Free module
Security operations
Learn security operations hands on: what to log, alert triage, detection rules, incident response and measuring it, in a real lab.
The lessons
Each lesson is free to read in full. Create a free account to run its commands in a live lab and to sit its quizzes and tasks.
1 · Virtual machine lab
What to log and watch
I can choose which logs and numbers a security team should collect and watch.
Read the lesson2 · Virtual machine lab
Alert triage and false alarms
I can rank a queue of alerts by how much each one matters.
Read the lesson3 · Virtual machine lab
Write a detection rule
I can write a rule that finds a guessing attack in log lines.
Read the lesson4 · Virtual machine lab
The steps of incident response
I can put the steps of an incident response in the right order.
Read the lesson5 · Virtual machine lab
Learn from an incident and measure it
I can work out the time to detect and the time to recover for an incident.
Read the lesson
Worked in a real lab
Every lesson of this module is worked in a lab started for you alone. The labs it uses:
Teaching a class? Set this module for your students with a teacher guide, marked assignments and a lab for every student.