Unit 01 · 1 h 59 min
Python for defenders
Run Python, hold data in lists and dicts, write functions and install packages you can trust.
Python for Security Automation
Build the Python tools defenders run every day, from log parsers to safe AI-assisted triage.
- Time
- 18 h 35 min
- Lessons
- 55
- Machine
- Ubuntu 24.04 LTS
- Builds on
- Linux Foundations
What you earn
RootCertificatePython for Security Automation, certificate of completion Python InstitutePCAPCertified Associate Python Programmer
Prepares you for Certified Associate Python Programmer. Root is not affiliated with these issuers.
You will be able to
- Parse logs, CSV and nested JSON into answers
- Detect bursts, traversal and logins after failures
- Verify releases and catch configuration drift
- Call security APIs with tokens, paging and retries
- Use LLM APIs without leaking secrets or trusting output
Units and lessons
Unit 02 · 2 h 20 min
Files and log parsing
Read a VPN log line by line, turn events into dicts, count them, window them and report.
- 1Reading log files16 min · machine
- 2From fields to dictionaries18 min · machine
- 3Counting with Counter20 min · machine
- 4Time windows and bursts22 min · machine
- 5Case file: a low and slow password spray24 min · machine
- 6Case file: impossible travel into the data warehouse22 min · machine
- 7Writing reports18 min · machine
Unit 03 · 1 h 42 min
Regular expressions
Describe text with patterns, pull out fields with groups and see through encoded attacks.
Unit 04 · 1 h 40 min
CSV, JSON and addresses
Work through firewall exports, asset lists and nested cloud audit logs with the right parsers.
Unit 05 · 1 h 33 min
Hashing and file integrity
Fingerprint files with SHA-256, verify releases against manifests and catch configuration drift.
Unit 06 · 2 h
Talking to security APIs
Call JSON APIs with tokens, page through results, enrich indicators and survive rate limits.
Unit 07 · 1 h 45 min
Using LLM APIs safely
Call a model from your tools without leaking secrets, trusting its output or obeying injected text.
Unit 08 · 2 h 4 min
Building a detection tool
Grow scripts into real tools: arguments, combined signals, permission and secret scanners, safe blocklists.
Unit 09 · 1 h 40 min
Testing, packaging and scheduling
Make a tool trustworthy enough to run unattended: tests, logs, exit codes, an installable package and a schedule.
Unit 10 · 1 h 52 min
Capstone: an automated triage report
Plan, collect, enrich, summarise and report one night's incident end to end with your own tools.
Ten project units on a real workstation, each with case files from real breaches: parse logs, verify files, call security APIs, use LLMs safely and ship a triage pipeline.