Programming Labs

The Programming Labs move you from:

LEARNING PROGRAMMING
        ↓
WRITING SECURITY SCRIPTS
        ↓
BUILDING SECURITY TOOLS
        ↓
AUTOMATING SECURITY WORKFLOWS

These labs are designed around the programming skills covered in:

PYTHON

BASH

POWERSHELL

JAVASCRIPT

SQL

SECURITY AUTOMATION

The emphasis is not simply:

WRITE CODE

The emphasis is:

UNDERSTAND A SECURITY PROBLEM
        ↓
DESIGN A WORKFLOW
        ↓
BUILD THE TOOL
        ↓
TEST IT
        ↓
GENERATE SECURITY RESULTS

All labs should be completed using:

YOUR OWN LAB SYSTEMS

SYNTHETIC SECURITY DATA

TRAINING ENVIRONMENTS

EXPLICITLY AUTHORIZED SYSTEMS

Programming Lab Roadmap

LAB 01
SECURITY LOG ANALYZER
        ↓
LAB 02
IOC PROCESSING & ENRICHMENT
        ↓
LAB 03
LINUX SECURITY AUTOMATION
        ↓
LAB 04
WINDOWS SECURITY AUTOMATION
        ↓
LAB 05
SQL SECURITY ANALYTICS
        ↓
LAB 06
VULNERABILITY DATA ANALYSIS
        ↓
LAB 07
SECURITY API INTEGRATION
        ↓
LAB 08
CLOUD SECURITY CONFIGURATION AUDITOR
        ↓
LAB 09
SOC ALERT TRIAGE AUTOMATION
        ↓
LAB 10
ENTERPRISE SECURITY AUTOMATION CAPSTONE

Lab 01 — Build a Security Log Analyzer

Mission

Build a Python-based security log analyzer capable of processing authentication events and producing an investigation summary.

Skills Used

PYTHON

FILES

REGEX

CSV

JSON

DICTIONARIES

COUNTERS

ERROR HANDLING

Lab Workflow

AUTHENTICATION LOG
       ↓
READ FILE
       ↓
PARSE EVENTS
       ↓
VALIDATE FIELDS
       ↓
NORMALIZE
       ↓
COUNT FAILED LOGINS
       ↓
GROUP BY USER
       ↓
GROUP BY SOURCE IP
       ↓
GENERATE REPORT

Students Will Build

A tool capable of answering questions such as:

How many failed logins occurred?

Which users had the most failures?

Which source IPs generated the most failures?

Were any successful logins observed after failures?

Which events require analyst review?

Expected Outputs

failed-users.csv

source-ip-summary.csv

security-summary.json

investigation-report.txt

Key Security Lesson

Logs become useful only when they are:

PARSED

NORMALIZED

CORRELATED

INTERPRETED

Lab 02 — IOC Processing and Enrichment Pipeline

Mission

Build a defensive Indicator of Compromise processing pipeline.

Students will work with synthetic indicators such as:

IP ADDRESSES

DOMAIN NAMES

FILE HASHES

Skills Used

PYTHON

REGEX

IPADDRESS

JSON

CSV

SETS

APIs

ERROR HANDLING

Workflow

RAW IOC LIST
     ↓
VALIDATE
     ↓
NORMALIZE
     ↓
DEDUPLICATE
     ↓
CLASSIFY
     ↓
OPTIONAL AUTHORIZED ENRICHMENT
     ↓
REPORT

Students Will Learn

How to:

Validate IP addresses

Normalize domains

Validate hash formats

Remove duplicates

Separate valid and invalid indicators

Add contextual information

Create analyst-ready output

Expected Outputs

valid-iocs.csv

invalid-iocs.csv

enriched-iocs.json

ioc-summary.txt

Key Security Lesson

An IOC match provides:

CONTEXT

not automatic proof of malicious activity.

Lab 03 — Linux Security Automation with Bash

Mission

Build a Bash-based Linux security assessment script for a controlled Linux lab system.

Skills Used

BASH

FILESYSTEM

PERMISSIONS

PROCESSES

SERVICES

NETWORKING

grep

awk

sort

uniq

Workflow

LINUX HOST
    ↓
SYSTEM INFORMATION
    ↓
USER CONTEXT
    ↓
PERMISSION REVIEW
    ↓
PROCESS REVIEW
    ↓
SERVICE REVIEW
    ↓
LISTENING PORTS
    ↓
LOG REVIEW
    ↓
SECURITY REPORT

Students Will Collect

Hostname

Operating System

Current User

Disk Usage

Running Processes

Running Services

Listening Ports

Selected File Permissions

Recent Authentication Events

Expected Outputs

system-inventory.txt

service-inventory.txt

network-listeners.txt

permission-review.txt

linux-security-report.txt

Key Security Lesson

Bash is especially effective when:

MULTIPLE SMALL LINUX COMMANDS

need to become:

ONE REPEATABLE WORKFLOW

Lab 04 — Windows Security Automation with PowerShell

Mission

Build a PowerShell-based Windows security inventory and audit script.

Skills Used

POWERSHELL

OBJECT PIPELINE

LOCAL USERS

GROUPS

PROCESSES

SERVICES

EVENT LOGS

NETWORKING

DEFENDER

FIREWALL

Workflow

WINDOWS HOST
     ↓
SYSTEM INFORMATION
     ↓
LOCAL USERS
     ↓
LOCAL ADMINISTRATORS
     ↓
PROCESSES
     ↓
SERVICES
     ↓
LISTENING PORTS
     ↓
WINDOWS SECURITY EVENTS
     ↓
DEFENDER / FIREWALL
     ↓
REPORT

Students Will Review

Current Identity

Operating System

Local Accounts

Administrators Group

Running Services

Listening Connections

Failed Authentication Events

Firewall Profiles

Defender Status

Expected Outputs

windows-inventory.csv

local-admins.csv

services.csv

failed-logins.csv

windows-security-report.html

Key Security Lesson

PowerShell allows defenders to query:

WINDOWS OBJECTS

directly rather than relying only on text parsing.

Lab 05 — SQL Security Analytics Lab

Mission

Use SQL to investigate a synthetic enterprise security database.

Dataset

The lab database should contain tables such as:

USERS

ASSETS

LOGIN_EVENTS

VULNERABILITIES

INCIDENTS

Skills Used

SELECT

WHERE

ORDER BY

GROUP BY

COUNT

HAVING

JOIN

LEFT JOIN

CASE

SUBQUERIES

Investigation Questions

Students should determine:

Which users generated the most failed logins?

Which source IP contacted the most accounts?

Which administrators do not have MFA?

Which critical assets have open critical vulnerabilities?

Which assets have no documented owner?

Which incidents remain unassigned?

Workflow

SECURITY QUESTION
       ↓
SELECT TABLE
       ↓
FILTER
       ↓
JOIN CONTEXT
       ↓
AGGREGATE
       ↓
INTERPRET
       ↓
REPORT

Expected Outputs

authentication-analysis.sql

mfa-review.sql

vulnerability-priority.sql

asset-hygiene.sql

security-analysis-report.md

Lab 06 — Vulnerability Data Analysis and Prioritization

Mission

Build a Python workflow that processes vulnerability scan exports and converts them into a prioritized remediation report.

Skills Used

PYTHON

CSV

JSON

DATA NORMALIZATION

DEDUPLICATION

RISK SCORING

REPORTING

Input Fields

Use synthetic data containing:

Asset

IP

Finding ID

Finding Name

Severity

CVSS

Status

Asset Criticality

Owner

Workflow

SCANNER EXPORT
      ↓
VALIDATE
      ↓
NORMALIZE
      ↓
DEDUPLICATE
      ↓
ADD ASSET CONTEXT
      ↓
PRIORITIZE
      ↓
GROUP BY OWNER
      ↓
GENERATE REPORT

Students Will Identify

Critical open findings

High-risk assets

Assets with multiple findings

Findings without owners

Duplicate findings

Overdue remediation items

Expected Outputs

normalized-findings.csv

critical-findings.csv

owner-summary.csv

vulnerability-priority.json

remediation-report.md

Key Security Lesson

Security prioritization should consider more than:

CVSS SCORE

A stronger model includes:

TECHNICAL SEVERITY
        +
ASSET CRITICALITY
        +
EXPOSURE
        +
BUSINESS CONTEXT

Lab 07 — Security API Integration

Mission

Build a Python application that retrieves security information from an approved training API and converts the response into a useful report.

Skills Used

PYTHON

HTTP

REST APIs

JSON

AUTHENTICATION

TIMEOUTS

ERROR HANDLING

RETRIES

Workflow

AUTOMATION
    ↓
API REQUEST
    ↓
AUTHENTICATION
    ↓
JSON RESPONSE
    ↓
VALIDATE
    ↓
NORMALIZE
    ↓
ANALYZE
    ↓
REPORT

Students Will Implement

GET requests

Headers

Environment variables

Timeouts

HTTP status handling

JSON parsing

Pagination concept

Rate-limit handling

Controlled retry logic

Security Requirements

Students must:

Avoid hard-coded credentials

Use approved API endpoints

Protect tokens

Avoid logging secrets

Use request timeouts

Handle errors gracefully

Expected Outputs

api-client.py

normalized-api-data.json

security-api-report.csv

README.md

Lab 08 — Cloud Security Configuration Auditor

Mission

Build a read-only cloud security assessment tool for a controlled cloud lab.

The first version must be:

READ ONLY

Possible Platforms

The methodology can be applied to:

AWS

AZURE

GOOGLE CLOUD

using the appropriate authorized APIs or CLIs.

Skills Used

PYTHON

CLOUD APIs

JSON

IDENTITY

CONFIGURATION CHECKS

REPORTING

Security Checks

Examples may include:

Logging enabled?

Encryption configured?

Public exposure present?

Privileged identity assignments?

Security monitoring configured?

Selected storage protections enabled?

Workflow

CLOUD API
    ↓
RESOURCE INVENTORY
    ↓
CONFIGURATION DATA
    ↓
SECURITY BASELINE
    ↓
COMPARE
    ↓
PASS / REVIEW / FAIL
    ↓
REPORT

Expected Outputs

cloud-inventory.json

configuration-findings.csv

identity-review.csv

cloud-security-report.md

Key Security Lesson

Cloud automation should normally begin with:

VISIBILITY

before:

AUTOMATIC REMEDIATION

Lab 09 — SOC Alert Triage Automation

Mission

Build an alert-processing workflow that converts raw security alerts into analyst-ready investigation packages.

Skills Used

PYTHON

JSON

APIs

SQL

DATA NORMALIZATION

ENRICHMENT

RISK SCORING

REPORTING

Input

Use synthetic alerts from multiple security products.

Example:

{
  "alert_id": "ALT-1001",
  "user": "admin01",
  "source_ip": "10.10.10.25",
  "asset": "WEB01",
  "severity": "high"
}

Workflow

RAW ALERT
    ↓
VALIDATE
    ↓
NORMALIZE
    ↓
USER LOOKUP
    ↓
ASSET LOOKUP
    ↓
RELATED EVENTS
    ↓
CONTEXT
    ↓
PRIORITY RECOMMENDATION
    ↓
ANALYST REVIEW

Students Will Generate

Alert Summary

User Context

Asset Context

Related Events

Risk Indicators

Recommended Investigation Priority

Analyst Notes Section

Important Control

The automation should:

RECOMMEND

rather than automatically perform disruptive response actions.

Expected Outputs

normalized-alert.json

enriched-alert.json

timeline.csv

investigation-package.md

Lab 10 — Enterprise Security Automation Capstone

Mission

Build an end-to-end security automation platform combining the skills from the entire Programming learning path.

This is the final Programming Lab.

Capstone Architecture

                 SECURITY DATA
                       ↓
              ┌─────────────────┐
              │ DATA COLLECTOR  │
              └────────┬────────┘
                       ↓
              ┌─────────────────┐
              │   VALIDATION    │
              └────────┬────────┘
                       ↓
              ┌─────────────────┐
              │  NORMALIZATION  │
              └────────┬────────┘
                       ↓
              ┌─────────────────┐
              │   ENRICHMENT    │
              └────────┬────────┘
                       ↓
              ┌─────────────────┐
              │   CORRELATION   │
              └────────┬────────┘
                       ↓
              ┌─────────────────┐
              │  RISK ANALYSIS  │
              └────────┬────────┘
                       ↓
              ┌─────────────────┐
              │  HUMAN REVIEW   │
              └────────┬────────┘
                       ↓
              ┌─────────────────┐
              │    REPORTING    │
              └─────────────────┘

Technologies

Students should combine several of:

PYTHON

BASH

POWERSHELL

SQL

JSON

REST APIs

HTML / JAVASCRIPT

Suggested Enterprise Scenario

Your organization has:

LINUX SERVERS

WINDOWS SERVERS

CLOUD RESOURCES

SECURITY ALERTS

VULNERABILITY FINDINGS

USER ACCOUNTS

Build a system that collects security information and creates a unified analyst report.

Phase 01 — Linux Collection

Use Bash to collect approved information such as:

Hostname

OS

Running Services

Listening Ports

Selected Security Logs

Export:

linux-inventory.json

Phase 02 — Windows Collection

Use PowerShell to collect:

System Information

Administrators

Services

Firewall Status

Defender Status

Authentication Events

Export:

windows-inventory.json

Phase 03 — Vulnerability Data

Process:

scanner-export.csv

using Python.

Normalize:

Asset

Finding

Severity

Status

Owner

Phase 04 — Security Database

Store or query normalized information using SQL.

Tables may include:

assets

users

events

findings

alerts

Phase 05 — Security Correlation

Correlate:

ASSET
   +
IDENTITY
   +
ALERTS
   +
VULNERABILITIES

Phase 06 — Risk Prioritization

Build a simple documented scoring model using:

EVENT SEVERITY

ASSET CRITICALITY

IDENTITY PRIVILEGE

OPEN VULNERABILITIES

DETECTION CONFIDENCE

Phase 07 — Analyst Report

Generate:

EXECUTIVE SUMMARY

HIGH-RISK ASSETS

PRIVILEGED IDENTITIES

CRITICAL FINDINGS

AUTHENTICATION ANOMALIES

OPEN ALERTS

RECOMMENDED INVESTIGATIONS

Phase 08 — Optional Dashboard

Use HTML and JavaScript to display:

Metrics

Findings

Assets

Alerts

Risk Levels

The dashboard should consume sanitized report data rather than embed secrets.

Phase 09 — Logging

The entire workflow should log:

RUN ID

START

INPUT VALIDATION

RECORD COUNTS

WARNINGS

ERRORS

COMPLETION

Phase 10 — Testing

Test:

Missing Files

Empty Data

Malformed JSON

Invalid IPs

Duplicate Findings

Unavailable API

Missing User

Missing Asset

Unknown Severity

Phase 11 — Security Controls

The project must demonstrate:

LEAST PRIVILEGE

INPUT VALIDATION

NO HARD-CODED SECRETS

ERROR HANDLING

SAFE LOGGING

READ-ONLY COLLECTION WHERE POSSIBLE

HUMAN REVIEW

LIMITED BLAST RADIUS

Capstone Deliverables

Students should produce:

enterprise-security-automation/
|
+-- README.md
|
+-- architecture.md
|
+-- collectors/
|
+-- parsers/
|
+-- enrichment/
|
+-- database/
|
+-- reports/
|
+-- tests/
|
+-- sample-data/
|
+-- docs/

Final artifacts:

Architecture Diagram

Source Code

Sample Dataset

SQL Queries

Security Report

Test Results

Runbook

Project README

Programming Labs Skill Progression

Lab	Primary Skill
Lab 01	Python Log Analysis
Lab 02	IOC Processing
Lab 03	Bash Automation
Lab 04	PowerShell Automation
Lab 05	SQL Security Analytics
Lab 06	Vulnerability Analysis
Lab 07	API Integration
Lab 08	Cloud Security Automation
Lab 09	SOC Automation
Lab 10	Enterprise Automation

Lab Difficulty Progression

LAB 01
BEGINNER
   ↓
LAB 02
BEGINNER+
   ↓
LAB 03
INTERMEDIATE
   ↓
LAB 04
INTERMEDIATE
   ↓
LAB 05
INTERMEDIATE
   ↓
LAB 06
INTERMEDIATE+
   ↓
LAB 07
INTERMEDIATE+
   ↓
LAB 08
ADVANCED
   ↓
LAB 09
ADVANCED
   ↓
LAB 10
CAPSTONE

What Students Should Have After Completing the Labs

Students should be able to demonstrate:

PYTHON SECURITY PROGRAMMING

LINUX AUTOMATION

WINDOWS AUTOMATION

SQL SECURITY ANALYSIS

API INTEGRATION

SECURITY DATA NORMALIZATION

SECURITY DATA CORRELATION

CLOUD SECURITY AUTOMATION

SOC AUTOMATION

ENTERPRISE WORKFLOW DESIGN

More importantly, they should understand:

WHEN TO AUTOMATE

HOW TO AUTOMATE SAFELY

HOW TO TEST AUTOMATION

HOW TO LIMIT PRIVILEGE

HOW TO HANDLE FAILURE

WHEN HUMAN REVIEW IS REQUIRED

Final Programming Labs Mental Model

SECURITY PROBLEM
       ↓
DATA
       ↓
CODE
       ↓
AUTOMATION
       ↓
SECURITY CONTEXT
       ↓
ACTIONABLE RESULT

But professional automation adds:

VALIDATION

TESTING

LOGGING

LEAST PRIVILEGE

ERROR HANDLING

DOCUMENTATION

HUMAN OVERSIGHT

Therefore:

GOOD CODE
   +
SECURITY KNOWLEDGE
   +
SAFE AUTOMATION
   =
SECURITY ENGINEERING

What’s Next?

➡️ Lab 01 — Build a Security Log Analyzer

The first practical lab begins with the most important security-programming skill:

RAW SECURITY LOGS
       ↓
PYTHON
       ↓
PARSE
       ↓
NORMALIZE
       ↓
ANALYZE
       ↓
CORRELATE
       ↓
REPORT

You will build the first complete programming-based security tool and convert raw authentication events into an analyst-ready investigation report.