Security Information and Event Management (SIEM) (IMCS-015) Training Course

Security Information and Event Management (SIEM)

SIEM platforms collect and correlate security events across the organisation, enabling detection of threats and supporting investigations and compliance. However, many…

5 daysClassroom

14Upcoming dates

6Cities

£2,840Fees from

Course overview

Why Attend

SIEM platforms collect and correlate security events across the organisation, enabling detection of threats and supporting investigations and compliance. However, many SIEM deployments generate noise rather than value.

This LLMI course covers SIEM architecture, log source onboarding, parsing and normalisation, correlation rules and detection use cases, alert tuning, dashboards, investigations, compliance reporting and SIEM programme management. Participants design detection use cases and tuning approaches.

The course suits security analysts, engineers and managers.

Course Objectives

Explain SIEM architecture and capabilities

Plan log source onboarding

Develop detection use cases

Tune alerts to reduce noise

Use SIEM for investigations and reporting

Manage and improve SIEM programmes

Target Audience

Security analysts and engineers

SOC staff

IT security managers

System administrators

Compliance professionals

Auditors

Course Methodology

Architecture presentations

Use-case design workshops

Demonstrations

Tuning exercises

Case studies

Course outline

1Day 1: SIEM Fundamentals

Purpose of SIEM
Architecture
Deployment options
Licensing and cost
Selection
Exercise: Requirements

2Day 2: Log Management

Log sources
Onboarding
Parsing
Retention
Data quality
Workshop: Log source plan

3Day 3: Detection Use Cases

Use-case frameworks
Correlation rules
Threat mapping
Behaviour analytics
Testing
Exercise: Writing use cases

4Day 4: Operations

Alert triage
Tuning
Dashboards
Investigations
Compliance reports
Demonstration: Investigation

5Day 5: Programme Management

Metrics
Governance
Automation
Improvement
Roadmap
Capstone: SIEM improvement plan

Frequently asked questions

How long is the Security Information and Event Management (SIEM) course?

The course runs over 5 days of classroom training, usually Monday to Friday.

When is the next Security Information and Event Management (SIEM) course?

The next public date is 16 - 20 Nov 2026 in Frankfurt. There are 14 upcoming dates in total.

Where is this course held?

Upcoming sessions run in Frankfurt, Rome, Cape Town, Barcelona, Paris, Vienna.

How much does the course cost?

Fees start from £2,840 per delegate, depending on the city. Fees include tuition and course materials.

Do participants receive a certificate?

Yes. Delegates who complete the course receive a London Leadership Management Innovation certificate of completion.

Can this course be delivered in-house for our team?

Yes. LLMI can tailor and deliver this course privately for your organisation at your premises or in one of our training cities.

Course information last updated 14 November 2026.

Security Information and Event Management (SIEM)

Course overview

Course outline

Dates and fees

Frequently asked questions

More IT Management and Cyber Security courses

AI Security: Protecting Machine Learning Systems

Application Security and Secure Software Development

Artificial Intelligence (AI) in Cyber Forensics: Investigating Advanced Cyber Crimes

Training a team?