What happens if I fail the exam?

You can retake it after a 24-hour cooldown, as many times as you need. Retakes are free, and each attempt draws a fresh random set of questions.

How long is a certificate valid?

The Safeguard Certified Practitioner credential is valid for 24 months from issue. The expiry date is printed on the certificate and shown live on its public verification page. Renewing means passing the current exam again.

Courses

SecOps & SIEM with Safeguard

IntermediateFree8 modules · 19 lessons

About this course

Understand Safeguard's SecOps/SIEM capability: OCSF-normalized ingestion from CloudTrail, Azure, GCP, syslog/CEF and webhook sources; detection via Sigma rules and IOC matching; alert deduplication; and how it relates to AutoTriage's cross-scanner noise reduction inside the same unified findings model.

What you'll learn

Bringing Security Operations Into the Findings Model

OCSF-Normalized Ingestion

Detection: Sigma Rules, IOC Matching, and Deduplication

Sigma Rules and IOC Matching

Where SecOps Fits Alongside the Supply-Chain Core

One Findings Model, Now Including Logs

The OCSF Data Model in Depth

Why Normalisation Decides Everything Downstream
Mapping a CloudTrail Event to OCSF
Syslog, CEF, and Webhook Sources

Detection Engineering with Sigma

Anatomy of a Sigma Rule
Writing a Detection End to End
Tuning, Thresholds, and Rule Lifecycle
IOC Matching and Threat Intelligence

Ingestion Sources and Pipeline Design

Cloud Audit Sources: CloudTrail, Azure, and GCP
On Premises and Network Sources
Webhooks, Retention, and Cost Control

Alerts, Deduplication, and AutoTriage

Why One Event Becomes Many Alerts
AutoTriage and the Rule That Never Bends
Routing, Notification, and Response Expectations

Investigation and Supply Chain Correlation

From Alert to Investigation
Correlating Operational Alerts with Supply Chain Context
Metrics and Programme Health

01Bringing Security Operations Into the Findings Model1 lessons

OCSF-Normalized Ingestion

02Detection: Sigma Rules, IOC Matching, and Deduplication1 lessons

Sigma Rules and IOC Matching

03Where SecOps Fits Alongside the Supply-Chain Core1 lessons

Common questions

How much does Safeguard Academy cost?

Nothing. Every course, exam, and certificate on the catalog is free — including retakes. All you need is a free Safeguard account.

What are the prerequisites?

None. The flagship course, Safeguard Certified Practitioner, is a beginner-level course — basic familiarity with how software is built helps, but every exam question is answerable from the lessons themselves.