Guide
The short pages that tell you where to go. Lessons and labs stay in the course and the practice list. This page is only the map.
Start
13 pages
- 01StartFour doors: you are new, you have a job in mind, you want a tool, or you want a lab now.
- 02First weekSeven days. Each day is one lesson or one lab that is already on the site.
- 03A small labA hypervisor, one Linux guest, and Wireshark. A second machine and extra tools can wait.
- 04Before you scanWhose network, the written scope, the time window, and where the scanner output will be stored.
- 05After a scanHow to read a port list: open versus filtered, which hosts to write down, and what you hand over.
- 06TopicsSix questions. Each one names the hubs and labs to open for that question.
- 07Career pathsSix job paths. Each path is a short list of lessons and ends in a lab.
- 08First SOC dayThe first day on a junior SOC seat: the queue, one alert you finish, and the note you hand on.
- 09First network dayThe first day watching a network: one capture or one flow, then who started it and who answered.
- 10First DFIR dayThe first day with an image already in the case folder: the copy, the hash, the timeline, and one sentence.
- 11First cloud dayThe first day in a cloud account you may read: whose account, the audit log, and one role you can explain.
- 12First identity dayThe first day reading logons: one success, one failure, MFA, and a password versus a token.
- 13First cert dayOne exam, then one objective and one lab you can explain. A second logo can wait.
A piece of work
5 pages
- 01Before you scanWhose network, the written scope, the time window, and where the scanner output will be stored.
- 02After a scanHow to read a port list: open versus filtered, which hosts to write down, and what you hand over.
- 03The case folderKeep the original file, a working copy, the hash, and the time. Keep notes out of that folder.
- 04How to write a findingHow to write the lab note: what failed, who can reach it, and what you would change.
- 05The handoffWhat the next person needs: what failed, where the file is, the time, and what you already changed.
Situations
7 pages
- 01A strange loginAn account signed in from somewhere new. Read the event before you reset a password.
- 02An odd emailA message that looks internal. Read the header before you call it phishing.
- 03A host that keeps talkingA machine makes regular outbound connections. Record the pattern before you name it.
- 04Ransomware first hourA ransom note is on a screen. Record what you see and who you call before anyone clears the machine.
- 05A file from emailA spreadsheet or invoice arrived with a request to open it. Check the sender and the file first.
- 06A cloud key in the openA cloud access key showed up in a log, a ticket, or a repo. Revoke it, then read what it already did.
- 07One SIEM alertOne alert, before you escalate. Read the title, the subject, the time, the rule, and the false positive.
Reference
5 pages
- 01CheatsheetsFour short sheets: display filters, Windows event IDs, email checks, and the first hour of an incident.
- 02Compare toolsWhen to open Wireshark, the packet logs, Burp, browser tools, Autopsy, or Volatility.
- 03How to write a findingHow to write the lab note: what failed, who can reach it, and what you would change.
- 04The case folderKeep the original file, a working copy, the hash, and the time. Keep notes out of that folder.
- 05The handoffWhat the next person needs: what failed, where the file is, the time, and what you already changed.