Teaching ASSURED
This page is for the person running the training: a SOC lead onboarding new analysts, a senior analyst mentoring a study group, or a trainer building a curriculum. Everything on the site is free to teach from under its CC BY 4.0 license; this page adds the structure a facilitator needs and the site’s reading order does not provide.
Three delivery formats
Self-study arc individual · ~2 weeks
The reading order as designed: intro through Documentation, one chapter per day or two, quizzes taken solo, then the three exercise packets as the capstone. Works with zero facilitation. The one addition worth making: a peer or lead reviews the learner’s Exercise 1 write-up against the answer key, because self-graded close notes drift generous.
Team workshop group · 4 × 90 minutes
The four-session plan below. Reading happens before each session; session time goes to worked examples, argued quizzes, and exercises, the things that need other people. Best for existing teams adopting a shared vocabulary.
Onboarding curriculum new hire · first month
The workshop plan stretched across a ramp: sessions become weekly, each followed by shadowing shifts where the new analyst writes parallel close notes on real queue alerts and a mentor compares them against the actual dispositions. The one-page reference goes up at the desk on day one; the vocabulary sticks fastest when the letters are used out loud in handoffs.
The four-session plan
Each session assumes the prep reading is done and spends the room’s time on application. Timings are for 90 minutes; cut the quiz debate before cutting the exercise.
Session 1 · The shape of the work A
Prep: Introduction, fast path, Alert chapter through its example.
In session: walk Case A’s Alert example as a group, one person per step, with the facilitator asking “what would you do next” before each reveal (20 min). Run the Alert quiz as argued discussion: answer individually first, then defend disagreements before showing explanations (30 min). Close with the depth ladder: give the room five real (sanitized) alerts from your own queue and have them assign levels (25 min).
Artifact produced: each participant’s level assignments with one-line justifications.
Session 2 · Who and how much S · S
Prep: Subject and Scope chapters through their examples.
In session: the “who before where” drill: present Exercise 1’s briefing and artifacts, run tasks 1-3 (Alert, Subject, Scope) in pairs, written answers (40 min). Debrief against the key, with special attention to who treated the service account as the subject (20 min). Both quizzes as homework-checks, discussing only the questions the room split on (25 min).
Artifact produced: pair-written subject determinations and scope boundaries for Exercise 1.
Session 3 · Evidence and verdict U · R
Prep: Uncover and Risk chapters through their examples; Cognitive traps.
In session: finish Exercise 1: tasks 4-7, pairs keep a visible hypothesis ledger while they work (40 min). Debrief with the traps page open, asking each pair which trap came closest to biting them (25 min). Then the Risk framing drill: give one scenario and have half the room score impact while the other half scores likelihood, then combine, to make the separation of the two axes physical (20 min).
Artifact produced: completed Exercise 1 write-ups with ledgers; these become the rubric calibration set below.
Session 4 · The decision and the record E · D
Prep: Escalation and Documentation chapters through their examples.
In session: Exercise 2 solo, in writing, strictly timed to 30 minutes, then a full-room debrief on who verified the change ticket and who deferred to it (25 min). Exercise 3 as a literal five-minute timed drill (10 min). Close by grading two or three volunteer close notes from Session 3 against the rubric below, as a group, kindly (20 min).
Artifact produced: each participant’s Exercise 2 verdict paragraph, graded against the rubric.
Running an exercise
- Written answers, always. The traps live in the gap between “I basically know” and the sentence on the page. Discussion happens after writing, not instead of it.
- Keys stay sealed. The facilitator reads the key in advance; participants see it only after the debrief has surfaced their actual answers. The keys name the traps planted in each packet, which makes the debrief run itself: ask each group which trap they felt.
- Timebox and enforce. Exercise 3’s five minutes is the exercise. Letting it run long trains exactly the wrong thing.
- Disagreement is the product. When two pairs reach different verdicts from the same artifacts, put both on the screen and trace where the readings diverged. That divergence point is the teachable moment; the “right answer” is secondary.
- Turn real cases into packets. The best exercise library is your own closed queue: take a case, sanitize it per the Documentation example’s sharing discipline, strip the verdict, and present the pre-verdict artifacts. One case a month builds a curriculum no vendor sells.
What to grade: the close-note rubric
Quiz scores measure reading. The skill being trained is the defensible close, and a close note passes on five checks:
- The verdict is stated, in one sentence, using the shared vocabulary (false-positive, benign true positive, confirmed malicious, escalated on criterion X).
- Every claim cites an artifact: a log line, a query result, a ticket, never “it looked normal” or a person’s say-so.
- Confidence is labeled, and at least one claim carries a confidence below the maximum, because a note where everything is “confirmed” was not written honestly.
- The gaps are named, with the condition that would reopen the case.
- The next action is clear: the tuning ticket, the pattern entry, the handoff, or the explicit “nothing further, here is why”.
A note that fails a check gets rewritten, not marked down; the rubric is a revision tool. Calibrate the room by grading two or three notes together before anyone grades alone.
Misconceptions to watch for
Every cohort produces the same handful. Naming them early saves a session’s worth of confusion.
- ”The second S comes first.” Learners scope before resolving the subject, then wonder why the boundary keeps moving. The intro’s memory hook (who before where) is worth saying out loud until it is annoying.
- ”Escalation means escalating.” The E phase is the close-or-escalate decision; most cases close there. Learners who miss this treat every completed investigation as an escalation-in-waiting.
- ”Benign evidence lowers impact.” It lowers likelihood. Impact is scored on the premise the activity is real; the Risk chapter’s Cursor scenario exists to make this concrete, and it is worth walking twice.
- ”A benign true positive is a false positive.” One is a detection working correctly on activity that context clears; the other is detection logic matching what it should not. They produce different feedback: a BTP may earn a pattern entry, a false-positive earns a tuning ticket.
- ”Documentation is the wind-down.” The record is the deliverable the whole arc exists to produce; the escalation example’s late-P1 callout and the documentation example’s hindsight-smoothing callout are the two readings that correct this fastest.
Teaching with the quizzes
The chapter quizzes are written as scenario judgments, which makes them better discussion prompts than tests. The highest-value facilitation move is not checking who scored what; it is finding the question that split the room and making both sides argue from the chapter’s text. A cohort that argues three quiz questions well learns more than one that scores 100%.
Key Takeaway
A facilitator’s leverage is not in explaining the chapters, which the site already does, but in forcing the writing, enforcing the timeboxes, and running the debriefs where divergent readings collide. Teach the letters until the team uses them in handoffs unprompted; that is the adoption signal that matters.