Why Sekoia Training?

1. Digital learning, always included

Every course is online, self-paced and free for customers and partners. A knowledge check closes each course so you can see where you stand. It helps you progress; it does not certify you.

2. Instructor-led, if you want it

A certified Sekoia trainer can take you through the recap module and prepare you for the exam. Choose it from the start or switch to it on the way. It is required only for the Self-Hosted Masters in 2026-2027.

3. One final exam validates your path

Each role has a learning path. At its end, one final exam with random questions and hands-on labs validates the whole path and earns your Master certificate.

Online courses

Start with the Essentials, add the Operate courses your role needs, then certify your path with a Master.
Essentials
Operate
Master
Defend Essentials
Your first tour of the Sekoia Defend SOC Platform: collect, detect, investigate, respond, administer.
Essentials
Knowledge check
~ 3h

What you will learn

Navigate the platform and locate its main surfaces across workspaces and communities
Describe how events are collected through entities, intakes, and the Sekoia Endpoint Agent
Identify the detection rule types (SIGMA, CTI, anomaly) and explain how an enabled rule raises an alert
Describe how an analyst investigates alerts and events using asset enrichment, the alert detail tabs, and the Query Builder
Recognize how playbooks, cases, notebooks, and dashboards are used to respond to, document, and monitor incidents
Describe how a community is administered: users and roles, security settings (2FA, SSO), API keys, subscriptions, and notifications

Course Details

Modality
Online, self-paced · 5 modules · no lab needed
Prerequisites
None
Duration
~ 3h
Language
English · French · Polish · Thai · Japanese
Cost
Free to customers and partners
Intelligence Essentials
Sekoia's Cyber Threat Intelligence from the model up: STIX, MITRE ATT&CK and TLP, then explore, pivot, share through feeds and read TDR reports.
Essentials
Knowledge check
~ 2h20

What you will learn

Describe what Cyber Threat Intelligence is in Sekoia, how the Threat Detection and Research (TDR) team produces it, and why validity dates keep it relevant
Explain how Sekoia structures intelligence using STIX 2.1, MITRE ATT&CK, and Traffic Light Protocol (TLP)
Distinguish Objects, Observables, and Indicators of Compromise (IOCs), and read confidence and source ratings
Navigate the Intelligence page to locate objects and observables, read their details and telemetry, and pivot through Graph Exploration
Describe how indicators flow in and out of Sekoia through IOC collections and custom feeds
Read curated intelligence through TDR reports (FLINT), external reports, and the Threat Landscape Dashboard

Course Details

Modality
Online, self-paced · 4 modules · no lab needed
Prerequisites
None
Duration
~ 2h20
Language
English · French · Polish · Thai · Japanese
Cost
Free to customers and partners
Reveal Essentials
Read an asset's full context during triage: the asset context panel, Health check, Points of Interest and the Attack Path graph.
Essentials
Knowledge check
~ 2h30

What you will learn

Open the asset context panel from each of its four entry points (alert, event, case, asset listing) and read its core anatomy
Identify the information each Reveal tab and the Health check card present
Recognize and interpret Points of Interest as decision-support signals, and know what they do and do not let you conclude
Navigate the Attack Path Visualization and describe what its graph shows — reachability, not proof
Configure asset connectors, recognize their health states, and read their logs
Use Reveal information both to prevent incidents and to investigate them

Course Details

Modality
Online, self-paced · 5 modules · no lab needed
Prerequisites
None
Duration
~ 2h30
Language
English · French · Polish · Thai · Japanese
Cost
Free to customers and partners
Sekoia Self-Hosted: Is It Right for You?
Decide whether Sekoia Self-Hosted fits your organization: why it exists, its architecture, what the current release includes and what you take on.
Essentials · Self-Hosted
Knowledge check
~ 1h30

What you will learn

Explain why an organization chooses Sekoia Self-Hosted over Sekoia SaaS, and how the two models differ
Describe the Self-Hosted architecture as one picture: nodes, surrounding services, and where event data is stored
Identify what the current Self-Hosted release includes, what it does not, and what depends on connectivity
Identify what an organization takes on when it runs Self-Hosted, and recognize the signals of a good or poor fit

Course Details

Modality
Online, self-paced · 4 modules · no lab needed
Prerequisites
None
Duration
~ 1h30
Language
English
Cost
Free to customers and partners
Alert Triage & Cases
Triage an alert with every part of the product, in the order an analyst meets it, and manage it as a case.
Operate
Knowledge check
~ 6h20

What you will learn

Navigate the alerts listing: read its columns, then sort and filter alerts by urgency, occurrences, status and rule
Interpret an alert from its details page: the rule that raised it, its assets, threat intelligence, kill chain phase and MITRE ATT&CK mapping
Investigate the events behind an alert with in-alert pivots, observable enrichment, the graph investigation and SOL queries
Qualify an alert with a status and a verdict justified in a comment
Act on a qualified alert: suppress a false positive, run a manual playbook, build a case and hand it over

Course Details

Modality
Online, self-paced · hands-on labs
Prerequisites
Defend Essentials
Duration
~ 6h20
Language
English · French · Polish · Thai · Japanese
Cost
Free to customers and partners
Querying with SOL
Learn the Sekoia Operating Language from scratch: write queries, build dashboards and run notebook investigations.
Operate
Knowledge check
4h to 6h

What you will learn

Write SOL queries from your first `| where` to multi-source joins and nested subqueries
Aggregate, bin, and visualize time-based data through charts and dashboards
Use query parameters to build interactive, reusable filters
Run investigations and document cases in Sekoia notebooks
Apply production-grade best practices: performance, multi-tenant scoping, query limits

Course Details

Modality
Online, self-paced · 9 modules · hands-on labs
Prerequisites
Defend Essentials (recommended)
Duration
4h to 6h
Language
English · French · Polish · Thai · Japanese
Cost
Free to customers and partners
Collecting Logs
Get a log source sending into Sekoia and keep it healthy: protocols, collectors, the Forwarder, intake keys, verification, debugging and monitoring.
Operate
Knowledge check
~ 10h

What you will learn

Explain how an event travels from a source device to a Sekoia Intake, and choose PUSH or PULL for a given source
Create an Intake and place its intake key correctly for Syslog, HTTPS, and cloud collection
Deploy a collection with a log collector or the Sekoia Forwarder over Syslog RFC 5424, HTTPS, or RELP
Verify collection health from the platform indicators and read the raw events that arrive
Debug a failing or incomplete collection layer by layer, from the source to the Intake

Course Details

Modality
Online, self-paced · 3 modules · hands-on labs
Prerequisites
Defend Essentials
Duration
~ 10h
Language
English · French · Polish · Thai · Japanese
Cost
Free to customers and partners
Parsing Events
Turn raw logs into structured, ECS-normalized events: stages, typing, the Custom Stage, Smart-Descriptions, Jinja and custom fields.
Operate
Knowledge check
~ 7h45

What you will learn

Read a raw event and choose the parsing stages that match its shape
Build a typed Custom Format parsing pipeline that turns a raw event into a structured event
Normalize parsed fields to the Elastic Common Schema (ECS) with the mandatory Custom Stage
Write a Smart-Description that summarizes an event in one sentence, with conditions and relationships
Transform field values with Jinja filters and apply a stage only when the event content matches a condition

Course Details

Modality
Online, self-paced · 2 modules · hands-on labs
Prerequisites
Collecting Logs; comfortable with JSON, CSV, regular expressions and key-value logs
Duration
~ 7h45
Language
English · French · Polish · Thai · Japanese
Cost
Free to customers and partners
Building Playbooks
Automate Sekoia from the interface: build playbooks, configure every block, chain them, then run, monitor and debug them.
Operate
Knowledge check
~ 4h45

What you will learn

Build and run a playbook from a catalog template and from scratch, configuring each block's Account, inputs, and outputs
Wire data through a playbook with Jinja and the five operators (Condition, Foreach, Store, Any, All)
Run, monitor, and debug a playbook from the platform indicators, and interpret rate-limiting and automatic deactivation
Assemble a multi-branch triage workflow that routes on urgency, enriches from an external source, and acts differently in each band

Course Details

Modality
Online, self-paced · 4 modules · hands-on labs
Prerequisites
Defend Essentials
Duration
~ 4h45
Language
English · French · Polish · Thai · Japanese
Cost
Free to customers and partners
Contributing Production Intake Formats
Take a parser to production: the intake-formats repository, test files, the validation gate, peer review and contribution.
Operate
Knowledge check
~ 5h

What you will learn

Scaffold a vendor module and a format in the `intake-formats` repository with the `mise` generators, creating no file by hand
Write format test files whose expected output is generated and then verified, and run the repository's validation gate
Test a format against real events in the product and replay events through an updated parser
Review normalization, parser structure, and Smart-Descriptions against the best-practices checklist, and decide ship or no-ship with named fixes
Contribute an Intake to the Sekoia public repository following the homologation process, or keep it private through a private app

Course Details

Modality
Online, self-paced · 2 modules · hands-on labs
Prerequisites
Parsing Events; comfortable with Git, a terminal and YAML, and running a test suite locally
Duration
~ 5h
Language
English · French · Polish · Thai · Japanese
Cost
Free to customers and partners
Sekoia Self-Hosted: Infrastructure Scoping and Sizing
Size a Self-Hosted infrastructure: node count, per-node requirements, S3 storage, network flows and a readiness review.
Operate · Self-Hosted
Knowledge check
~ 2h50

What you will learn

Translate the license dimensions into a cluster size, a node count and a manager layout
Check a node against the requirements the preflight enforces, and name the fix for a failed check
Calculate the S3-compatible storage a deployment needs from daily ingest and retention
Specify the services and network flows around the cluster, online and air-gapped
Run a readiness review and decide whether an environment can proceed to deployment

Course Details

Modality
Online, self-paced · 5 modules · no lab needed
Prerequisites
Is It Right for You? (recommended)
Duration
~ 2h50
Language
English
Cost
Free to customers and partners
Sekoia Self-Hosted: Deployment
Install Sekoia Self-Hosted: the release archive, the configuration file, the six installation steps, troubleshooting and validation before hand-over.
Operate · Self-Hosted
Knowledge check
~ 5h10

What you will learn

Prepare the orchestration node: verify the release archive, load the SHC and run it online or air-gapped
Write and validate the deployment configuration file for a given environment
Run the installation and read what each of its six steps logs
Troubleshoot a failed installation step, and collect the evidence for Sekoia support
Validate a finished deployment and hand it over with its first community and subscription

Course Details

Modality
Online, self-paced · 8 modules · no lab needed
Prerequisites
Is It Right for You? + Scoping and Sizing (recommended)
Duration
~ 5h10
Language
English
Cost
Free to customers and partners
Sekoia Self-Hosted: Operations and Maintenance
Run Sekoia Self-Hosted day to day: monitoring, incident diagnosis, recovery actions, lifecycle limits and escalation.
Operate · Self-Hosted
Knowledge check
~ 3h

What you will learn

Operate the platform's tools from the orchestration node: the SHC interface, one-shot mode and kubectl
Monitor the platform day to day with the Grafana Default dashboard and Loki
Troubleshoot an incident with the documented diagnostic sequence and read its results
Apply the documented recovery actions, and know when to wait or stop
Plan operations around the platform and content lifecycles, backups and upgrades

Course Details

Modality
Online, self-paced · 6 modules · no lab needed
Prerequisites
Is It Right for You? (recommended)
Duration
~ 3h
Language
English
Cost
Free to customers and partners
SOC Analyst Master
Handles the alert queue: qualify, investigate, escalate.
Master
Master certificate
Recap module + final exam

What you will learn

Defend Essentials
Alert Triage & Cases
Querying with SOL
Optional: Intelligence Essentials
Optional: Reveal Essentials

Course Details

Modality
Self-paced or trainer-led
Prerequisites
The courses of the path
Duration
Recap module + final exam
Language
English · French · Polish · Thai · Japanese
Cost
Certification voucher
Integration Engineer Master
Connects log sources and normalises events.
Master
Master certificate
Recap module + final exam

What you will learn

Defend Essentials
Collecting Logs
Parsing Events
Contributing Production Intake Formats
Optional: Querying with SOL

Course Details

Modality
Self-paced or trainer-led
Prerequisites
The courses of the path
Duration
Recap module + final exam
Language
English · French · Polish · Thai · Japanese
Cost
Certification voucher
Self-Hosted Deployer Master
Sizes and deploys Sekoia on its own infrastructure.
Master · Self-Hosted
Master certificate
Recap module + final exam

What you will learn

Defend Essentials
Self-Hosted: Is It Right for You?
Self-Hosted: Infrastructure Scoping and Sizing
Self-Hosted: Deployment
Optional: Collecting Logs

Course Details

Modality
Trainer-led
Prerequisites
The courses of the path
Duration
Recap module + final exam
Language
English
Cost
Certification voucher
Self-Hosted Operator Master
Runs and maintains a Sekoia Self-Hosted platform.
Master · Self-Hosted
Master certificate
Recap module + final exam

What you will learn

Defend Essentials
Self-Hosted: Is It Right for You?
Self-Hosted: Operations and Maintenance
Optional: Self-Hosted: Infrastructure Scoping and Sizing

Course Details

Modality
Trainer-led
Prerequisites
The courses of the path
Duration
Recap module + final exam
Language
English
Cost
Certification voucher

From sign-up to Master certificate

Learning is free. A voucher is needed only for the final exam.

Partners can resell vouchers and coach their customers. The final exam is always the official Sekoia one.
1. Sign up
Free
Get free access with your work e-mail and land in your learning space.

TIPS :

Access is for employees of Sekoia customers and partners.
2. Learn
At your own pace
Follow the courses of your role's path. A knowledge check after each course shows how you are doing.

TIPS :

Check each course's setup first: some need your organization's Sekoia community, or a machine with Python and Docker.
3. Get a voucher
1 month to redeem
Order it from your Sekoia account manager or your partner. Each voucher is set for one Master path.

TIPS :

Redeem it at training.sekoia.com/self-signup with your work e-mail.
4. Take the final exam
3 months to pass
The voucher unlocks the recap module and the final exam: random questions and hands-on labs. Self-paced includes 2 attempts.

TIPS :

Need more support? Switch to trainer-led at any time. What you already paid is deducted.
5. Get certified
Valid 2 years
You receive your Master certificate and badge, valid for 2 years.

TIPS :

Courses are shared between paths, so a second Master often needs only a few more courses.

Prepare your way, pass the same exam

Self-paced

Study alone or with your partner's coaching, and take the exam when you are ready. 2 exam attempts included.

Trainer-led

A certified Sekoia trainer takes you through the recap module and prepares you for the exam. Required for Self-Hosted Masters in 2026-2027.

Switch at any time

Started self-paced and need more support? Move to trainer-led, for instance after two failed attempts. What you already paid is deducted.

FAQs Sekoia Training

Do I need a trainer?

No. Every course is digital and self-paced, and you can certify on your own. A certified Sekoia trainer is optional, except for the Self-Hosted Masters in 2026-2027.

Do course quizzes count towards certification?

No. The knowledge check at the end of each course helps you measure your progress before the final exam. Only the final exam of a Master path certifies you.

Who gets free access?

Every employee of a Sekoia customer or partner, signing up with a work e-mail address.

How do I get a voucher?

Order it from your Sekoia account manager, or from your partner if a partner manages your Sekoia subscription. Each voucher is set for one Master path and one mode, self-paced or trainer-led, when it is ordered. One order can cover several learners and paths. The voucher code is sent to the learner by e-mail.

How do I use my voucher?

Go to training.sekoia.com/self-signup, sign in with your work e-mail and enter your voucher code. The recap module and the final exam of your Master path then appear in your learning space. Redeem the voucher within 1 month of receiving it, then you have 3 months to pass the exam.

Self-paced or trainer-led?

Self-paced includes 2 exam attempts and suits learners who study alone or with a partner's coaching. Trainer-led adds a certified Sekoia trainer who guides you through the recap module and the exam. You can switch from self-paced to trainer-led at any time if you need it, for instance after two failed attempts: what you already paid is deducted.

How long is a certificate valid?

2 years. A reminder is sent before expiry, and you recertify with a self-paced voucher.

I'm a partner: how do I train and certify the customers I manage?

You resell certification vouchers to your customers, like licences and services. You can also sell your own coaching, run by your staff. Partner coaching is not an official Sekoia course: certification always requires the official exam.

I'm already certified: what happens to my certificates?

Results and certificates already earned are kept and carry over:

  • 301 Certified Analyst → SOC Analyst Master
  • 302 Certified Integrator → Integration Engineer Master
  • 101 Fundamentals → Defend Essentials + Intelligence Essentials

What about Sekoia Self-Hosted?

Self-Hosted courses are free. In 2026-2027, the Deployer and Operator Masters are trainer-led only and taught together in one course.

Which languages are available?

Courses are available in English, French, Polish, Thai and Japanese. Self-Hosted courses are in English for now.

Already registered?

Sign in to your account to continue your learning journey and access your certificates.

Login to Sekoia university