HackBlue

Paths

Pick a job, then follow the lessons.

Each path is a short list of lessons already on this site, and a lab at the end. The lab is the part you talk about in an interview. The lesson is how you knew what to look for. The number is how many steps are in the path.

SOC analyst

5 steps

Read an alert, decide if it is real, and write down what you would do next.

  1. 01Detection engineering lessons
  2. 02Windows security lessons
  3. 03Email security lessons
  4. 04Build one detection and name its false positive
  5. 05Read a header before you call it phishing

Network defense

5 steps

See the packet, name the host, and say what should not have been reachable.

  1. 01Wireshark lessons
  2. 02Nmap, from the side that was scanned
  3. 03Linux security lessons
  4. 04Follow one packet through the path
  5. 05Decide which rule should have stopped it

Cloud security

4 steps

Start from an identity and a log, not from a list of service names.

  1. 01Cloud security lessons
  2. 02GuardDuty and CloudTrail lessons
  3. 03Read a policy and say what it allows
  4. 04Ask one question of a log

Identity and Active Directory

4 steps

Follow a logon. Know which event proves the password was used, and which one does not.

  1. 01Active Directory lessons
  2. 02BloodHound, AD CS, and Entra sign-in logs
  3. 03Triage a push-bombing queue
  4. 04Read a token before you trust it

Incident response and forensics

5 steps

Keep the order of events. A finding without a time is a guess.

  1. 01Incident response playbooks
  2. 02Autopsy, Volatility, YARA, CyberChef, Sysmon
  3. 03KAPE, Plaso, Chainsaw, Hayabusa
  4. 04Put five events in order
  5. 05The first hour of a ransomware case

A first certification

3 steps

One exam, then lab time you can talk through. Not a stack of logos.

  1. 01Certification study lessons
  2. 02The course, in order, if the vocabulary is new
  3. 03A lab you can describe without the hint open