ProCourses All Courses Security Pro Data Pro DevOps Pro AI Pro CertPrep+ All Certs
CompTIA A+ Core 1 A+ Core 2 Network+ Security+ CySA+ About CompTIA
ISC2 CISSP About ISC2
Microsoft AZ-900 Azure Fundamentals AZ-104 Azure Administrator AI-901 Azure AI Fundamentals About Microsoft
AWS Cloud Practitioner Solutions Architect Associate AI Practitioner About AWS
Games Read Latest News Guides About Pricing Contact Enroll
Security Pro
Security Pro

Cyber Security & Operations

10 levels from your first terminal session to security architecture. Harden SSH, write firewall rules, analyze packets with tshark, investigate incidents with forensic tools, run a SOC workflow, map compliance frameworks, and automate it all in Python.

Get Security Pro Try Level 1 Free
72Lessons
22Labs
72Quizzes
9Exams

Full Curriculum

Click any level to see what you'll learn.

The foundation everything else builds on. You'll learn to navigate a Linux system, create and manage files, control who can access what, and chain commands together to automate tasks. By the end, you'll be able to set up users, connect to servers over SSH, install software, and run your first Docker container.

T01 Files & Navigation (+Quiz)
Learn to move around a Linux filesystem, create and organize directories, copy, move, and remove files, and search for anything on the system.
ls, cd, pwd, mkdir, rm, cp, mv, find
T02 Viewing, Editing & Permissions (+Quiz)
Read files from the terminal, edit them with nano, and control exactly who can read, write, or execute every file on the system.
cat, head, tail, less, nano, chmod, chown
T03 Pipes & Redirection (+Quiz)
Chain commands together to filter, sort, count, and search through data. Redirect output to files, combine streams, and build one-liners that do real work.
|, >, >>, 2>&1, tee, sort, uniq, wc, grep
T04 Processes & System (+Quiz)
See what's running on your system, monitor resource usage in real time, stop runaway processes, and manage background jobs.
ps, top, kill, bg, fg, jobs
Lab Disk Space Incident
A disk space alert fired overnight. Investigate the cause, find what's eating the space, and preserve the evidence.
Covers: df, ls -lh, tail, grep -c, output redirection
T05 Users & SSH (+Quiz)
Create and manage user accounts, configure sudo access, generate SSH keys, and connect to remote servers securely.
useradd, passwd, sudo, ssh, ssh-keygen, authorized_keys
T06 Networking (+Quiz)
Check your network interfaces, test connectivity, make HTTP requests from the terminal, understand how DNS resolves names, and identify what's listening on which ports.
ip, ss, ping, curl, DNS resolution, ports
T07 Package Management (+Quiz)
Install, update, and remove software. Manage repositories, resolve dependency issues, and keep your system current.
apt, dpkg, repositories, dependencies
T08 Docker Basics (+Quiz)
Pull images, run containers, map ports, and manage the container lifecycle. Your first step into the tool that changed how software gets deployed.
images, containers, run, ps, stop, rm, port mapping
Lab Shift Handoff
Your colleague left two issues to check before their shift ended. Read the handoff, investigate both, and close them out.
Covers: cat, ls, find, wc, free
Exam Level 1 Master Exam
Prove you've mastered the fundamentals. 10 questions covering everything from Level 1. Score 80% or higher to pass.
Covers: files, permissions, pipes, processes, users, SSH, networking, packages, docker
Cards Level 1 Flashcards
Drill every command and concept from Level 1. Cards pull from this level's quizzes and exam, and the ones you miss come back more often.

Running a Linux server means keeping it healthy, secure, and automated. Job scheduling, log management, firewalls, disk management, backups, shell environments, systemd services, and text processing with awk and sed.

T09 Cron & Scheduling (+Quiz)
Automate recurring tasks with cron. Write crontab entries, schedule scripts to run at specific times, and build the habits that keep servers running without you watching.
crontab, cron.d, at, 5-field syntax, scheduling
T10 Log Management (+Quiz)
Read and analyze system logs with journalctl and syslog. Set up log rotation so your disks don't fill up, and learn to spot patterns that tell you something is wrong before it breaks.
journalctl, syslog, logrotate, /var/log, log analysis
T11 Firewall (+Quiz)
Control what traffic gets in and out of your server. Set up allow and deny rules, configure default policies, and understand the basics of network security at the OS level.
ufw, allow, deny, status, default policies
T12 Disk Management (+Quiz)
Monitor disk usage, understand mount points, work with block devices, and get an introduction to LVM for flexible storage management.
df, du, lsblk, mount, fdisk, LVM basics
Lab Failed Backup Investigation
The nightly backup didn't complete. Trace the failure from cron to the backup log, find the root cause, and verify the source data is intact.
Covers: crontab, grep chaining, log analysis, du, rsync --dry-run
T13 Backup Strategies (+Quiz)
Use rsync and tar to create reliable backups. Learn incremental backup strategies, automate them with cron, and understand the difference between a backup you have and one you can actually restore.
rsync, tar, incremental backups, cron-automated
T14 Environment & Shell (+Quiz)
Customize your terminal with .bashrc and .profile. Set up PATH, create aliases for common commands, and configure environment variables that persist across sessions.
.bashrc, .profile, PATH, aliases, environment variables
T15 Systemd Deep Dive (+Quiz)
Understand how Linux manages services at boot and runtime. Work with units, targets, and dependencies. Start, stop, enable, and debug services with systemctl and journalctl.
units, services, targets, systemctl, journalctl
T16 Text Processing (+Quiz)
Slice, transform, and analyze structured text from the command line. Use cut for columns, awk for field extraction and pattern matching, and sed for find-and-replace across files.
cut, awk, sed, sort, uniq, field extraction
Lab Post-Upgrade Cleanup
A system upgrade broke three things overnight. Track down each issue and fix it before the morning deploy.
Covers: journalctl, sed -i, crontab, systemd unit files, config management
Exam Level 2 Master Exam
Prove you can administer a Linux server. 10 questions covering scheduling, logs, firewalls, backups, systemd, and text processing. Score 80% or higher to pass.
Covers: scheduling, logs, firewalls, backups, systemd, text processing
Cards Level 2 Flashcards
Drill every command and concept from Level 2. Cards pull from this level's quizzes and exam, and the ones you miss come back more often.

Your first security-focused level. Harden SSH, deploy fail2ban, lock down user privileges, audit file permissions, set up security auditing with auditd, detect network threats, analyze logs for security events, and manage secrets.

T17 SSH Hardening (+Quiz)
The first thing attackers scan for is SSH on port 22 with password auth. Lock it down. Switch to key-only authentication, disable root login, restrict who can connect, and make your server invisible to the most common automated attacks.
key-only auth, PermitRootLogin, MaxAuthTries, AllowUsers
T18 Fail2Ban (+Quiz)
Ban attackers automatically. Configure jails that watch your auth logs, detect brute-force attempts, and block offending IPs at the firewall. The difference between watching attacks happen and stopping them.
jail configuration, filter rules, ban actions, monitoring
T19 User & Sudo Security (+Quiz)
Control what users can actually do. Write sudo rules that grant just enough access for the job, use the wheel group correctly, and enforce least privilege across your entire team.
sudo rules, wheel group, sudoers.d, least privilege
T20 File Permissions Deep Dive (+Quiz)
Go beyond chmod 755. Learn what SUID and SGID really do, understand the sticky bit, set proper umask defaults, use ACLs for fine-grained control, and hunt down the dangerous permissions attackers look for.
SUID/SGID, sticky bit, umask, ACLs, find by permission
Lab Brute-Force Investigation
Fail2ban banned three IPs overnight, but the attack started before the bans kicked in. Find out if anyone got through and what they accessed.
Covers: fail2ban log analysis, auth.log investigation, audit log tracing, secrets scanning
T21 Security Auditing (+Quiz)
Turn on the black box recorder. Configure auditd to track file access, privilege changes, and suspicious syscalls, then use ausearch and aureport to pull the signal out of the noise when something happens.
auditd, auditctl rules, ausearch, aureport, audit.log
T22 Network Threat Detection (+Quiz)
Know what's talking to your server. Read netstat and ss output like a pro, spot port scans in progress, recognize beaconing patterns, and build the pattern-matching skills that separate analysts from alert-clickers.
netstat, ss, port scanning indicators, suspicious connections
T23 Log Security Analysis (+Quiz)
Your auth.log is telling you a story. Learn to read it. Spot brute force campaigns, detect privilege escalation attempts, track user sessions, and identify the exact moment a normal login became a compromise.
auth.log patterns, brute force detection, privilege escalation
T24 Secrets Management (+Quiz)
Stop putting API keys in your code. Understand the tradeoffs between env vars and config files, lock down permissions on secret files, and learn the basics of gpg for when you need real encryption at rest.
environment variables, file permissions, gpg basics
Lab Compliance Hardening
The quarterly security audit failed on SSH misconfigurations and world-writable files. Fix every finding before end of day.
Covers: sshd_config hardening, sed -i, find -perm, chmod, compliance remediation
Exam Level 3 Master Exam
Prove you can secure a Linux server. 10 questions covering SSH hardening, fail2ban, sudo, permissions, auditd, and log analysis. Score 80% or higher to pass.
Covers: SSH hardening, fail2ban, UFW, lynis, auditd, CIS benchmarks
Cards Level 3 Flashcards
Drill every command and concept from Level 3. Cards pull from this level's quizzes and exam, and the ones you miss come back more often.

Power tools for serious Linux work. vim for efficient editing on any server. Systemd unit authoring for custom services. iptables for real firewall control. lsof and strace for debugging. Netcat for network testing. Ansible for automation. Make for task running.

T25 vim (+Quiz)
The editor that's on every server. Learn modes, navigation, editing, search and replace, and how to configure .vimrc. Once you're comfortable in vim, you can edit anything, anywhere.
modes, navigation, editing, search/replace, buffers, .vimrc
T26 systemd Unit Authoring (+Quiz)
Write your own systemd service files from scratch. Define how services start, set dependencies, create timers, and manage custom applications as first-class system services.
service files, ExecStart, dependencies, timers
T27 iptables (+Quiz)
Real firewall control. Understand chains, tables, and rule ordering. Write ACCEPT, DROP, and REJECT rules. Configure NAT, log suspicious traffic, and persist rules across reboots.
chains, tables, rules, ACCEPT/DROP/REJECT, NAT, logging
T28 lsof (+Quiz)
See every file every process has open and every network socket in use. Essential for spotting unexpected connections, backdoor processes, and anything else that shouldn't be there.
open files, network connections, process file handles
Lab Crash Loop Debugging
The app is crash-looping because a dependency connection fails on startup. Trace the failure, identify which dependency moved, fix the config, and verify connectivity.
Covers: lsof, strace, netcat, vim, dependency debugging
T29 strace (+Quiz)
Trace every system call a process makes. Debug hangs, find permission issues, and when you need to, figure out exactly what a suspicious process is trying to do.
system call tracing, hanging processes, latency analysis
T30 netcat (+Quiz)
The Swiss army knife of networking. Test if ports are open, transfer files between machines, set up simple servers, and debug network connectivity issues in seconds.
port testing, file transfer, simple servers, debugging
T31 ansible (+Quiz)
Automate configuration across multiple servers. Write inventory files and playbooks, use modules and handlers, and understand idempotency so your automation is safe to run twice.
inventory, playbooks, modules, tasks, handlers, idempotency
T32 make (+Quiz)
Use Makefiles as task runners for your projects. Define targets, manage dependencies between tasks, set variables, and build repeatable workflows that anyone on the team can run.
Makefiles, targets, dependencies, variables, task automation
Lab Deployment Prep
Three issues need fixing before the v2.4 deploy goes live: missing firewall rule, missing restart policy, and untested build pipeline. Fix all three.
Covers: iptables rules, vim editing, systemd unit configuration, make dry-run
Exam Level 4 Master Exam
Prove you know the power tools. 10 questions covering vim, systemd, iptables, lsof, strace, netcat, Ansible, and Make. Score 80% or higher to pass.
Covers: tshark, tcpdump, Snort, Suricata, Zeek, packet analysis
Cards Level 4 Flashcards
Drill every command and concept from Level 4. Cards pull from this level's quizzes and exam, and the ones you miss come back more often.

Hands-on offensive and defensive tools. Network scanning with nmap. Packet analysis with tshark. Security auditing with lynis. Advanced auditd rule writing. Advanced iptables for security. Incident response playbook execution.

T33 nmap Discovery (+Quiz)
Map networks from the command line. Scan for live hosts, enumerate open ports, detect running services, and fingerprint operating systems. The reconnaissance foundation every security engineer needs.
host scanning, port scanning, service detection, OS fingerprinting
T34 nmap Advanced (+Quiz)
Go beyond basic scans. Run NSE scripts for vulnerability detection, tune timing to avoid detection, format output for parsing, and turn nmap into a full security assessment tool.
script scanning, vulnerability detection, output formats, timing
T35 tshark Basics (+Quiz)
Capture and analyze network traffic from the terminal. Read packet captures, apply display filters to find what matters, and understand the protocols flowing across your network.
capturing traffic, reading pcaps, display filters, protocols
T36 tshark Analysis (+Quiz)
Extract real signal from a pcap. Follow TCP streams, pull statistics and conversations, reconstruct transferred files, and build the investigation skills that turn raw traffic into answers.
conversations, statistics, following streams, extracting data
Lab Network Reconnaissance
A SOC alert flagged anomalous traffic during last night's scan. Examine the evidence — scan results and packet captures — to identify exposed services and determine if the anomaly is an active threat.
Covers: nmap result analysis, tshark display filters, tshark statistics, log correlation, reverse shell identification
T37 lynis (+Quiz)
Audit servers automatically. Run lynis to score your hardening posture against industry benchmarks, check compliance requirements, and generate prioritized remediation lists for every finding.
security auditing, hardening index, compliance, remediation
T38 Advanced auditd (+Quiz)
Go deeper into auditd. Write custom rules for file integrity monitoring, audit syscalls by key, track privileged operations, and search your audit log for exactly what you need.
custom rules, file integrity monitoring, syscall auditing
T39 Advanced iptables Security (+Quiz)
Move past basic rules. Implement stateful inspection, rate-limit aggressive IPs, configure port knocking for hidden services, and build dedicated logging chains for investigation.
stateful inspection, rate limiting, port knocking, logging chains
T40 Incident Response Playbook (+Quiz)
Execute the IR lifecycle when something goes wrong. Contain the threat, eradicate it from affected systems, recover services, and document everything so the postmortem actually helps.
IR lifecycle, containment, eradication, recovery, documentation
Lab Breach Confirmation
OSSEC flagged a suspicious file on web02. Confirm whether this is a real breach, trace the full attack chain, and identify the persistence mechanism.
Covers: brute-force analysis, auth log correlation, audit log tracing, kill chain identification, persistence detection
Exam Level 5 Master Exam
Prove you can run security operations. 10 questions covering nmap, tshark, lynis, advanced auditd, iptables, and incident response. Score 80% or higher to pass.
Covers: centralized logging, structured logs, IDS, CIS benchmarks, SIEM, threat hunting
Cards Level 5 Flashcards
Drill every command and concept from Level 5. Cards pull from this level's quizzes and exam, and the ones you miss come back more often.

Enterprise security operations. Centralized logging with rsyslog. Structured log formats for machine parsing. Intrusion detection with OSSEC/Wazuh. CIS benchmark compliance. Vulnerability assessment and CVSS scoring. Threat intelligence with STIX feeds. Detection engineering with Sigma rules. SOC analyst workflow.

T41 Centralized Logging with rsyslog (+Quiz)
Build a central log collection system. Configure rsyslog to forward logs from remote hosts, aggregate them in one place, and design the architecture enterprises use for real visibility.
rsyslog forwarding, remote collection, aggregation architecture
T42 Structured Logging & Log Formats (+Quiz)
Ship logs as JSON and CEF so machines can parse them. Use jq to query, filter, and reshape structured log data, and turn unreadable text streams into queryable datasets.
JSON log format, CEF format, jq for parsing
T43 Intrusion Detection with OSSEC/Wazuh (+Quiz)
Deploy a host-based IDS. Configure OSSEC or Wazuh agents, tune detection rules to reduce noise, set up active response actions, and manage a fleet of monitored endpoints.
OSSEC/Wazuh alerts, rule tuning, active response, agents
T44 CIS Benchmarks (+Quiz)
Score your servers against industry security baselines. Work through CIS Benchmark checks, measure compliance gaps, and prioritize which remediations matter most for your environment.
security baseline scoring, compliance, remediation
Lab SOC Alert Triage
Five OSSEC alerts in the overnight queue. Triage the highest-severity ones, check if the attacker gained access, and run the detection pipeline to catch anything the alerts missed.
Covers: OSSEC alert parsing, source IP extraction, auth log correlation, access log analysis, brute-force detection pipeline
T45 Vulnerability Assessment (+Quiz)
Run real vulnerability scans and interpret the results. Score findings with CVSS, prioritize by actual risk to your environment, and build patch management workflows that ship fixes.
scanning concepts, CVSS scoring, remediation, patch management
T46 Threat Intelligence (+Quiz)
Work with threat feeds. Consume STIX/TAXII data, parse indicators with jq, match IOCs against your logs, and turn external intelligence into local detections.
STIX/TAXII, IOC types, threat feed parsing, indicator matching
T47 Detection Engineering (+Quiz)
Write Sigma rules that catch real attacks. Define detection logic, tune out false positives, map coverage to attack techniques, and build a detection library your SOC can actually use.
Sigma rules, detection logic, false positive tuning, coverage
T48 SOC Analyst Workflow (+Quiz)
Work an alert queue like a real SOC analyst. Triage incoming events, investigate what matters, escalate what's serious, hand off cleanly at shift change, and document every step.
alert triage, investigation, escalation, shift handoff
Lab Threat Intelligence Hunt
A fresh threat intelligence feed landed with 6 IOCs. Hunt for these indicators across your logs, determine which ones are active in your environment, and build detection rules for the patterns you find.
Covers: jq STIX parsing, IOC correlation, log hunting, access log analysis, detection engineering
Exam Level 6 Master Exam
Prove you can operate in a SOC. 10 questions covering centralized logging, structured logs, IDS, CIS benchmarks, vulnerability management, threat intelligence, detection rules, and SOC workflow. Score 80% or higher to pass.
Covers: incident response, forensics, evidence handling, chain of custody, reporting
Cards Level 6 Flashcards
Drill every command and concept from Level 6. Cards pull from this level's quizzes and exam, and the ones you miss come back more often.

When incidents happen, you investigate. Chain of custody and evidence handling. Filesystem forensics. Log timeline reconstruction. Network forensics from packet captures. User activity tracking. Malware indicator analysis. Writing formal incident response reports.

T49 Forensic Fundamentals (+Quiz)
Handle evidence the right way. Establish chain of custody, work through the order of volatility, image systems before touching them, and hash everything so your findings hold up.
chain of custody, order of volatility, imaging, file hashing
T50 Filesystem Forensics (+Quiz)
Investigate a compromised filesystem. Read MAC times, find files modified during an attack window, check suspicious locations for persistence mechanisms, and pull the full bash history.
MAC times, find by time, persistence mechanisms, bash history
T51 Log Timeline Reconstruction (+Quiz)
Rebuild the full story of an incident. Merge logs from multiple hosts, normalize timestamps across timezones, correlate events across systems, and map the attack to a coherent kill chain.
merging logs, timestamp normalization, cross-host correlation
T52 Network Forensics (+Quiz)
Dig into captured traffic to find what happened. Analyze connections, investigate DNS lookups, identify command-and-control beaconing, and extract the evidence that shows where data went.
capture summaries, connection analysis, DNS forensics, C2 traffic
Lab Malware Indicator Analysis
A suspicious binary was quarantined from a production server. Verify it's malware by checking hashes against IOC feeds, identify its persistence mechanism, and trace its C2 communication channel.
Covers: file hash analysis, IOC matching, persistence detection, DNS C2 identification, jq threat feed parsing
T53 User Activity Investigation (+Quiz)
Track exactly what a user did. Follow SSH session trails, map privilege escalations, audit file access patterns, and reconstruct process execution history across the entire system.
SSH trails, privilege escalation tracking, file access trails
T54 Malware Indicator Analysis (+Quiz)
Check files and processes against known threats. Hash suspicious binaries, match against threat intelligence feeds, inspect running processes for malicious behavior, and extract IOCs others can use.
file hash checking, threat feed matching, IOC extraction
T55 Writing IR Reports (+Quiz)
Turn your investigation into a report leadership can read. Write executive summaries, lay out timelines, assess business impact, identify root cause, and recommend remediation that actually gets funded.
executive summary, timeline, impact, root cause, remediation
T56 Investigation Capstone (+Quiz)
Walk through a complete forensic workflow on a real incident. Gather evidence, reconstruct the timeline, identify the root cause, pull the IOCs, and deliver the final report.
full incident reconstruction, complete forensic workflow
Lab Incident Investigation
OSSEC flagged suspicious activity on web-server. Reconstruct the full attack: initial access, privilege escalation, malware deployment, lateral movement, and data exfiltration.
Covers: auth log forensics, timeline reconstruction, kill chain analysis, lateral movement detection, exfiltration assessment
Exam Level 7 Master Exam
Prove you can investigate incidents. 10 questions covering evidence handling, filesystem forensics, log reconstruction, network forensics, user activity, and IR reporting. Score 80% or higher to pass.
Covers: compliance frameworks, risk management, security architecture, policy, governance
Cards Level 7 Flashcards
Drill every command and concept from Level 7. Cards pull from this level's quizzes and exam, and the ones you miss come back more often.

The senior security level. Think about security at the organizational level, not just individual servers. Security frameworks (CIS, NIST, SOC2). Control mapping. SOC2 audit preparation. Risk assessment with STRIDE. Security policy writing. Network security architecture and zero trust. Audit preparation.

T57 Security Frameworks (+Quiz)
Understand the frameworks that shape enterprise security. Learn what CIS Controls, NIST CSF, SOC2, and ISO 27001 actually require, and how to pick the right one for your organization.
CIS Controls v8, NIST CSF, SOC2, ISO 27001
T58 Control Mapping (+Quiz)
Translate framework requirements into real Linux configurations. Map abstract controls to concrete SSH settings, iptables rules, and auditd configs. Turn compliance into engineering.
framework requirements to Linux configs, SSH, iptables, auditd
T59 SOC2 for Linux (+Quiz)
Implement the Linux controls SOC2 auditors actually check. Configure access controls for CC6, set up monitoring for CC7, document change management for CC8, and collect the evidence that passes audit.
CC6 access controls, CC7 monitoring, CC8 change management, evidence
T60 Risk Assessment (+Quiz)
Quantify risk so leadership can act on it. Score likelihood against impact, classify assets by criticality, threat model with STRIDE, and maintain a risk register that drives real decisions.
likelihood x impact, asset classification, STRIDE, risk registers
Lab Audit Remediation
The SOC2 auditor flagged three critical gaps. Map each finding to its technical fix, remediate, and regenerate the evidence package.
Covers: gap analysis, SOC2 control mapping, sed -i remediation, iptables segmentation, evidence collection
T61 Security Policy Writing (+Quiz)
Write policies people will actually follow. Draft access control, password, incident response, and backup policies using RFC 2119 language, and produce documents that hold up in audit.
access control, password, IR, backup policies, RFC 2119
T62 Network Security Architecture (+Quiz)
Design networks that assume breach. Apply defense in depth, segment traffic zones, design DMZs properly, implement zero trust principles, and translate architecture decisions into iptables rules.
defense in depth, segmentation, DMZ, zero trust, iptables
T63 Audit Preparation (+Quiz)
Get ready for a real audit. Run gap analysis against your target framework, organize evidence so auditors can find it, plan remediation for gaps, and build continuous compliance instead of last-minute scrambles.
gap analysis, evidence organization, remediation, continuous compliance
T64 Architecture Capstone (+Quiz)
Design a complete security architecture for an organization. Define segmentation, access controls, monitoring, logging, and incident response. End-to-end, on paper, defensible to leadership.
designing complete security architecture for an organization
Lab Pre-Audit Prioritization
The audit is in 48 hours. Build a prioritized remediation roadmap from the risk register and gap analysis, calculate the closure rate, and brief the CISO on the path forward.
Covers: risk scoring, gap analysis, remediation prioritization, audit readiness calculation, architecture comparison
Exam Level 8 Master Exam
Prove you can think like a security architect. 10 questions covering frameworks, control mapping, SOC2, risk assessment, policy writing, and network architecture. Score 80% or higher to pass.
Covers: offensive security, detection engineering, purple teaming, threat modeling, security operations
Cards Level 8 Flashcards
Drill every command and concept from Level 8. Cards pull from this level's quizzes and exam, and the ones you miss come back more often.

Python as a security automation tool. Scripting fundamentals, log parsing and analysis, network scanning automation, threat feed processing, forensic tooling, report generation, and building production-grade security tools.

T65 Python Basics (+Quiz)
Get comfortable in Python. Work with variables, data types, functions, conditionals, loops, and the core data structures (dicts and lists) that every security script depends on.
variables, data types, functions, conditionals, loops, dicts, lists
T66 Python for Files and Data (+Quiz)
Parse security logs at scale. Read auth.log with Python, extract fields with regex, detect suspicious patterns, and alert on anomalies before humans would notice.
auth.log, regex extraction, pattern detection, anomaly alerts
T67 Log Parsing with Python (+Quiz)
Build network tools in Python. Write port scanners with the socket module, automate nmap workflows, and turn one-off investigations into repeatable scripts.
socket programming, port scanning, nmap workflow automation
T68 Automating Security Tools (+Quiz)
Automate threat intelligence. Download STIX and CSV feeds on a schedule, match IOCs against your logs, and turn external feeds into automated indicator lookups.
STIX/CSV feeds, IOC matching, automated indicator lookups
Lab Automated Log Investigator
Three servers were targeted overnight. Scope the attack, identify brute-force IPs, correlate across servers, build an attacker timeline, and generate the automated report.
Covers: wc, grep pipelines, cross-server correlation, timeline construction, logwatch automation
T69 Threat Intelligence Automation (+Quiz)
Automate evidence collection. Hash files in bulk, generate timeline data from system artifacts, and build the scripts that make repeatable forensic investigations possible.
file hashing, timeline generation, evidence collection automation
T70 Security Report Automation (+Quiz)
Generate reports automatically. Build templated incident reports, output CSV and JSON for other tools, and schedule daily security briefings that land in your inbox before coffee.
templated IR reports, CSV/JSON output, daily briefings
T71 Building Security Tools (+Quiz)
Build CLI tools that feel professional. Use argparse for clean flags, handle errors gracefully, log what matters, and structure code into modules other engineers can import.
argparse CLI tools, error handling, logging, modular design
T72 Security Automation Capstone (+Quiz)
Build a production-grade security tool from scratch. Design the interface, write the logic, handle edge cases, document the usage, and produce something your team would actually deploy.
production security automation tool from scratch
Lab IOC Enrichment Pipeline
15 IOCs extracted from an incident. Build the enrichment pipeline: classify types, check against threat feeds and blacklists, prioritize by indicator stability, and enrich with geolocation.
Covers: IOC classification, threat feed matching, hash blacklist checking, enrichment, Python automation
Exam Level 9 Master Exam
Prove you can automate security work in Python. 10 questions covering Python fundamentals, log parsing, network scripting, threat feeds, forensic automation, and tool building. Score 80% or higher to pass.
Covers: Python scripting, log analysis, network automation, threat feeds, security tooling
Cards Level 9 Flashcards
Drill every command and concept from Level 9. Cards pull from this level's quizzes and exam, and the ones you miss come back more often.

Four capstone labs that combine everything you've learned across all levels.

Lab Red Team Assessment
Analyze scan results from an authorized penetration test. Identify the primary target based on vulnerability AND network position, map the attack path, and classify what's at stake.
Covers: attack surface analysis, network architecture, risk-based targeting, service enumeration, data classification
Lab SOC Alert Triage
Ten overnight alerts. Seven are false positives. Three are real — and two of them are connected. Triage the queue, make the judgment calls, and escalate the breach.
Covers: jq alert parsing, false positive filtering, C2 beacon identification, alert correlation, escalation writing
Lab Insider Threat Investigation
A departing employee may be stealing data. Compare her recent activity against her baseline, trace what data she accessed and where it went, and determine when the exfiltration began.
Covers: baseline comparison, file access analysis, email exfiltration detection, insider threat timeline, unauthorized access identification
Lab Breach Investigation — Case 2
A second breach — different vector, different attacker, different exfiltration method. SQL injection through the web app, webshell persistence, and DNS tunneling for data theft. Work the full forensic process.
Covers: SQL injection forensics, webapp log analysis, DNS tunneling detection, IOC cross-referencing, kill chain reconstruction

Where these skills take you

Real job titles that use the tools taught in this course.

Entry-level
$55K – $75K
  • Junior Security Analyst
  • SOC Analyst (Tier 1)
  • IT Security Specialist
  • Compliance Analyst
  • Junior Systems Administrator
  • Security Operations Technician
2 Years Experience
$100K – $140K
  • Security Engineer
  • SOC Analyst (Tier 2/3)
  • Incident Response Analyst
  • Security Automation Engineer
  • Cloud Security Engineer
  • Compliance Engineer
4+ Years Experience
$150K – $210K+
  • Senior Security Engineer
  • Security Architect
  • Detection Engineering Lead
  • Principal Security Engineer
  • Security Operations Manager
  • CISO (smaller orgs)

Ranges based on BLS Occupational Employment & Wage Statistics (May 2024) for Information Security Analysts, adjusted by metro. Remote and cost-of-living affect real pay. The first role in each column is the most common entry point from this course.

Questions

Before you start

It's very learnable if you build it in order. Most of the struggle comes from skipping the basics, so this course starts with Linux and server administration before security tools like nmap, tshark and auditd. Each lesson teaches one thing, then has you do it.
Yes. This course assumes no experience: Level 1 is Linux Fundamentals, and each level builds on the one before. Many entry-level job posts also ask for a cert such as Security+.
It helps a lot. Much of security work happens on Linux servers and with Linux tools, which is why Levels 1 and 2 cover Linux and server administration before the security levels start.
Roles like SOC Analyst (Tier 1), Junior Security Analyst, IT Security Specialist and Junior Systems Administrator. The "Where these skills take you" section above shows where they lead next.
Security+, CySA+ and the CISSP. The course teaches the hands-on side; pair it with CertPrep+ for exam-style questions.
Yes. Level 1 of every ProCourse is free. Create a free account to save your progress. The rest of the course opens with a subscription, or buy Security Pro once and keep it forever.
Yes. Lessons, labs and quizzes all run in your browser and are built for phones first, so you can study anywhere. A laptop or Chromebook works too.
No. It's a simulated terminal that runs in your browser and responds the way Linux does. There's nothing to install, no virtual machine to set up and nothing you can break, so you can experiment freely.

Start building security skills

Subscribe monthly or buy a course forever.

Get Security Pro