Python for network and security automation
Foundation course
A hands-on Python course that teaches enough to automate the daily work of a network or security team - device configuration, log parsing and API calls - written and run in class. Graduates write scripts that talk to Splunk, to Microsoft Sentinel and to network gear, and arrive prepared for the Python Institute PCEP and PCAP exams.
- Registration
- Waiting list
- Duration
- 24 academic hours
- Format
- In personHybrid
- Level
- Foundation
- Certification
- SpotAcademy certificate of completion
- Language
- Hebrew, course materials in English
- For organisations
- By arrangement - at the academy or hybrid
What you will be able to do
- Write Python with the types, control flow and functions the PCEP exam covers.
- Structure code into modules and classes, and handle files and exceptions.
- Parse logs and data with regular expressions, JSON and CSV.
- Call REST APIs - including the Splunk and Microsoft Graph APIs - from a script.
- Automate a repetitive network or SOC task end to end.
- Build and document a small enrichment or triage tool.
The syllabus
8 modules over 24 academic hours. Open a module for its topics.
- Data types, variables and operators
- Control flow - conditions and loops
- Functions and scope
- The scope of the PCEP exam
- Modules and packages
- Exceptions and error handling
- Strings and file handling
- Object-oriented programming - the PCAP scope
- Regular expressions
- JSON and CSV
- Reading and transforming data
- An introduction to pandas
- Sockets and the requests library
- Talking to HTTP APIs
- An introduction to scapy for packet work
- Parsing device output
- The Splunk REST API and SDK
- Microsoft Sentinel and Microsoft Graph API calls
- Enrichment and lookup scripts
- Scheduling and running jobs
- Simple scanners and fuzzers
- Automating repetitive test steps
- Handling credentials and secrets safely
- Input validation and common pitfalls
- Dependency and virtual-environment hygiene
- Reading and reusing existing code
- Build a triage or enrichment tool end to end
- Code review and documentation
- Preparation for the PCEP and PCAP exams
Who it is for
Who takes this course, and what you need before the first session.
Network and security engineers who want to stop doing the same task by hand.
SOC and IT people automating log work and enrichment.
Anyone starting toward the Python Institute PCEP and PCAP certifications.
Prerequisites
The course is open to anyone with a basic grasp of an operating system and networking; no prior programming experience is required.
The exam and the certification
The course prepares for the Python Institute certifications: PCEP - Certified Entry-Level Python Programmer, then PCAP - Certified Associate Python Programmer. Both have a 70% passing score and are valid for five years; the exams are in English; registration is through the institute's own testing service, and for PCAP also through Pearson VUE. The exact exam-version code is refreshed from time to time, so we confirm the active edition with the vendor before you register.
The certification
SpotAcademy certificate of completion
PCEP
Certified Entry-Level Python Programmer, from the Python Institute: 30 questions, 40 minutes, passing score 70%, delivered online through the institute's own testing service; valid five years.
PCAP
Certified Associate Python Programmer: 40 questions, 65 minutes, passing score 70%, through Pearson VUE or the institute's testing service; valid five years.
When you are ready
No exam is required to finish the course; the certificate of completion stands on its own. The exams are versioned, and we point you to the active code when you book.
The labs
Everything is written and run in class, in the lab's Python environment against live services - Splunk and the lab's network gear. Participants build a small triage or enrichment tool step by step: it reads logs, parses them with regex, calls a REST API and returns a result that can be acted on.
Two ways to take the course
The waiting list for the next open cohort, or an intensive format for a team - which a team can have on its own dates, whatever the open cohorts are doing.
The next cohort
The next cohort is in planning - 24 academic hours at the academy in Shoham. A hybrid option is available, with part of the sessions remote. Join the waiting list and you hear the dates first; the list is also what decides which course opens next.
For your team
An intensive format, by arrangement - at the academy in Shoham, or hybrid with part of the sessions remote. Small groups, and a syllabus adjusted to your equipment and environment.
Related courses
Linux Administration
Linux administration from the first shell prompt to a running server - the command line, users and permissions, storage, services, networking and shell scripts - on Linux servers of your own in the lab. You leave able to build a Linux server, maintain it and troubleshoot it, with the material of the LPIC-1 and CompTIA Linux+ exams covered.
Explore Professional Opening soonPenetration Testing
A penetration-testing course that opens with methodology and moves to the tools - Nmap, Burp Suite, Metasploit and the OWASP Top 10 - against targets built for the purpose in the lab. Graduates can plan an engagement, gather intelligence, exploit a weakness, escalate privileges and move laterally across an Active Directory domain, and write a report a client can act on.
Explore
Associate
Opening soon
Cisco CCNA
Preparation for the Cisco CCNA certification - switching, routing, IP services, security fundamentals and automation, following the 200-301 exam topics Cisco publishes. Participants leave able to build and maintain a small to mid-sized enterprise network on Cisco equipment, and ready to sit the exam.
Explore