Security Analytics (SecA)

This is the course “Security Analytics (SecA)” given each winter semester at the Technische Hochschule Rosenheim.

The responsible professor is Prof. Dr.-Ing. Kevin Mayer.

The module SecA introduces the Security Information and Event Management (SIEM) toolchain, a lab environment, and core security analysis skills. Students will work through a fictional cyber security incident, specifically a phishing triage with basic network traffic analysis. The course covers anomaly detection via statistical baselines, threat intelligence integration, and SIEM correlation rule engineering. Students write detection rules for observed indicators. Further, a deep dive into the Incident Response workflow, memory forensics, and introductory malware analysis is conducted. Students produce a full memory and malware analysis report. The course explores Machine-Learning-based log analysis and hypothesis-driven threat hunting. The course ties together the full attack chain attribution, reporting, and dashboard design to give the students a broad skillset for cyber security defense operations.

The lecture concept was awarded with the Lehrförderpreis in 2026.

Labs and reports

The labs happen after each larger module. You have 72 hours to submit the report on Learning Campus (coming soon). See the due dates and hours in the table below.

Important: You must have submitted at least 3 reports to be eligible for the exam. You may need to revise a report.

Schedule

The lecture is on each Thursday from 8:00-11:15 in room B0.08.

There will be a on-site lecture with a connected exercise. You can also prepare in advance using the coming soon.