M365 Security, Detection Engineering and DFIR: taught by building what you'd deploy.

Design, deploy and harden an endpoint estate: onboarding, compliance and Conditional Access, ASR, antivirus, device and application control, and EDR configuration.

• 10 Modules
• Lab exercises with Sysmon, ASR and MDE

Architect Zero Trust infrastructure across the full M365 stack, producing ADRs, decision matrices, a risk register, architecture diagrams, and a board-ready executive summary.

• 15 Modules
• M365 E5 Developer Tenant + Azure Subscription

Read a Conditional Access estate the way an investigator does: what each control covers, which population it misses, and why a correctly configured policy still let the attack through.

• 10 Modules
• Lab Exercises with Entra, Conditional Access, KQL

Build a governed identity program where every identity, human and machine, has an owner, a lifecycle, and compliance evidence that survives audit.

• 15 Modules

Build the detection rules that catch identity attacks, govern workload and external identities, and operate Entra ID day to day. The companion to ARC401, and takeable first.

• 10 Modules

Operate the unified Microsoft security platform across Defender XDR, Sentinel, and Purview, building your SOC playbook from alert to shift handoff with live detections deployed to your tenant.

• 17 Modules
• Lab Exercises with Sentinel, Defender XDR

Design, build, test, and deploy production KQL detection rules mapped to real attack chains, leaving with a detection-as-code pipeline and the methodology to ship a validated detection for any technique.

• 13 Modules
• 71 Production Detection Rules

Master KQL from first query to production detection rules, building a reusable query library you carry into every hunt and investigation.

• 14 Modules
• 68 KQL Exercises

Run hypothesis-driven hunt campaigns across identity, email, and endpoint telemetry, building Sentinel playbooks ready for your environment.

• 17 Modules
• 10 Complete Hunt Campaigns

Automate containment and evidence collection with Sentinel playbooks and Logic Apps, building fully functional auto-response workflows you deploy to your environment.

• 14 Modules
• Lab Exercises with Logic Apps, Sentinel

Make the first hour's calls from the records: confirm the alert, capture what expires, scope and score the incident, contain in an order that removes the access, and hand off.

• 13 Modules
• Runnable KQL and SPL against the lab corpus, timed alert queues, and a five-script triage kit

Investigate BEC, identity compromise, ransomware, insider threat, and OAuth abuse end to end, leaving with IR playbooks, KQL investigation queries, and containment runbooks.

• 11 Modules
• Incident Lab Scenarios + Guided Walkthroughs

Investigate compromised Linux hosts end to end: volatile evidence collection, filesystem forensics, memory analysis, and log reconstruction, building your forensic toolkit on your own hardware.

• 12 Modules
• Lab Exercises with Volatility, Log2Timeline

Investigate Windows endpoints end to end: registry, filesystem, memory, event logs, and timeline reconstruction, producing investigation reports you can defend.

• 13 Modules
• 2 Capstone Investigations + 39 Cookbook Procedures

Operate and defend an endpoint estate you did not build: write endpoint detections, hunt the telemetry, triage and contain a compromise, and preserve what an investigation needs.

• 9 Modules
• Lab Exercises with MDE Advanced Hunting and Live Response

Build SOC operational playbooks for triage, escalation, shift handover, and the metrics that prove your team is improving, ready to implement this week.

• 14 Modules
• Lab Exercises with Sentinel, KQL

Build risk registers, compliance mappings, audit evidence packages, and board reports: the governance program your assessor recognizes as production-grade.

• 17 Modules

Investigate volatile memory to surface fileless malware, injected code, and stolen credentials that never touch disk, leaving with a repeatable Volatility 3 workflow and report templates.

• 10 Modules
• 33 hands-on exercises + 10 guided walkthroughs

Investigate macOS endpoints from APFS forensics through unified logging, persistence, execution provenance, and cross-device correlation, producing investigation reports you apply to any Mac engagement.

• 14 Modules
• Full Capstone Investigation + macOS Fieldcraft Procedures

Emulate attacker techniques, validate detection coverage, and tune rules end to end across Sentinel, Splunk, and Elastic, proving your detections work before adversaries test them.

• 15 Modules
• 134 ATT&CK Techniques Walked End-to-End

Execute real attacker techniques, observe the telemetry they produce, and translate TTPs into production Sentinel and Defender XDR detections.

• 12 Modules
• Campaign-Level Detection Thinking

Collect the artifacts that answer the question, prove the collection matched what you specified, drive the parsers that make it readable, and work on evidence somebody else collected. Built on the 2026 licensing position, which most published material predates.

• 7 Modules

Investigate and contain AWS intrusions across CloudTrail, GuardDuty, and VPC Flow Logs, from leaked keys through privilege escalation to data exfiltration, producing a written investigation report.

• 12 Modules
• AWS Query Lab + Guided Investigations

Deploy Velociraptor, write the queries that ask well, collect from one endpoint in an order that survives a reboot, hunt an entire estate, and turn what comes back into an account somebody else can check.

• 7 Modules
• Full Course Rebuild + Worked Cases and Runbooks

The specific PowerShell you run mid-incident: the object pipeline, fan-out collection with remoting, the first-response evidence script, event log timelines, persistence hunting, and M365 containment.

• 7 Modules
• The PowerShell you reach for mid-incident, from the pipeline to fleet-wide collection

Write tstats-accelerated detections over CIM data models, hunt across identity, endpoint, network, and cloud, and run a Splunk incident from alert to report.

• 13 Modules
• Runnable SPL against the NE corpus

Build a detection library for AD attacks from the Windows Security log: Kerberoasting, DCSync, delegation abuse, and domain dominance, rendered for Sigma, Sentinel, Splunk, and XDR alongside the hardening that removes each attack path.

• 12 Modules
• Source-first detections in four surfaces: Sigma, Windows, KQL, SPL

Write rules you can defend: what each modifier costs, the denominator behind every false-positive figure, patterns chosen by what it costs an author to change them, and the control that separates a clean estate from a broken rule.

• 7 Modules
• Full Course Rebuild + Worked Cases and Runbooks

Build a CI pipeline for detections in your own GitHub: Sigma rules in version control, fixture-based tests, CI that blocks bad rules, and automated deployment to your SIEM.

• 12 Modules
• Build and own a detection pipeline: Sigma rules, CI, automated SIEM deployment

Read the verdict, authorize your senders, sign as your domain, reach enforcement on evidence rather than hope, and operate it afterwards. Built on RFC 9989 rather than the standard it replaced.

• 6 Modules
• Audit records, read headers and sort reports in the instruments; leave with the scripts and files

Write detections once in Sigma and run them on any SIEM: durable rules, conversion to KQL, SPL, and Elastic, correlation for multi-event attacks, and validation before they ship.

• 6 Modules
• Write a detection once in Sigma and run it on Splunk, Microsoft, and Elastic

Read a file the way somebody who has to decide about it does: its structure, what it is equipped to do, what others have seen, what it does when it runs, and the wording that keeps the verdict honest.

• 7 Modules
• Full Course Rebuild + Worked Cases and Runbooks

Design, measure and ship a Conditional Access policy set: read verdicts from the record, prove coverage as a number, structure the set around populations, and deploy changes without locking anybody out.

• 6 Modules

Version control for detection rules, IR playbooks, scripts, policy-as-code, and evidence: full history, safe branching and review, secret hygiene, signed provenance, and CI validation.

• 6 Modules
• Version control every security artifact with a provable audit trail and safe review

Build, tune, deploy, and validate a Sysmon config end to end: what Sysmon records, the config that captures attacker behavior without the noise, fleet deployment, SIEM collection, Sigma detections mapped to ATT&CK, and the operations that keep coverage real.

• 4 Modules
• Build, tune, deploy, and prove a Sysmon config that catches attacker behavior

Build data security in Microsoft Purview from classification through labeling, DLP, endpoint DLP, retention, insider risk, investigation, and AI, ending with configuration guides for building each control in your own tenant.

• 13 Modules
• Full Data Security Program + Config Guides