Academy
Beginner track

Defensive Foundations

Triage, hunt, detect, and respond with evidence you can defend.

Create a free account to track progress and earn the certificate. You can read the syllabus below without one.

Final exam

6 questions in 20 minutes, 5 to pass. Certificates require it.

Take the exam
  1. 01The triage mindsetSeparate what you saw from what you think, then build the timeline.
  2. 02Hunting in logsGrep an auth log, find the break-in, count what matters.
  3. 03Indicators of compromiseHashes, addresses, domains: what IOCs are and how to pivot on them.
  4. 04Your first detectionWrite a brute-force rule and test it against a log sample before it ships.
  5. 05Contain, then fixIncident response order: why containment comes before eradication.
  6. 06Hardening that mattersPatching, MFA, least privilege, backups: the controls that end most incidents.