SEC495: Leveraging LLMs: Building & Securing RAG, Contextual RAG, and Agentic RAG™

Students must have at least intermediate Python skills since the series of workshops will all be written in Python.

Important! Bring your own system configured according to these instructions.

A properly configured system is required to fully participate in this course. If you do not carefully read and follow these instructions, you will not be able to fully participate in hands-on exercises in your course. Therefore, please arrive with a system meeting all the specified requirements.

Back up your system before class. Better yet, use a system without any sensitive/critical data. SANS is not responsible for your system or data.

Mandatory SEC495 System Hardware Requirements

Your system must have at least 16 gigabytes of RAM; more is better. The system must be running a modern 64-bit operating system such as Windows 10, Windows 11, Linux, or MacOS. Both Intel and ARM processors are fully supported in the labs. Your system must have at least 20 gigabytes of free disk space available.

This class does not use VMWare. You must have the appropriate rights to install software, or your system must be preconfigured with Rancher Desktop installed and functioning. Docker can also be used if you have a strong preference for it (especially if you are running Linux). Other containerization solutions supporting Docker compose files are acceptable, but you may need to supply your own support. Internet connectivity is required at several points during the class.

If you have additional questions about the laptop specifications, please contact customer service. 

More and more, management is looking to us to leverage AI in useful ways in the enterprise. How can we do this? What does it look like? While there are many answers to these questions, and SEC595 provides clear answers with regard to threat hunting and monitoring, SEC495 teaches you everything you need to know to get started building solutions that leverage LLMs. While the SEC595 solutions are extremely useful and cutting edge, the SEC495 focus on building RAG solutions using LLMs is much more readily understood by management teams who can instantly see and understand how the solution is useful.

While we focus on leveraging (and securing) RAGs for information retrieval, there are some beautiful natural extensions, such as identifying standards compliance based on policies, automated report generation, and many more. Perhaps the best part of SEC495 is that everything is completed using on-premises containers. Of course, you can host these in the cloud, scale them up, or even trade them out for commercial APIs, but you learn how to implement all these pieces without every needing to send sensitive information to a third party. That’s a big win!

-Dave Hoelzer