Cyber Security & Operations

The foundation everything else builds on. You'll learn to navigate a Linux system, create and manage files, control who can access what, and chain commands together to automate tasks. By the end, you'll be able to set up users, connect to servers over SSH, install software, and run your first Docker container.

Chain commands together to filter, sort, count, and search through data. Redirect output to files, combine streams, and build one-liners that do real work.

|, >, >>, 2>&1, tee, sort, uniq, wc, grep

T04 Processes & System (+Quiz)

See what's running on your system, monitor resource usage in real time, stop runaway processes, and manage background jobs.

ps, top, kill, bg, fg, jobs

Lab Disk Space Incident

A disk space alert fired overnight. Investigate the cause, find what's eating the space, and preserve the evidence.

Covers: df, ls -lh, tail, grep -c, output redirection

T05 Users & SSH (+Quiz)

Create and manage user accounts, configure sudo access, generate SSH keys, and connect to remote servers securely.

useradd, passwd, sudo, ssh, ssh-keygen, authorized_keys

T06 Networking (+Quiz)

Check your network interfaces, test connectivity, make HTTP requests from the terminal, understand how DNS resolves names, and identify what's listening on which ports.

ip, ss, ping, curl, DNS resolution, ports

T07 Package Management (+Quiz)

Install, update, and remove software. Manage repositories, resolve dependency issues, and keep your system current.

apt, dpkg, repositories, dependencies

T08 Docker Basics (+Quiz)

Pull images, run containers, map ports, and manage the container lifecycle. Your first step into the tool that changed how software gets deployed.

images, containers, run, ps, stop, rm, port mapping

Lab Shift Handoff

Your colleague left two issues to check before their shift ended. Read the handoff, investigate both, and close them out.

Covers: cat, ls, find, wc, free

Exam Level 1 Master Exam

Prove you've mastered the fundamentals. 10 questions covering everything from Level 1. Score 80% or higher to pass.

Covers: files, permissions, pipes, processes, users, SSH, networking, packages, docker

Cards Level 1 Flashcards

Drill every command and concept from Level 1. Cards pull from this level's quizzes and exam, and the ones you miss come back more often.

Running a Linux server means keeping it healthy, secure, and automated. Job scheduling, log management, firewalls, disk management, backups, shell environments, systemd services, and text processing with awk and sed.

T09 Cron & Scheduling (+Quiz)

Automate recurring tasks with cron. Write crontab entries, schedule scripts to run at specific times, and build the habits that keep servers running without you watching.

crontab, cron.d, at, 5-field syntax, scheduling

T10 Log Management (+Quiz)

Read and analyze system logs with journalctl and syslog. Set up log rotation so your disks don't fill up, and learn to spot patterns that tell you something is wrong before it breaks.

journalctl, syslog, logrotate, /var/log, log analysis

T11 Firewall (+Quiz)

Control what traffic gets in and out of your server. Set up allow and deny rules, configure default policies, and understand the basics of network security at the OS level.

ufw, allow, deny, status, default policies

T12 Disk Management (+Quiz)

Monitor disk usage, understand mount points, work with block devices, and get an introduction to LVM for flexible storage management.

df, du, lsblk, mount, fdisk, LVM basics

Lab Failed Backup Investigation

The nightly backup didn't complete. Trace the failure from cron to the backup log, find the root cause, and verify the source data is intact.

Covers: crontab, grep chaining, log analysis, du, rsync --dry-run

T13 Backup Strategies (+Quiz)

Use rsync and tar to create reliable backups. Learn incremental backup strategies, automate them with cron, and understand the difference between a backup you have and one you can actually restore.

rsync, tar, incremental backups, cron-automated

T14 Environment & Shell (+Quiz)

Customize your terminal with .bashrc and .profile. Set up PATH, create aliases for common commands, and configure environment variables that persist across sessions.

.bashrc, .profile, PATH, aliases, environment variables

T15 Systemd Deep Dive (+Quiz)

Understand how Linux manages services at boot and runtime. Work with units, targets, and dependencies. Start, stop, enable, and debug services with systemctl and journalctl.

units, services, targets, systemctl, journalctl

T16 Text Processing (+Quiz)

Slice, transform, and analyze structured text from the command line. Use cut for columns, awk for field extraction and pattern matching, and sed for find-and-replace across files.

cut, awk, sed, sort, uniq, field extraction

Lab Post-Upgrade Cleanup

A system upgrade broke three things overnight. Track down each issue and fix it before the morning deploy.

Covers: journalctl, sed -i, crontab, systemd unit files, config management

Exam Level 2 Master Exam

Prove you can administer a Linux server. 10 questions covering scheduling, logs, firewalls, backups, systemd, and text processing. Score 80% or higher to pass.

Covers: scheduling, logs, firewalls, backups, systemd, text processing

Cards Level 2 Flashcards

Drill every command and concept from Level 2. Cards pull from this level's quizzes and exam, and the ones you miss come back more often.

Your first security-focused level. Harden SSH, deploy fail2ban, lock down user privileges, audit file permissions, set up security auditing with auditd, detect network threats, analyze logs for security events, and manage secrets.

T17 SSH Hardening (+Quiz)

The first thing attackers scan for is SSH on port 22 with password auth. Lock it down. Switch to key-only authentication, disable root login, restrict who can connect, and make your server invisible to the most common automated attacks.

key-only auth, PermitRootLogin, MaxAuthTries, AllowUsers

T18 Fail2Ban (+Quiz)

Ban attackers automatically. Configure jails that watch your auth logs, detect brute-force attempts, and block offending IPs at the firewall. The difference between watching attacks happen and stopping them.

jail configuration, filter rules, ban actions, monitoring

T19 User & Sudo Security (+Quiz)

Control what users can actually do. Write sudo rules that grant just enough access for the job, use the wheel group correctly, and enforce least privilege across your entire team.

sudo rules, wheel group, sudoers.d, least privilege

T20 File Permissions Deep Dive (+Quiz)

Go beyond chmod 755. Learn what SUID and SGID really do, understand the sticky bit, set proper umask defaults, use ACLs for fine-grained control, and hunt down the dangerous permissions attackers look for.

SUID/SGID, sticky bit, umask, ACLs, find by permission

Lab Brute-Force Investigation

Fail2ban banned three IPs overnight, but the attack started before the bans kicked in. Find out if anyone got through and what they accessed.

Covers: fail2ban log analysis, auth.log investigation, audit log tracing, secrets scanning

T21 Security Auditing (+Quiz)

Turn on the black box recorder. Configure auditd to track file access, privilege changes, and suspicious syscalls, then use ausearch and aureport to pull the signal out of the noise when something happens.

auditd, auditctl rules, ausearch, aureport, audit.log

T22 Network Threat Detection (+Quiz)

Know what's talking to your server. Read netstat and ss output like a pro, spot port scans in progress, recognize beaconing patterns, and build the pattern-matching skills that separate analysts from alert-clickers.

netstat, ss, port scanning indicators, suspicious connections

T23 Log Security Analysis (+Quiz)

Your auth.log is telling you a story. Learn to read it. Spot brute force campaigns, detect privilege escalation attempts, track user sessions, and identify the exact moment a normal login became a compromise.

auth.log patterns, brute force detection, privilege escalation

T24 Secrets Management (+Quiz)

Stop putting API keys in your code. Understand the tradeoffs between env vars and config files, lock down permissions on secret files, and learn the basics of gpg for when you need real encryption at rest.

environment variables, file permissions, gpg basics

Lab Compliance Hardening

The quarterly security audit failed on SSH misconfigurations and world-writable files. Fix every finding before end of day.

Covers: sshd_config hardening, sed -i, find -perm, chmod, compliance remediation

Exam Level 3 Master Exam

Prove you can secure a Linux server. 10 questions covering SSH hardening, fail2ban, sudo, permissions, auditd, and log analysis. Score 80% or higher to pass.

Covers: SSH hardening, fail2ban, UFW, lynis, auditd, CIS benchmarks

Cards Level 3 Flashcards

Drill every command and concept from Level 3. Cards pull from this level's quizzes and exam, and the ones you miss come back more often.

Power tools for serious Linux work. vim for efficient editing on any server. Systemd unit authoring for custom services. iptables for real firewall control. lsof and strace for debugging. Netcat for network testing. Ansible for automation. Make for task running.

T25 vim (+Quiz)

The editor that's on every server. Learn modes, navigation, editing, search and replace, and how to configure .vimrc. Once you're comfortable in vim, you can edit anything, anywhere.

modes, navigation, editing, search/replace, buffers, .vimrc

T26 systemd Unit Authoring (+Quiz)

Write your own systemd service files from scratch. Define how services start, set dependencies, create timers, and manage custom applications as first-class system services.

service files, ExecStart, dependencies, timers

T27 iptables (+Quiz)

Real firewall control. Understand chains, tables, and rule ordering. Write ACCEPT, DROP, and REJECT rules. Configure NAT, log suspicious traffic, and persist rules across reboots.

chains, tables, rules, ACCEPT/DROP/REJECT, NAT, logging

T28 lsof (+Quiz)

See every file every process has open and every network socket in use. Essential for spotting unexpected connections, backdoor processes, and anything else that shouldn't be there.

open files, network connections, process file handles

Lab Crash Loop Debugging

The app is crash-looping because a dependency connection fails on startup. Trace the failure, identify which dependency moved, fix the config, and verify connectivity.

Covers: lsof, strace, netcat, vim, dependency debugging

T29 strace (+Quiz)

Trace every system call a process makes. Debug hangs, find permission issues, and when you need to, figure out exactly what a suspicious process is trying to do.

system call tracing, hanging processes, latency analysis

T30 netcat (+Quiz)

The Swiss army knife of networking. Test if ports are open, transfer files between machines, set up simple servers, and debug network connectivity issues in seconds.

port testing, file transfer, simple servers, debugging

T31 ansible (+Quiz)

Automate configuration across multiple servers. Write inventory files and playbooks, use modules and handlers, and understand idempotency so your automation is safe to run twice.

inventory, playbooks, modules, tasks, handlers, idempotency

T32 make (+Quiz)

Use Makefiles as task runners for your projects. Define targets, manage dependencies between tasks, set variables, and build repeatable workflows that anyone on the team can run.

Makefiles, targets, dependencies, variables, task automation

Lab Deployment Prep

Three issues need fixing before the v2.4 deploy goes live: missing firewall rule, missing restart policy, and untested build pipeline. Fix all three.

Covers: iptables rules, vim editing, systemd unit configuration, make dry-run

Exam Level 4 Master Exam

Prove you know the power tools. 10 questions covering vim, systemd, iptables, lsof, strace, netcat, Ansible, and Make. Score 80% or higher to pass.

Covers: tshark, tcpdump, Snort, Suricata, Zeek, packet analysis

Cards Level 4 Flashcards

Drill every command and concept from Level 4. Cards pull from this level's quizzes and exam, and the ones you miss come back more often.

Hands-on offensive and defensive tools. Network scanning with nmap. Packet analysis with tshark. Security auditing with lynis. Advanced auditd rule writing. Advanced iptables for security. Incident response playbook execution.

T33 nmap Discovery (+Quiz)

Map networks from the command line. Scan for live hosts, enumerate open ports, detect running services, and fingerprint operating systems. The reconnaissance foundation every security engineer needs.

host scanning, port scanning, service detection, OS fingerprinting

T34 nmap Advanced (+Quiz)

Go beyond basic scans. Run NSE scripts for vulnerability detection, tune timing to avoid detection, format output for parsing, and turn nmap into a full security assessment tool.

script scanning, vulnerability detection, output formats, timing

T35 tshark Basics (+Quiz)

Capture and analyze network traffic from the terminal. Read packet captures, apply display filters to find what matters, and understand the protocols flowing across your network.

capturing traffic, reading pcaps, display filters, protocols

T36 tshark Analysis (+Quiz)

Extract real signal from a pcap. Follow TCP streams, pull statistics and conversations, reconstruct transferred files, and build the investigation skills that turn raw traffic into answers.

conversations, statistics, following streams, extracting data

Lab Network Reconnaissance

A SOC alert flagged anomalous traffic during last night's scan. Examine the evidence — scan results and packet captures — to identify exposed services and determine if the anomaly is an active threat.

Covers: nmap result analysis, tshark display filters, tshark statistics, log correlation, reverse shell identification

T37 lynis (+Quiz)

Audit servers automatically. Run lynis to score your hardening posture against industry benchmarks, check compliance requirements, and generate prioritized remediation lists for every finding.

security auditing, hardening index, compliance, remediation

T38 Advanced auditd (+Quiz)

Go deeper into auditd. Write custom rules for file integrity monitoring, audit syscalls by key, track privileged operations, and search your audit log for exactly what you need.

custom rules, file integrity monitoring, syscall auditing

T39 Advanced iptables Security (+Quiz)

Move past basic rules. Implement stateful inspection, rate-limit aggressive IPs, configure port knocking for hidden services, and build dedicated logging chains for investigation.

stateful inspection, rate limiting, port knocking, logging chains

T40 Incident Response Playbook (+Quiz)

Execute the IR lifecycle when something goes wrong. Contain the threat, eradicate it from affected systems, recover services, and document everything so the postmortem actually helps.

IR lifecycle, containment, eradication, recovery, documentation

Lab Breach Confirmation

OSSEC flagged a suspicious file on web02. Confirm whether this is a real breach, trace the full attack chain, and identify the persistence mechanism.

Covers: brute-force analysis, auth log correlation, audit log tracing, kill chain identification, persistence detection

Exam Level 5 Master Exam

Prove you can run security operations. 10 questions covering nmap, tshark, lynis, advanced auditd, iptables, and incident response. Score 80% or higher to pass.

Covers: centralized logging, structured logs, IDS, CIS benchmarks, SIEM, threat hunting

Cards Level 5 Flashcards

Drill every command and concept from Level 5. Cards pull from this level's quizzes and exam, and the ones you miss come back more often.

Enterprise security operations. Centralized logging with rsyslog. Structured log formats for machine parsing. Intrusion detection with OSSEC/Wazuh. CIS benchmark compliance. Vulnerability assessment and CVSS scoring. Threat intelligence with STIX feeds. Detection engineering with Sigma rules. SOC analyst workflow.

T41 Centralized Logging with rsyslog (+Quiz)

Build a central log collection system. Configure rsyslog to forward logs from remote hosts, aggregate them in one place, and design the architecture enterprises use for real visibility.

rsyslog forwarding, remote collection, aggregation architecture

T42 Structured Logging & Log Formats (+Quiz)

Ship logs as JSON and CEF so machines can parse them. Use jq to query, filter, and reshape structured log data, and turn unreadable text streams into queryable datasets.

JSON log format, CEF format, jq for parsing

T43 Intrusion Detection with OSSEC/Wazuh (+Quiz)

Deploy a host-based IDS. Configure OSSEC or Wazuh agents, tune detection rules to reduce noise, set up active response actions, and manage a fleet of monitored endpoints.

OSSEC/Wazuh alerts, rule tuning, active response, agents

T44 CIS Benchmarks (+Quiz)

Score your servers against industry security baselines. Work through CIS Benchmark checks, measure compliance gaps, and prioritize which remediations matter most for your environment.

security baseline scoring, compliance, remediation

Lab SOC Alert Triage

Five OSSEC alerts in the overnight queue. Triage the highest-severity ones, check if the attacker gained access, and run the detection pipeline to catch anything the alerts missed.

Covers: OSSEC alert parsing, source IP extraction, auth log correlation, access log analysis, brute-force detection pipeline

T45 Vulnerability Assessment (+Quiz)

Run real vulnerability scans and interpret the results. Score findings with CVSS, prioritize by actual risk to your environment, and build patch management workflows that ship fixes.

scanning concepts, CVSS scoring, remediation, patch management

T46 Threat Intelligence (+Quiz)

Work with threat feeds. Consume STIX/TAXII data, parse indicators with jq, match IOCs against your logs, and turn external intelligence into local detections.

STIX/TAXII, IOC types, threat feed parsing, indicator matching

T47 Detection Engineering (+Quiz)

Write Sigma rules that catch real attacks. Define detection logic, tune out false positives, map coverage to attack techniques, and build a detection library your SOC can actually use.

Sigma rules, detection logic, false positive tuning, coverage

T48 SOC Analyst Workflow (+Quiz)

Work an alert queue like a real SOC analyst. Triage incoming events, investigate what matters, escalate what's serious, hand off cleanly at shift change, and document every step.

alert triage, investigation, escalation, shift handoff

Lab Threat Intelligence Hunt

A fresh threat intelligence feed landed with 6 IOCs. Hunt for these indicators across your logs, determine which ones are active in your environment, and build detection rules for the patterns you find.

Covers: jq STIX parsing, IOC correlation, log hunting, access log analysis, detection engineering

Exam Level 6 Master Exam

Prove you can operate in a SOC. 10 questions covering centralized logging, structured logs, IDS, CIS benchmarks, vulnerability management, threat intelligence, detection rules, and SOC workflow. Score 80% or higher to pass.

Covers: incident response, forensics, evidence handling, chain of custody, reporting

Cards Level 6 Flashcards

Drill every command and concept from Level 6. Cards pull from this level's quizzes and exam, and the ones you miss come back more often.

When incidents happen, you investigate. Chain of custody and evidence handling. Filesystem forensics. Log timeline reconstruction. Network forensics from packet captures. User activity tracking. Malware indicator analysis. Writing formal incident response reports.

T49 Forensic Fundamentals (+Quiz)

Handle evidence the right way. Establish chain of custody, work through the order of volatility, image systems before touching them, and hash everything so your findings hold up.

chain of custody, order of volatility, imaging, file hashing

T50 Filesystem Forensics (+Quiz)

Investigate a compromised filesystem. Read MAC times, find files modified during an attack window, check suspicious locations for persistence mechanisms, and pull the full bash history.

MAC times, find by time, persistence mechanisms, bash history

T51 Log Timeline Reconstruction (+Quiz)

Rebuild the full story of an incident. Merge logs from multiple hosts, normalize timestamps across timezones, correlate events across systems, and map the attack to a coherent kill chain.

merging logs, timestamp normalization, cross-host correlation

T52 Network Forensics (+Quiz)

Dig into captured traffic to find what happened. Analyze connections, investigate DNS lookups, identify command-and-control beaconing, and extract the evidence that shows where data went.

capture summaries, connection analysis, DNS forensics, C2 traffic

Lab Malware Indicator Analysis

A suspicious binary was quarantined from a production server. Verify it's malware by checking hashes against IOC feeds, identify its persistence mechanism, and trace its C2 communication channel.

Covers: file hash analysis, IOC matching, persistence detection, DNS C2 identification, jq threat feed parsing

T53 User Activity Investigation (+Quiz)

Track exactly what a user did. Follow SSH session trails, map privilege escalations, audit file access patterns, and reconstruct process execution history across the entire system.

SSH trails, privilege escalation tracking, file access trails

T54 Malware Indicator Analysis (+Quiz)

Check files and processes against known threats. Hash suspicious binaries, match against threat intelligence feeds, inspect running processes for malicious behavior, and extract IOCs others can use.

file hash checking, threat feed matching, IOC extraction

T55 Writing IR Reports (+Quiz)

Turn your investigation into a report leadership can read. Write executive summaries, lay out timelines, assess business impact, identify root cause, and recommend remediation that actually gets funded.

executive summary, timeline, impact, root cause, remediation

T56 Investigation Capstone (+Quiz)

Walk through a complete forensic workflow on a real incident. Gather evidence, reconstruct the timeline, identify the root cause, pull the IOCs, and deliver the final report.

full incident reconstruction, complete forensic workflow

Lab Incident Investigation

OSSEC flagged suspicious activity on web-server. Reconstruct the full attack: initial access, privilege escalation, malware deployment, lateral movement, and data exfiltration.

Covers: auth log forensics, timeline reconstruction, kill chain analysis, lateral movement detection, exfiltration assessment

Exam Level 7 Master Exam

Prove you can investigate incidents. 10 questions covering evidence handling, filesystem forensics, log reconstruction, network forensics, user activity, and IR reporting. Score 80% or higher to pass.

Covers: compliance frameworks, risk management, security architecture, policy, governance

Cards Level 7 Flashcards

Drill every command and concept from Level 7. Cards pull from this level's quizzes and exam, and the ones you miss come back more often.

The senior security level. Think about security at the organizational level, not just individual servers. Security frameworks (CIS, NIST, SOC2). Control mapping. SOC2 audit preparation. Risk assessment with STRIDE. Security policy writing. Network security architecture and zero trust. Audit preparation.

T57 Security Frameworks (+Quiz)

Understand the frameworks that shape enterprise security. Learn what CIS Controls, NIST CSF, SOC2, and ISO 27001 actually require, and how to pick the right one for your organization.

CIS Controls v8, NIST CSF, SOC2, ISO 27001

T58 Control Mapping (+Quiz)

Translate framework requirements into real Linux configurations. Map abstract controls to concrete SSH settings, iptables rules, and auditd configs. Turn compliance into engineering.

framework requirements to Linux configs, SSH, iptables, auditd

T59 SOC2 for Linux (+Quiz)

Implement the Linux controls SOC2 auditors actually check. Configure access controls for CC6, set up monitoring for CC7, document change management for CC8, and collect the evidence that passes audit.

CC6 access controls, CC7 monitoring, CC8 change management, evidence

T60 Risk Assessment (+Quiz)

Quantify risk so leadership can act on it. Score likelihood against impact, classify assets by criticality, threat model with STRIDE, and maintain a risk register that drives real decisions.

likelihood x impact, asset classification, STRIDE, risk registers

Lab Audit Remediation

The SOC2 auditor flagged three critical gaps. Map each finding to its technical fix, remediate, and regenerate the evidence package.

Covers: gap analysis, SOC2 control mapping, sed -i remediation, iptables segmentation, evidence collection

T61 Security Policy Writing (+Quiz)

Write policies people will actually follow. Draft access control, password, incident response, and backup policies using RFC 2119 language, and produce documents that hold up in audit.

access control, password, IR, backup policies, RFC 2119

T62 Network Security Architecture (+Quiz)

Design networks that assume breach. Apply defense in depth, segment traffic zones, design DMZs properly, implement zero trust principles, and translate architecture decisions into iptables rules.

defense in depth, segmentation, DMZ, zero trust, iptables

T63 Audit Preparation (+Quiz)

Get ready for a real audit. Run gap analysis against your target framework, organize evidence so auditors can find it, plan remediation for gaps, and build continuous compliance instead of last-minute scrambles.

gap analysis, evidence organization, remediation, continuous compliance

T64 Architecture Capstone (+Quiz)

Design a complete security architecture for an organization. Define segmentation, access controls, monitoring, logging, and incident response. End-to-end, on paper, defensible to leadership.

designing complete security architecture for an organization

Lab Pre-Audit Prioritization

The audit is in 48 hours. Build a prioritized remediation roadmap from the risk register and gap analysis, calculate the closure rate, and brief the CISO on the path forward.

Covers: risk scoring, gap analysis, remediation prioritization, audit readiness calculation, architecture comparison

Exam Level 8 Master Exam

Prove you can think like a security architect. 10 questions covering frameworks, control mapping, SOC2, risk assessment, policy writing, and network architecture. Score 80% or higher to pass.

Covers: offensive security, detection engineering, purple teaming, threat modeling, security operations

Cards Level 8 Flashcards

Drill every command and concept from Level 8. Cards pull from this level's quizzes and exam, and the ones you miss come back more often.

Python as a security automation tool. Scripting fundamentals, log parsing and analysis, network scanning automation, threat feed processing, forensic tooling, report generation, and building production-grade security tools.

T65 Python Basics (+Quiz)

Get comfortable in Python. Work with variables, data types, functions, conditionals, loops, and the core data structures (dicts and lists) that every security script depends on.

variables, data types, functions, conditionals, loops, dicts, lists

T66 Python for Files and Data (+Quiz)

Parse security logs at scale. Read auth.log with Python, extract fields with regex, detect suspicious patterns, and alert on anomalies before humans would notice.

auth.log, regex extraction, pattern detection, anomaly alerts

T67 Log Parsing with Python (+Quiz)

Build network tools in Python. Write port scanners with the socket module, automate nmap workflows, and turn one-off investigations into repeatable scripts.

socket programming, port scanning, nmap workflow automation

T68 Automating Security Tools (+Quiz)

Automate threat intelligence. Download STIX and CSV feeds on a schedule, match IOCs against your logs, and turn external feeds into automated indicator lookups.

STIX/CSV feeds, IOC matching, automated indicator lookups

Lab Automated Log Investigator

Three servers were targeted overnight. Scope the attack, identify brute-force IPs, correlate across servers, build an attacker timeline, and generate the automated report.

Covers: wc, grep pipelines, cross-server correlation, timeline construction, logwatch automation

T69 Threat Intelligence Automation (+Quiz)

Automate evidence collection. Hash files in bulk, generate timeline data from system artifacts, and build the scripts that make repeatable forensic investigations possible.

file hashing, timeline generation, evidence collection automation

T70 Security Report Automation (+Quiz)

Generate reports automatically. Build templated incident reports, output CSV and JSON for other tools, and schedule daily security briefings that land in your inbox before coffee.

templated IR reports, CSV/JSON output, daily briefings

T71 Building Security Tools (+Quiz)

Build CLI tools that feel professional. Use argparse for clean flags, handle errors gracefully, log what matters, and structure code into modules other engineers can import.

argparse CLI tools, error handling, logging, modular design

T72 Security Automation Capstone (+Quiz)

Build a production-grade security tool from scratch. Design the interface, write the logic, handle edge cases, document the usage, and produce something your team would actually deploy.

production security automation tool from scratch

Lab IOC Enrichment Pipeline

15 IOCs extracted from an incident. Build the enrichment pipeline: classify types, check against threat feeds and blacklists, prioritize by indicator stability, and enrich with geolocation.

Covers: IOC classification, threat feed matching, hash blacklist checking, enrichment, Python automation

Exam Level 9 Master Exam

Prove you can automate security work in Python. 10 questions covering Python fundamentals, log parsing, network scripting, threat feeds, forensic automation, and tool building. Score 80% or higher to pass.

Covers: Python scripting, log analysis, network automation, threat feeds, security tooling

Cards Level 9 Flashcards

Drill every command and concept from Level 9. Cards pull from this level's quizzes and exam, and the ones you miss come back more often.

Four capstone labs that combine everything you've learned across all levels.

Lab Red Team Assessment

Analyze scan results from an authorized penetration test. Identify the primary target based on vulnerability AND network position, map the attack path, and classify what's at stake.

Covers: attack surface analysis, network architecture, risk-based targeting, service enumeration, data classification

Lab SOC Alert Triage

Ten overnight alerts. Seven are false positives. Three are real — and two of them are connected. Triage the queue, make the judgment calls, and escalate the breach.

Covers: jq alert parsing, false positive filtering, C2 beacon identification, alert correlation, escalation writing

Lab Insider Threat Investigation

A departing employee may be stealing data. Compare her recent activity against her baseline, trace what data she accessed and where it went, and determine when the exfiltration began.

Covers: baseline comparison, file access analysis, email exfiltration detection, insider threat timeline, unauthorized access identification

Lab Breach Investigation — Case 2

A second breach — different vector, different attacker, different exfiltration method. SQL injection through the web app, webshell persistence, and DNS tunneling for data theft. Work the full forensic process.

Covers: SQL injection forensics, webapp log analysis, DNS tunneling detection, IOC cross-referencing, kill chain reconstruction

Cyber Security & Operations

Full Curriculum

Where these skills take you

Start building security skills