaps that boards now ask about. Regulatory pressure reinforces it: retention, audit evidence, breach notification timelines and sector-specific controls all assume you can demonstrate what happened and when.
The scarce skill is not operating the console. It is detection engineering — deciding which data sources actually earn their ingestion cost, getting parsing and normalisation right so a field means the same thing across twelve sources, keeping identity context accurate enough for behavioural baselines to be meaningful, writing policies with a defensible false-positive rate, and running a content lifecycle so the detection set improves rather than accumulates. Teams that skip that work end up with an expensive platform and an alert queue nobody reads.
The problem before the platform. Why correlation rules alone stopped scaling, what behaviour analytics adds and what it cannot do, and an honest framing of Securonix against log-search-first platforms — including the operational cost that any SIEM imposes on the team that runs it.
Topics: What a SIEM is actually for: detection, investigation, evidence, compliance · The limits of signature and correlation-only detection · UEBA: baselines, peer groups and deviation scoring · Insider threat, compromised credentials and cloud account misuse as detection classes · Securonix positioned against log-centric SIEM platforms · The real operational cost of running a SIEM well · Detection engineering as a discipline, not a product feature
How data physically gets in and where it lives. Cloud and self-managed deployment models, collection components and remote ingestion, the data lake and search tiers, retention and cost, multi-tenancy, and role-based access for an analyst team.
Topics: Deployment models: cloud-delivered and self-managed · Collection architecture and remote ingestion nodes · Message queues, batching and back-pressure behaviour · The data lake, indexing and search tiers · Retention tiers, archival and the cost model of ingestion · Multi-tenancy and data segregation · Users, roles, RBAC and least privilege for analysts · Platform health monitoring and ingestion lag alerting
The stage that determines whether anything downstream works. Connectors and collection methods, writing and testing parsers, mapping fields into the normalised event model, handling malformed and multi-line events, timestamp and timezone correctness, and validating that a source is genuinely complete.
Topics: Connector types: syslog, API, agent, cloud-native and file-based · Onboarding cloud sources: identity providers, cloud audit logs, SaaS applications · Parser development, regular expressions and structured formats · Mapping to the normalised event model and why field consistency matters · Timestamp, timezone and event-time versus ingest-time problems · Handling multi-line, truncated and malformed events · Validating source completeness and detecting silent collection failure · Ingestion cost control: filtering, sampling and what not to collect
Behavioural analytics is only as good as the context under it. Importing users and assets from directory and HR sources, entity resolution across identifiers, peer group construction, service and shared account handling, watchlists, and threat intelligence enrichment.
Topics: User import from directory and HR systems, and keeping it current · Asset and network context import · Entity resolution: linking accounts, hosts and identities to one entity · Peer groups: how they are built and what breaks them · Service accounts, shared accounts and non-human identities · Joiners, movers and leavers as a data quality problem · Watchlists for high-risk populations and departing employees · Threat intelligence feeds and enrichment at ingest
Writing detections that survive contact with production. Rule-based policies for known patterns, behavioural policies for deviation, rarity, land-speed and beaconing analytics, threshold selection, and assembling individual violations into threat models and chains that read as a narrative.
Topics: Policy types and choosing between rule-based and behavioural detection · Behaviour profiles, baselining periods and cold-start problems · Rarity, first-seen and volumetric analytics · Land-speed, impossible travel and geo-based detection · Beaconing and periodicity detection for command-and-control · Risk scoring, weighting and score decay · Threat models and threat chains across ATT&CK stages · Out-of-the-box content: what to adopt, what to modify, what to disable · Testing a detection safely before enabling it
What an analyst actually does at three in the morning. Searching and pivoting with Spotter, working an incident in the investigation workbench with entity context attached, evidence collection, playbook-driven response, integration with ticketing and identity tooling, and writing a conclusion someone else can audit.
Topics: Spotter search syntax, filtering and pivoting · Building an investigation timeline from violations and raw events · The investigation workbench and entity-centric analysis · Triage: separating a real detection from expected behaviour · Evidence collection and preserving audit integrity · Case management, assignment, escalation and handover · Automated response playbooks and safe containment actions · Integrations with ticketing, identity, endpoint and email security · Writing an incident conclusion that survives review
Keeping the platform useful in year two. Measuring false positives honestly, tuning with whitelists and thresholds rather than disabling detections, ATT&CK coverage mapping, content version control and promotion, dashboards and reporting for different audiences, and the audit evidence compliance functions ask for.
Topics: Measuring detection quality: false positive rate, precision, time to triage · Whitelisting and exception management with expiry and ownership · Threshold tuning against historical data instead of intuition · Retiring detections that never produce a true positive · MITRE ATT&CK coverage mapping and gap analysis · Content version control, promotion between environments and rollback · Dashboards for analysts, managers and executives · Compliance reporting, retention evidence and audit support · Onboarding a new data source as a repeatable process
We rebuild the agenda around the tools you actually run.
Request a custom agendaTake a custom application log, write and test a parser, map every field to the normalised model and prove timestamps and completeness are correct.
Import identity and asset context, resolve accounts to entities, build peer groups and demonstrate how a bad grouping ruins a behavioural detection.
Build a privileged-access-misuse detection, validate it against historical data, set thresholds from evidence and record its expected false positive rate.
Assemble related violations into a threat chain mapped across ATT&CK stages, and demonstrate the difference in analyst workload against ungrouped alerts.
Run a full investigation in Spotter and the workbench, collect evidence, and produce a conclusion another analyst could audit without asking you a question.
Deliver intake, testing, promotion, measurement, tuning and retirement for a detection content set, with an ATT&CK coverage map and prioritised gaps.
Billed yearly at ₹9,996
Max 8 to 10 hours of live instruction
Full program, private instructor
8–30 engineers · custom agenda · onsite or online · PO and GST invoicing
Refunds. If we cancel or postpone a cohort, you get a full refund within 15 days. There is no money-back guarantee otherwise.
Terms. Course material remains licensed to the attendee. Read the terms.
Your data. We don't share it with third parties. Privacy policy.
Certificate of completion
Rajesh is a very good trainer I have experienced in DevSecOps training. The number of contents in different topics he has posted on the DevOpsSchool public website are amazing and user friendly for beginners and experienced professionals.
Very good training session. Well explained from the basics to the complex concepts. Also tried to cover practicals and demos within the 3 hour sessions. The learning content and videos are of a great deal of help.
Basics explanation was exemplary from Rajesh where he dealt with complicated topics to be simple. Great learning stuff personally for me.
Very detailed explanation and has lots of patience in attending the questionnaire. Thanks again for your wonderful sessions.
Good discussion, helped us to understand different tools in SRE.
Got good lab sessions which kept the new DevOps tool learnings to the point and it helped a lot in my career.
| What matters | YouTube + blogs | Generic online course | Freelance marketplace | DevOpsSchool |
|---|---|---|---|---|
| Named practitioner | No | Rarely | Varies per booking | Yes — same trainer each time |
| Production experience | Unknown | Unknown | Unverified | 20 years, named employers |
| Custom agenda | No | No | Sometimes | Built from your stack |
| Onsite delivery | No | No | Sometimes | Yes |
| Lab environment | None | Sandbox that expires | Varies | Your own cloud — skill goes with you |
| Assessment | None | Quiz | Rarely | Assignments + capstone per module |
| Per-attendee certificates | No | Sometimes | Rarely | Yes |
| Corporate invoicing | No | Limited | Varies | PO and GST |
| Post-training support | None | Forum, time-limited | None | Lifetime forum access |
Tell us the team, the stack and the timeline. You'll get a straight answer, not a sales sequence.
Talk to an advisorPrefer to call or email?
More ways to reach us on the contact page.