Skip to content


All the courses proposed below involve a mix of theoretical teaching and practical exercises. Theoretical content comes from the punch Product Documentation. Practical exercises are based on real or training use cases.

The standalone platform is used in all trainings so as to provide each participant with its own exercise environment. Participants are free and encouraged to bring their own macos or linux/unix laptop. Check out the standalone platform requirements.

Target Audiences

The various training modules target the following audiences:

  • Solution architects and product integrators, in charge of designing solutions, preparing the actual deployments and configurations, and producing platform-specific resources such as end-user context-specific documentations and configuration packages.
  • Maintenance in Operational Condition (MOC) teams, in charge of configuration updates, platform upgrades, incident management, problem investigation, patch deployment, access control management.
  • Cybersecurity analysts in charge of handling alerts and analyzing events logs (alerts investigation/ forensics).
  • SIEM expert users responsible for configuring alert rules or defining new correlation/specific application development needs.
  • Event logs parsers/normalization/enrichment developers in charge of developing new or improving existing parsers, conforming to the defined data model.
  • Application developers in charge of designing data analytics applications such as aggregations, extract-transform-load pipelines, machine learning applications using a mix of on the shelf punch modules and nodes and custom ones.

Training Units

The punch training catalog provides training units that can be assembled depending on the target audience and their skills, as required for their role(s).

Each unit comes with a delivered material that provides instructions, presentations and exercices. This package also contain trainer instructions so as to be possibly replayed directly as part of the same project without further iplication of the punch team.

Here are the various training units together with their short identification code.

HLI High level introduction, Capabilities, Features, Software and Framework components, design and concepts
CHA Channels and applications design and basic operation, Streams, channels components, PML
DPP Deployment, patching, Platform configuration, upgrading
ARCH Scalability, Sharding and grouping, High Availability ; Components placement Frameworks point of attention
ADM Admin tools (alias, mapping, offsets management, housekeeping) and Troubleshooting, Perf. Tuning
MON Platform, channels and applications monitoring
IKQ Kibana best practices, querying & ES mappings automated aggregation
CAN Configuring simple correlation and alerting rules & notifications
TIDE Normalization/ Data model, Threat Intel, Data enrichment
PUN Punchlang / Parsing, Enrichment development
DEV Advanced application Developers training : Custom Nodes, Stateful correlators
AIM Machine Learning, Python PySpark and Spark application design. Dealing with models.


the CAN and TIDE units are provided as part of the punch cybels analytics product offering.

The units dependency relationship is illustrated next. It indicates in which order the units can be provided. It is essential to follow the required units before moving on to the next one.


Training Sessions Prerequisites

Each training unit requires 3 hours, and is conducted through remote sessions. At most 5 attendees are accepted so as to keep trainings well-adapted to online trainings. A Slack access account is setup for each trainee and for the duration of the training.
In addition, each unit gives access to a citadel question/answer channel so as to consolidate the skills and topics presented during the online course.

Each trainee must have at his/her disposal for the duration of the session a workstation with internet access and the preinstalled following requirements:

  • a Chrome or Safari browser
  • the Slack desktop application installed, and trainee account (provided by the training team) pre-tested by the trainee with the training team to ensure instant access at training session time,
  • SSH client with remote X11 forwarding setup, and capacity to locally display remote X windows (this is for ease of remote files edition during the hands-on training sequences)
  • Allowed SSH outgoing accesses to the internet-accessible training platform.


Trainee are strongly encouraged to use their own personal laptop. The punch training material and standalone works fine on any macos or linux laptop.

Get in touch with the punch team for the training fees or any additional information regarding the trainings content.

Training Material Conventions

The training material provides exercices, explanations, and of course important references to the rich punch online documentation.

The following highlighting is used throughout the training tracks:


Each chapter or track topic is described in here.


All reference to online or external documentation is signaled as part of info highlights. For example: - Punch Programming Reference Guide - Tuples


Some question you should ask yourself and be able to answer are provided. If not clear to you make sure you ask the trainer.


Tips contains the trainer explanations. The concepts or important point to consider and understand are listed here. The punch training material is designed so as to allow you can give it yourself, in turn, to more teams.


Common mistakes or misconfigurations are highlighted in these sections.