Learn to plan, deploy and use a SIEM: onboard and normalize log sources, write search queries and correlation rules, build dashboards and tune detections to cut noise.
The Security Information & Event Management (SIEM) course in Doha, Qatar focuses on the platform at the center of most security monitoring programs. Participants learn how a SIEM collects, parses and normalizes logs, correlates events, raises alerts and supports investigations, and how to design use cases that match an organization's real risks. Platforms such as Microsoft Sentinel, Splunk, Elastic Security and IBM QRadar are used as examples so the concepts transfer to whichever product an organization runs.
The course is practical. Learners onboard Windows, Linux, firewall and cloud log sources in a lab, write search queries in languages such as KQL and SPL, convert detection ideas into correlation rules, and build dashboards and reports for analysts and managers. Detection engineering topics, including Sigma rules, MITRE ATT&CK coverage mapping and rule tuning, show how to reduce false positives. The course can also run as an in-house program, focused on the SIEM platform an organization has deployed.
By the end of this course, participants will be able to:
Explain SIEM architecture, data flow, storage and licensing considerations
Onboard, parse and normalize logs from endpoints, network devices and cloud services
Write search queries to investigate security events in KQL or SPL
Build correlation rules and use cases aligned with MITRE ATT&CK techniques
Create dashboards and reports for analysts, managers and auditors
Tune detections to reduce false positives and integrate with SOAR automation
This course is for technical professionals who deploy, manage or work daily with a SIEM platform.
SOC analysts and detection engineers
Security engineers responsible for SIEM deployment
System and network administrators feeding logs to a SIEM
Cloud security engineers
Security team leads planning SIEM use cases
Log management versus SIEM and the role of SOAR
Collectors, agents, parsers, indexing and retention
Cloud-native and on-premises SIEM deployment models
Examples: Microsoft Sentinel, Splunk, Elastic Security, IBM QRadar
Windows event forwarding, Sysmon and syslog collection
Firewall, DNS, proxy and cloud audit log onboarding
Field extraction, normalization and common data models
Time synchronization and log source health monitoring
Query fundamentals in KQL and SPL
Filtering, aggregation and time-based analysis
Pivoting between users, hosts and IP addresses
Saved searches and investigation workbooks
Designing use cases from risks and threat scenarios
Correlation rules, thresholds and anomaly detection
Writing portable detections with Sigma rules
Mapping detection coverage to MITRE ATT&CK
Reducing false positives through allowlists and context
Dashboards and compliance reports for different audiences
SOAR playbooks for enrichment and automated response
Measuring detection quality and maintaining rules over time
Qatar's expanding cloud adoption, new data centers and digital public services generate large volumes of security data that must be monitored effectively. Banks, energy companies, healthcare providers and government bodies rely on SIEM platforms to detect threats and demonstrate compliance with national cybersecurity guidance. Professionals who can turn raw logs into reliable detections help organizations get value from these investments and support Qatar National Vision 2030's goal of a secure, knowledge-based economy.
Join a scheduled class at our training center in Doha or attend live online. For organizations, the course can run as an in-house program at your premises or online, tailored to your sector, examples and schedule.
It is a hands-on course in Doha that teaches how to collect and normalize logs, write search queries, build correlation rules and dashboards, and tune detections in a SIEM. Products such as Microsoft Sentinel, Splunk, Elastic Security and IBM QRadar serve as examples.
SOC analysts, detection engineers, security engineers who deploy SIEM platforms, administrators who send logs into them, cloud security engineers and team leads who plan use cases. A basic understanding of networking, operating systems and security events is expected.
No. It is vendor-neutral training that uses several platforms as examples, and it is not official vendor training. The skills apply across products. For in-house groups, exercises can focus on the SIEM platform your organization already uses.
Yes. It can be delivered at your premises or online and tailored to your sector, your SIEM platform and log sources, and your schedule. Contact Leaders Training Center to plan an in-house session for your security team.
Tell us a little about yourself and an advisor will contact you about batch timings, fees and eligibility. No obligation.
Sat–Thu: 09:00–22:00Fri: 08:00–22:00
Build a solid technical grounding in cybersecurity: core security principles, common threats, network and endpoint defenses, identity controls and the frameworks IT teams use to manage risk.
Learn how attackers find and exploit weaknesses, and practice reconnaissance, scanning, enumeration and basic exploitation in an isolated lab, always within legal authorization and an agreed scope.
Learn to plan, run and report a structured penetration test, from scoping and rules of engagement through network, web and Active Directory testing in a lab to risk-rated findings.
Prepare for the CompTIA Security+ exam by working through its domains, from threats and security architecture to operations and governance, with labs, scenario questions and practice reviews.
