Syllabus: AINS6301 Automated Response Systems#
Course Identity#
Field |
Value |
|---|---|
Course |
AINS6301 Automated Response Systems |
Program |
Aurnova Master of Science in Artificial Intelligence |
Track |
Cybersecurity AI |
Credits |
3 graduate credits |
Format |
8-week online graduate course with weekly instructor interaction |
Primary environment |
Google Colab for first-run labs; GitHub Codespaces for repository-based or instructor-guided work |
Catalog Description#
Builds AI-assisted incident response playbooks, orchestration, remediation, escalation, testing, and learning loops.
Student Audience and Prerequisites#
Completion of the MSAI core foundations or permission of the instructor is recommended. No undergraduate computer science major is assumed; technical work remains scaffolded around interpretation, evidence, and professional judgment. The course is designed for graduate students preparing to lead, evaluate, manage, or apply AI work in professional settings. Students are not expected to be computer science majors. Technical work is scaffolded so students can run a notebook, observe output, change one controlled variable, and explain the evidence in professional language.
Course-Level Learning Outcomes#
By the end of this course, students will be able to:
CO1: Analyze professional problems in Automated Response Systems and formulate AI use cases with explicit stakeholders, decision boundaries, data assumptions, and success criteria.
CO2: Execute or interpret reproducible notebook-based investigations that demonstrate core Automated Response Systems methods using guided Python/Colab workflows.
CO3: Evaluate model, workflow, or governance evidence for accuracy, validity, uncertainty, bias, security, privacy, and operational limitations appropriate to Cybersecurity AI contexts.
CO4: Produce professional artifacts for Automated Response Systems, including briefs, model cards, risk registers, evaluation memos, implementation plans, or executive recommendations.
CO5: Apply responsible AI, academic integrity, data stewardship, accessibility, and human-oversight expectations to course work and proposed deployments.
CO6: Communicate AI findings, limitations, tradeoffs, and next-step recommendations to technical and nontechnical stakeholders using clear graduate-level evidence.
Credit-Hour and Contact-Hour Rationale#
This 3-credit accelerated graduate course expects approximately 135 total student learning hours across the 8-week term. The course design allocates approximately 45 hours to instructor-led lecture, narrated content, guided lab demonstration, discussion, feedback, and synchronous or asynchronous interaction. Approximately 90 additional hours are allocated to reading, notebook practice, applied assignments, revision, and the final portfolio artifact. Each module contains enough slide and narration material for a 90-minute class session, plus labs and assignments that extend learning beyond direct instruction.
Weekly Schedule and Major Deliverables#
Week |
Module Topic |
Essential Question |
Primary Deliverable |
|---|---|---|---|
1 |
Incident response lifecycle |
Where can automation improve response? |
Module 1 Assignment: Incident response lifecycle |
2 |
Playbooks and decision trees |
How do procedures become executable response logic? |
Module 2 Assignment: Playbooks and decision trees |
3 |
SOAR and tool orchestration |
How do response systems coordinate tools? |
Module 3 Assignment: SOAR and tool orchestration |
4 |
Containment and remediation automation |
What actions can be safely automated? |
Module 4 Assignment: Containment and remediation automation |
5 |
Human approval and escalation |
When must people remain in the loop? |
Module 5 Assignment: Human approval and escalation |
6 |
Testing response automation |
How can automation be validated before incidents? |
Module 6 Assignment: Testing response automation |
7 |
Post-incident learning |
How does the system improve after response? |
Module 7 Assignment: Post-incident learning |
8 |
Automated response readiness review |
What makes a response system deployable? |
Module 8 Assignment: Automated response readiness review |
Assessment Plan#
Component |
Weight |
Evidence |
|---|---|---|
Module applied assignments (Modules 1–7) |
35% |
Seven professional artifacts, 50 course points each, scored with module rubrics. |
Notebook labs and exit-ticket reflections (Modules 1–8) |
20% |
Eight 25-point guided investigations with baseline, controlled comparison, interpretation, and limitation evidence. |
Mid-course synthesis brief |
15% |
One 150-point integrative memo covering evidence from at least two of Modules 1–4. |
Final applied portfolio (Module 8 assignment) |
20% |
One 200-point cumulative artifact; it is not counted again as a module applied assignment. |
Weekly professional engagement |
10% |
Eight 12.5-point records of preparation, constructive response, and revision/next-step evidence. |
Populi uses a 1,000-point total: 350 + 200 + 150 + 200 + 100. Populi remains the official gradebook and source of dates, submission status, feedback, and final grades.
Passing performance requires both cumulative course performance of 70% or higher and submission of the final applied portfolio artifact. Graduate-level performance requires accurate vocabulary, evidence-based reasoning, responsible limitation statements, and professional communication. Students may revise selected artifacts when the instructor determines that revision supports learning outcomes and academic integrity.
Grading Scale#
Grade |
Range |
Interpretation |
|---|---|---|
A |
93-100 |
Excellent graduate performance; evidence is rigorous, well communicated, and professionally defensible. |
A- |
90-92 |
Strong graduate performance with minor gaps in depth, precision, or integration. |
B+ |
87-89 |
Good performance; work is complete and evidence-based but not consistently advanced. |
B |
83-86 |
Satisfactory graduate performance; meets core expectations with some limitations. |
B- |
80-82 |
Marginal graduate performance; recurring gaps require attention. |
C |
70-79 |
Minimal passing performance; significant weaknesses in evidence, accuracy, or communication. |
F |
Below 70 |
Does not demonstrate required course outcomes. |
Required Readings, Standards, and Professional Resources#
The instructor may update editions, links, or equivalent institutional resources before the term begins. Readings combine scholarly foundations, professional standards, and applied guidance.
Before the course opens, the instructor or program designee verifies library access, link currency, accessible formats, and any approved substitutions. Populi identifies the authoritative assigned edition or link for the live offering; students should use that version rather than an older saved copy.
Module |
Topic |
Required Reading or Standard |
Applied Professional Resource |
|---|---|---|---|
1 |
Incident response lifecycle |
NIST SP 800-61r2 Computer Security Incident Handling Guide. |
CISA incident response playbook guidance. |
2 |
Playbooks and decision trees |
CISA incident response playbook guidance. |
SOAR and orchestration readings selected by instructor. |
3 |
SOAR and tool orchestration |
SOAR and orchestration readings selected by instructor. |
MITRE D3FEND resources for defensive countermeasures. |
4 |
Containment and remediation automation |
MITRE D3FEND resources for defensive countermeasures. |
Human-in-the-loop approval and escalation guidance selected by instructor. |
5 |
Human approval and escalation |
Human-in-the-loop approval and escalation guidance selected by instructor. |
Incident simulation and tabletop exercise guidance selected by instructor. |
6 |
Testing response automation |
Incident simulation and tabletop exercise guidance selected by instructor. |
Post-incident review and learning resources selected by instructor. |
7 |
Post-incident learning |
Post-incident review and learning resources selected by instructor. |
NIST Cybersecurity Framework 2.0, Respond and Recover functions. |
8 |
Automated response readiness review |
NIST Cybersecurity Framework 2.0, Respond and Recover functions. |
NIST SP 800-61r2 Computer Security Incident Handling Guide. |
Learning Technology and Beginner Support#
Students should start notebook labs in Google Colab unless the instructor specifies Codespaces. Colab lowers setup burden and supports students who are new to Python. Students should first run the notebook unchanged, then change one small value and explain what changed. Codespaces is used when an activity requires the full repository, multiple files, tests, or GitHub workflow evidence. The course assesses interpretation, evidence, limitations, and professional judgment; it does not assume that every student enters as a programmer.
Before launch, the instructor or program designee tests Colab and Codespaces access, equivalent activity paths, assistive-technology concerns, and the support escalation route. Populi provides the current accessibility, accommodation, and technical-support contacts for the live offering.
Academic Integrity and Permitted AI Assistance#
Students must submit their own analysis, decisions, explanations, and reflections. Use of generative AI tools is permitted for brainstorming, debugging, summarizing public documentation, and improving prose when allowed by the instructor, but students must disclose material AI assistance and remain responsible for factual accuracy, citations, code behavior, and final claims. Fabricated citations, hidden AI-generated submissions, unauthorized collaboration, or submission of work the student cannot explain may be treated as academic misconduct.
Accessibility and Accommodations#
Aurnova is expected to provide reasonable accommodations consistent with institutional policy and applicable law. Students who need accommodations should contact the designated institutional office and notify the instructor as early as possible. Course materials should be provided in accessible formats when feasible, including readable HTML pages, downloadable notebooks, text-based instructions, and alternatives for activities that require specific hardware or external accounts.
Data Privacy, Safety, and Responsible Use#
Unless explicitly approved by the instructor and institution, students must not upload confidential, regulated, proprietary, patient, student, financial, security-sensitive, or personally identifiable information into Colab, Codespaces, public repositories, or third-party AI tools. Labs use synthetic or public proxy data. Students must document data assumptions, privacy risks, and operational limits before recommending real-world use.
Late Work, Participation, and Instructor Interaction#
Students are expected to engage weekly with readings, lecture material, labs, and applied deliverables. Late work may receive reduced credit unless prior arrangements are approved or institutional policy applies. The instructor should provide regular substantive interaction through announcements, discussion, feedback, office hours or appointments, assignment feedback, and timely grading. Participation is evaluated by evidence of preparation, constructive discussion, peer feedback, and revision effort rather than by technical bravado.
Accreditation Evidence Location#
Aurnova maintains program-outcome mappings, assessment records, and continuous-improvement evidence separately from the public learner site. Those records are not learner coursework or a substitute for the syllabus, rubric, or Populi gradebook.