What You Will Learn

•      Course orientation

o  How the 7 classes connect; learning path from beginner to advanced

o  Ethics, sandbox rules and the 5 rules of safe AI use

•      AI, Machine Learning, Deep Learning and LLM

o  What each term means in plain words, with an everyday analogy

o  Where ChatGPT, Claude, Gemini, Copilot and Perplexity fit, and what each is good at

•      How an LLM actually works

o  Next-word prediction: why a fluent answer is not always a correct answer

o  Tokens: how text is chopped up, and why very long logs get cut off

o  Context window: the model's short-term memory and its limit

o  Temperature: predictable vs creative output, and which to choose for security work

•      Hallucination

o  Why it happens; real security examples: invented CVE numbers, fake IOCs, fake sources

o  A 5-point verification habit: ask for the source, cross-check, test it, compare a second tool, human sign-off

•      RAG (Retrieval-Augmented Generation)

o  Retrieve, Augment, Generate: how the AI answers from your own documents

o  Why SOC teams ground AI in playbooks, policies and runbooks

o  Limits of RAG: poor documents give poor answers; who is allowed to read which document

•      Safe use of public AI tools: what must never be pasted and why

Tools Used

ChatGPT, Claude, Gemini (any one or more), sample incident-response playbook, Python (optional starter script)

✓ Lab 1: Incident Playbook RAG Bot

Build a bot that answers incident-response questions only from a supplied playbook.

1.       Load the sample playbook into the AI assistant (or the starter script)

2.       Ask 5 in-scope questions, for example: who is notified for a high-severity phishing incident?

3.       Require every answer to name the playbook section it came from

4.       Ask 2 out-of-scope questions and check that the bot says it does not know

5.       Ask the same questions without the playbook and compare the answers

✓ Output After This Class

•      A working RAG bot grounded in an incident playbook

•      A Q&A test sheet: 5 grounded answers, 2 correctly refused answers, and a with / without RAG comparison

•      A one-page AI cheat sheet: key terms in the learner's own words

•      A personal hallucination checklist to use in every later class

Remember: Tool names change every month, but if you understand the concept you can run any tool.