Stop Wasting Hours on Manual Threat Hunting: Build AI Security Tools in 50 Labs

Stop Wasting Hours on Manual Threat Hunting: Build AI Security Tools in 50 Labs

Your SIEM is screaming. Your inbox is drowning in alerts. And you're still writing regex rules by hand like it's 2012.

Here's the brutal truth that nobody in your Security Operations Center wants to say out loud: the bad guys are already using AI. They're generating polymorphic malware, crafting spear-phishing emails at scale, and automating reconnaissance with LLM-powered tools. Meanwhile, you're stuck pivoting between Splunk dashboards, manually correlating logs, and praying your YARA rules catch what evolves tomorrow.

What if you could flip the script? What if you became the one wielding AI to build detection pipelines, automate incident response, and predict threats before they land?

Enter ai_for_the_win — a battle-tested training program that transforms security practitioners into AI tool builders. Not theorists. Builders. Fifty hands-on labs. Four capstone projects. Eighteen CTF challenges. All designed for "vibe coding" with AI assistants like Cursor, Claude Code, and GitHub Copilot.

This isn't another "AI in cybersecurity" webinar that leaves you with vague platitudes. This is your blueprint for constructing real tools that catch real threats. And the first 13 labs? Completely free. No API keys. No excuses.

Ready to stop being outpaced by attackers and start building your arsenal?

What is ai_for_the_win?

ai_for_the_win is an open-source, hands-on training ecosystem created by Raymond DePalma, a security practitioner who clearly got tired of watching the industry talk about AI without actually building with it. Launched as a comprehensive response to the growing skills gap between traditional security operations and AI-augmented defense, this repository has rapidly become the underground favorite among SOC analysts, incident responders, and red teamers who want to level up fast.

The program is structured around 50+ progressive labs spanning five difficulty tiers: Foundation (grey), ML Foundations (green), LLM Basics (purple), Detection & DFIR (orange), and Advanced/Cloud (red). Each tier builds upon the last, taking you from "What's a prompt?" to deploying autonomous threat-hunting agents in production environments.

But here's what makes this genuinely different from every Coursera certificate and Udemy course collecting digital dust in your bookmarks:

It's built for "vibe coding." DePalma explicitly designed these labs to be completed alongside AI coding assistants. You're not memorizing scikit-learn APIs or LangChain syntax — you're learning to orchestrate AI tools to build security tools faster than humanly possible. The repository includes Colab notebooks for instant browser-based execution, a full Docker^{↗ Bright Coding Blog} environment with Elasticsearch, Kibana, PostgreSQL^{↗ Bright Coding Blog}, Redis, MinIO, Ollama, and ChromaDB, plus solution walkthroughs when you get stuck.

The dual licensing model (MIT for code, CC BY-NC-SA for educational content) means you can freely use the code in commercial tools while respecting the educational materials. And with OpenSSF Scorecard integration and active CI pipelines, this isn't abandonware — it's a living, breathing curriculum that evolves with the threat landscape.

Why it's trending now: The cybersecurity industry hit an inflection point in 2024-2025. LLMs went from novelty to necessity. Security vendors slapped "AI-powered" on every datasheet without explaining how. Practitioners realized they needed to build their own tools or be held hostage by black-box solutions. ai_for_the_win arrived at exactly the right moment — practical, hands-on, and ruthlessly focused on outcomes.

Key Features That Separate Builders from Bystanders

Let's dissect what makes this training ecosystem genuinely powerful for security practitioners who are done with passive learning:

🎯 Progressive Lab Architecture with Clear Skill Gates

The color-coded progression isn't just visual candy — it's a deliberate pedagogical strategy. Grey foundation labs (00-09) establish Python^{↗ Bright Coding Blog} security fundamentals and prompt engineering basics without requiring any API expenditure. Green ML labs (10-13) build your first models using scikit-learn and TF-IDF. Only when you've proven fundamentals do you unlock purple LLM labs (14-18) requiring API keys. This prevents the common failure mode of throwing money at GPT-4 calls before understanding when LLMs actually help versus when traditional ML suffices.

🐳 Production-Ready Docker Environment

The included Docker Compose configuration isn't a toy setup. It spins up Jupyter Lab, Elasticsearch, Kibana, PostgreSQL, Redis, MinIO for object storage, Ollama for local LLM inference, and ChromaDB for vector operations. You can simulate full detection pipelines, build RAG systems over threat intel, and test local models without burning API credits. The docker compose up -d jupyter profile gets you started in seconds; full stack^{↗ Bright Coding Blog} deployment supports the most advanced labs.

🤖 AI-Assistant Native Design

Every lab is optimized for "vibe coding" — DePalma's term for flowing with AI assistants rather than fighting them. Labs include starter code, clear requirements, and evaluation criteria that let Cursor or Claude Code understand intent. You're not cheating by using AI; you're learning to direct AI effectively, which is arguably the more transferable skill than memorizing any single framework.

🏆 CTF-Integrated Learning

Eighteen capture-the-flag challenges bridge the gap between guided labs and independent problem-solving. These aren't gimmicky puzzles — they're realistic scenarios where your AI-built tools either catch the adversary or they don't. The immediate feedback loop accelerates skill acquisition far beyond traditional coursework.

📊 Real Datasets, Real Tools, Real Outcomes

Sample datasets include actual malware metadata for YARA generation, Windows event logs for detection engineering, and network traffic for C2 analysis. The technology stack reads like a modern security engineer's wishlist: LangChain and LangGraph for agent orchestration, PyTorch and Transformers for deep learning, Sigma and YARA for detection rules, MITRE ATT&CK for structured threat modeling.

Four Battle-Tested Use Cases Where This Training Pays Dividends

1. Autonomous Phishing Detection at Scale

Your organization's email gateway catches 99% of obvious spam. It's the 1% — the crafted executive impersonations, the typo-squatted domains, the urgency-laced social engineering — that breaches companies. Lab 10's phishing classifier demonstrates how TF-IDF feature extraction paired with Random Forest classification achieves 96.2% accuracy with 97.8% recall on nuanced cases that rules miss entirely. The model exposes its reasoning: urgency words contribute +0.34 to phishing probability, URL mismatches +0.28, domain spoofing +0.22. You don't just get a verdict; you get explainable detection that satisfies skeptical incident responders.

2. LLM-Powered Log Analysis for Overwhelmed SOCs

Modern enterprises generate terabytes of logs daily. Human analysts can't scale. Lab 35's pipeline shows how to deploy LLMs for initial log triage — parsing entries, identifying threats, extracting IOCs, and generating structured incident reports with MITRE ATT&CK mapping. The output isn't raw model hallucination; it's a rigorous timeline with confidence-scored attribution. A multi-stage PowerShell attack that would take 45 minutes to manually reconstruct gets analyzed in seconds, complete with FIN7/Carbanak attribution based on TTP sequence matching.

3. RAG-Enhanced Threat Intelligence Operations

Your threat intel team subscribes to 50 feeds. Nobody can read them all. Lab 18's Security RAG implementation uses ChromaDB to embed and retrieve relevant intelligence context, enabling natural language queries like "What are FIN7's latest persistence techniques?" against your entire knowledge base. The retrieval-augmented generation pattern eliminates LLM hallucination on factual matters while maintaining conversational flexibility. Combined with Lab 16's autonomous threat intel agent, you build systems that don't just answer questions — they proactively investigate indicators.

4. Purple Team Automation and Adversary Simulation

Lab 32's safe ransomware simulation and Lab 50's purple team AI demonstrate how to automate attack emulation for continuous control validation. Instead of annual penetration tests, your AI agent generates and executes safe attack variants, measures detection coverage, and identifies gaps. Lab 49's LLM red teaming specifically trains you to probe your own defenses — prompt injection, jailbreaks, and adversarial inputs that expose weaknesses before attackers do.

Step-by-Step Installation: From Zero to Building in Under 5 Minutes

Option 1: Instant Browser Start (Recommended for First-Timers)

No installation. No configuration. No API keys for foundations.

All 50+ notebooks live in the notebooks/ directory — open any .ipynb directly in Colab.

Option 2: Full Docker Environment (Recommended for Serious Practitioners)

# Clone the repository
git clone https://github.com/depalmar/ai_for_the_win.git
cd ai_for_the_win/docker

# Start Jupyter only — fastest, sufficient for most labs
docker compose up -d jupyter

# Or start complete stack (8GB+ RAM recommended)
docker compose up -d

# Access Jupyter Lab: http://localhost:8888 (token: aiforthewin)

Available services: Jupyter Lab, Elasticsearch, Kibana, PostgreSQL, Redis, MinIO, Ollama (local LLMs), ChromaDB (vectors). Start only what you need — see docker/README.md for service profiles.

Option 3: Local Python Installation (Maximum Control)

⚠️ Critical: Python 3.10, 3.11, or 3.12 required. Python 3.13 is experimental. Python 3.14 is explicitly unsupported — it causes resolution-too-deep errors because PyTorch, LangChain, and other packages lack 3.14 wheels.

# 1. Clone and enter repository
git clone https://github.com/depalmar/ai_for_the_win.git
cd ai_for_the_win

# 2. Create virtual environment (specify python3.12 if multiple versions exist)
python -m venv venv
source venv/bin/activate  # Windows: .\venv\Scripts\activate

# 3. Install dependencies — CHOOSE ONE based on your needs:
pip install -r requirements.txt           # Everything (all providers)
pip install -e ".[anthropic]"             # Core + Claude (recommended for beginners)
pip install -e ".[ollama]"                # Core + Ollama (free, local, no API costs)
pip install -e "."                        # Core only (Labs 00-13, no LLM capabilities)

# 4. Verify your setup catches common issues
python scripts/verify_setup.py

# 5. Begin with Lab 00 — zero API key required
cd labs/lab00-environment-setup

Dependency troubleshooting: If pip install hangs with resolution-too-deep:

1. Verify Python version: python --version (must be 3.10-3.12)
2. Try uv for faster resolution: pip install uv && uv pip install -r requirements.txt
3. Install selectively: pip install -e ".[anthropic]" instead of full requirements

API Key Configuration (Labs 14+)

# Copy example environment file
cp .env.example .env

# Edit .env with your preferred editor — NEVER paste keys in terminal (saved in shell history)
# Example contents:
# ANTHROPIC_API_KEY=your-key-here
# OPENAI_API_KEY=your-alternative-key
# GOOGLE_API_KEY=your-gemini-key

# Verify everything works
python scripts/verify_setup.py

Budget reality check: All labs support multiple providers. You only need ONE key. Total API cost for entire advanced track: approximately $5-25. Compare that to a single cybersecurity certification exam.

REAL Code Examples: See the Power in Action

The ai_for_the_win repository doesn't tease with toy examples. Here are actual outputs from production-ready labs, exactly as documented:

Lab 10: Phishing Classifier — What Rules Miss

This isn't theoretical. This is what executes when you run the solution:

$ python labs/lab10-phishing-classifier/solution/main.py

[+] Training on 1,000 labeled emails...
[+] Model: Random Forest + TF-IDF (847 features)
[+] Accuracy: 96.2% | Precision: 94.1% | Recall: 97.8%

Scanning inbox (4 new emails)...

  From: security@amaz0n-verify.com
  Subj: "Your account will be suspended in 24 hours"
  --> PHISHING (98.2%)  [urgency + spoofed domain]

  From: sarah.jones@company.com
  Subj: "Q3 budget report attached"
  --> LEGIT (94.6%)

  From: helpdesk@paypa1.com
  Subj: "Click here to verify your identity"
  --> PHISHING (96.7%)  [link mismatch + typosquat]

  From: it-dept@company.com
  Subj: "Password expires in 7 days - reset here"
  --> SUSPICIOUS (67.3%)  [needs review]

Top features that caught phishing:
   urgency_words: +0.34  (suspend, verify, immediately)
   url_mismatch:  +0.28  (display != actual link)
   domain_spoof:  +0.22  (amaz0n, paypa1)

Why this matters: The model doesn't just classify — it explains. The feature importance breakdown (urgency_words: +0.34) gives incident responders actionable intelligence. The SUSPICIOUS category with 67.3% confidence demonstrates calibrated uncertainty — it knows when it doesn't know, routing edge cases for human review instead of generating false confidence. This is the difference between demo-ware and production-ware.

Lab 35: LLM Log Analysis — Finding Attacks in Noise

Manual log analysis doesn't scale. This pipeline automates the entire SOC tier-1 triage workflow:

+------------------------------------------------------+
| Lab 35: LLM-Powered Security Log Analysis - SOLUTION |
+------------------------------------------------------+
Security Log Analysis Pipeline

Step 1: Initializing LLM...
  LLM initialized: READY
Step 2: Parsing log entries...
  Parsing entry 1/5... Done
  Parsing entry 2/5... Done
  Parsing entry 3/5... Done
  Parsing entry 4/5... Done
  Parsing entry 5/5... Done
  Parsed 5 log entries
Step 3: Analyzing for threats...
  Found 2 threats
  Severity: 8/10
Step 4: Extracting IOCs...
  Extracted 12 IOCs
Step 5: Generating incident report...
  Report generated

================================================================
                        INCIDENT REPORT
================================================================

+--------------------------------------------------------------+
|                    Executive Summary                          |
+--------------------------------------------------------------+
A critical security incident involving multi-stage attack behavior
was detected on WORKSTATION01 involving user 'jsmith'. The attack
progression includes initial PowerShell execution downloading a
payload from a suspicious external domain, followed by system
discovery commands, and culminating in persistence establishment
via Registry Run keys and Scheduled Tasks.

+--------------------------------------------------------------+
|                        Timeline                               |
+--------------------------------------------------------------+
 1  2025-01-15 03:22:10 - PowerShell downloaded payload from
                          hxxp://evil-c2[.]com/payload.ps1
 2  2025-01-15 03:22:15 - Discovery commands executed
                          (whoami, hostname, ipconfig)
 3  2025-01-15 03:22:18 - Network connection to evil-c2[.]com
                          (185[.]143[.]223[.]47:443)
 4  2025-01-15 03:23:00 - Registry persistence: HKCU Run keys
 5  2025-01-15 03:25:00 - Scheduled Task: SecurityUpdate created

+--------------------------------------------------------------+
|                    MITRE ATT&CK Mapping                       |
+--------------------------------------------------------------+
  Technique ID   Technique Name                    Evidence
 -------------------------------------------------------------
  T1059.001      PowerShell                        DownloadString, IEX
  T1082          System Information Discovery      whoami, hostname
  T1547.001      Registry Run Keys                 HKCU\...\Run
  T1053.005      Scheduled Task                    SecurityUpdate
  T1105          Ingress Tool Transfer             DownloadString

+--------------------------------------------------------------+
|                   Attribution Analysis                        |
+--------------------------------------------------------------+
High Confidence: FIN7/Carbanak
* Tooling matches known campaigns (PowerShell obfuscation)
* Infrastructure historically associated with FIN7
* TTP sequence is signature behavior pattern

Why this matters: The pipeline transforms raw logs into actionable intelligence — structured timeline, MITRE ATT&CK mapping with specific evidence, and attribution analysis with confidence scoring. A process that consumes 30-60 minutes of analyst time completes in under 30 seconds. The structured output integrates directly with ticketing systems, automated response playbooks, and executive briefings. This is how you scale human expertise without scaling human headcount.

Docker Environment — One Command, Full Stack

# The complete local development environment
git clone https://github.com/depalmar/ai_for_the_win.git
cd ai_for_the_win/docker

# Jupyter-only for quick experiments (minimal resource footprint)
docker compose up -d jupyter

# Full security operations platform (comprehensive capabilities)
docker compose up -d
# Spins up: Jupyter Lab, Elasticsearch, Kibana, PostgreSQL, 
#           Redis, MinIO, Ollama (local LLMs), ChromaDB (vectors)

Why this matters: Reproducible environments eliminate "works on my machine" friction. The service-oriented architecture lets you compose exactly the infrastructure your lab requires — no more, no less. Ollama provides free local LLM inference for cost-sensitive experimentation. ChromaDB enables vector search without managed service dependencies. This mirrors how modern security engineering teams actually build: infrastructure-as-code, version-controlled, collaboratively developed.

Advanced Usage & Best Practices from the Trenches

🎯 Strategic Lab Sequencing for Maximum ROI

Don't treat labs as a checklist. The repository provides role-based paths: SOC analysts should prioritize Labs 05, 10, 15, 23, 29; incident responders need Labs 25-35; threat hunters benefit from Labs 16, 31, 34, 36. The resources/role-based-learning-paths.md file maps your current role to optimal progression.

💰 API Cost Optimization

Labs 00-13 require zero API spend — master these completely before opening your wallet. When advancing to LLM labs, start with Ollama (free, local) for experimentation, then promote to Claude/GPT only for final validation. The pip install -e ".[ollama]" profile keeps costs at literally zero for most advanced labs.

🧪 CTF as Capability Validation

Don't skip the 18 CTF challenges. They're designed to break your tools — adversarial inputs, edge cases, and realistic evasion techniques that expose where your AI-assisted solutions fail. A phishing classifier that works on clean test data but collapses on obfuscated Unicode homoglyphs isn't production-ready. CTFs reveal these gaps safely.

🔒 Security Hygiene for Security Builders

The repository includes simulated attack artifacts that trigger antivirus. Exclude these paths before starting: ctf-challenges/**/challenge/, labs/lab21-yara-generator/data/, data/malware/. The scripts/verify_setup.py checks your environment and flags common misconfigurations.

🤖 Vibe Coding Mastery

DePalma's labs are explicitly designed for AI pair programming. But direction matters: feed Cursor the lab's README.md and requirements.txt as context, specify the evaluation criteria from the start, and iterate on failing tests rather than accepting first-draft solutions. The skill you're building isn't Python syntax — it's AI orchestration for security outcomes.

Comparison: Why ai_for_the_win Dominates Alternatives

The verdict: Generic ML courses teach you to classify Iris flowers. Vendor certifications teach you to click their product's UI. ai_for_the_win teaches you to build tools that catch FIN7. The difference is existential for practitioners who need to defend against adversaries, not pass multiple-choice exams.

FAQ: What Developers and Security Pros Actually Ask

Q: Do I need a machine learning background to start?

A: Absolutely not. Labs 00-09 assume only basic Python. The "ML Concepts Primer" (Lab 04) and "Hello World ML" (Lab 07) build intuition from zero. If you can write a for loop, you can start. The AI assistants handle syntax; you focus on security logic.

Q: How much will API keys actually cost me?

A: Labs 00-13: $0. Labs 14-50 with Ollama local LLMs: $0. Labs 14-50 with Claude/GPT: approximately $5-25 total for complete progression. The repository includes cost-tracking utilities (Lab 24) so you monitor spend in real-time.

Q: Can I use this for commercial security tools?

A: The code (MIT license): yes, freely. The educational content (CC BY-NC-SA): personal use free, commercial training requires licensing. See docs/COMMERCIAL_LICENSING.md for corporate training, bootcamps, and consulting use cases.

Q: What if my antivirus quarantines lab files?

A: Expected behavior — the repository contains simulated attack artifacts for analysis. Exclude: ai_for_the_win/ (entire repo), ctf-challenges/**/challenge/, labs/lab21-yara-generator/data/, data/malware/. These contain metadata and educational simulations, not functional malware.

Q: Is this suitable for red teamers or only blue team?

A: Explicitly both. Labs 32 (ransomware simulation), 37 (AI-powered threat actors), 49 (LLM red teaming), and 50 (purple team AI) serve offensive practitioners. Understanding AI detection is prerequisite to AI evasion.

Q: How current is the content?

A: Active CI/CD pipeline, OpenSSF Scorecard monitoring, and community contributions keep materials current. The curriculum addresses GPT-5, Gemini 3, and Claude's latest models. MITRE ATT&CK mappings update with framework revisions.

Q: Can I contribute or request new labs?

A: Yes — see CONTRIBUTING.md. The maintainer actively merges community labs, especially for emerging attack vectors and defensive techniques.

The Bottom Line: Build or Be Breached

The cybersecurity arms race has irrevocably shifted. Attackers aren't just using AI — they're building with it, iterating faster than any vendor patch cycle. The question isn't whether AI belongs in your security stack. The question is whether you will be the one architecting that stack, or the one blindsided by opponents who did.

ai_for_the_win isn't a course completion certificate for your LinkedIn. It's a construction kit for the tools you'll actually deploy: phishing detectors that explain their reasoning, log analyzers that generate ATT&CK-mapped incident reports, threat intel agents that investigate autonomously, and purple team systems that validate defenses continuously.

Fifty labs. Thirteen free. Four capstones. Eighteen CTF challenges. One decision.

Start building today. Open Lab 02 in Colab for zero-cost fundamentals, or clone the full repository and run docker compose up -d jupyter for your local security AI lab. The adversaries aren't waiting. Neither should you.

What's the first tool you're going to build?