Become the professional your team relies on

Harden endpoints with ASR rules, compliance policies, and Defender for Endpoint detection configurations you deploy to your environment today.

• 16 Modules
• Lab Exercises with KAPE, Sysmon, MDE

Design Conditional Access architectures, deploy phishing-resistant MFA, govern app registrations, and detect identity-based attacks, leaving with production-ready policies and detection rules you deploy immediately.

• 19 Modules
• Lab Exercises with Entra, Conditional Access, KQL

Operate the unified Microsoft security platform across Defender XDR, Sentinel, and Purview, building your SOC playbook from alert to shift handoff with live detections deployed to your tenant.

• 17 Modules
• Lab Exercises with Sentinel, Defender XDR

Read the verdict, authorize your senders, sign as your domain, reach enforcement on evidence rather than hope, and operate it afterwards. Built on RFC 9989 rather than the standard it replaced.

• 6 Modules

Design, measure and ship a Conditional Access policy set: read verdicts from the record, prove coverage as a number, structure the set around populations, and deploy changes without locking anybody out.

• 6 Modules

Version control for detection rules, IR playbooks, scripts, policy-as-code, and evidence: full history, safe branching and review, secret hygiene, signed provenance, and CI validation.

• 6 Modules
• Version control every security artifact with a provable audit trail and safe review

Build data security in Microsoft Purview from classification through labeling, DLP, endpoint DLP, retention, insider risk, investigation, and AI, ending with configuration guides for building each control in your own tenant.

• 13 Modules
• Full Data Security Program + Config Guides

Architect Zero Trust infrastructure across the full M365 stack, producing ADRs, decision matrices, a risk register, architecture diagrams, and a board-ready executive summary.

• 15 Modules
• M365 E5 Developer Tenant + Azure Subscription

Build a governed identity program where every identity, human and machine, has an owner, a lifecycle, and compliance evidence that survives audit.

• 15 Modules

Design, build, test, and deploy production KQL detection rules mapped to real attack chains, leaving with a detection-as-code pipeline and the methodology to ship a validated detection for any technique.

• 13 Modules
• 71 Production Detection Rules

Master KQL from first query to production detection rules, building a reusable query library you carry into every hunt and investigation.

• 14 Modules
• 68 KQL Exercises

Run hypothesis-driven hunt campaigns across identity, email, and endpoint telemetry, building Sentinel playbooks ready for your environment.

• 17 Modules
• 10 Complete Hunt Campaigns

Automate containment and evidence collection with Sentinel playbooks and Logic Apps, building fully functional auto-response workflows you deploy to your environment.

• 14 Modules
• Lab Exercises with Logic Apps, Sentinel

Build SOC operational playbooks for triage, escalation, shift handover, and the metrics that prove your team is improving, ready to implement this week.

• 14 Modules
• Lab Exercises with Sentinel, KQL

Execute real attacker techniques, observe the telemetry they produce, and translate TTPs into production Sentinel and Defender XDR detections.

• 12 Modules
• Campaign-Level Detection Thinking

Write tstats-accelerated detections over CIM data models, hunt across identity, endpoint, network, and cloud, and run a Splunk incident from alert to report.

• 13 Modules
• Runnable SPL against the NE corpus

Build a CI pipeline for detections in your own GitHub: Sigma rules in version control, fixture-based tests, CI that blocks bad rules, and automated deployment to your SIEM.

• 12 Modules
• Build and own a detection pipeline: Sigma rules, CI, automated SIEM deployment

Write detections once in Sigma and run them on any SIEM: durable rules, conversion to KQL, SPL, and Elastic, correlation for multi-event attacks, and validation before they ship.

• 6 Modules
• Write a detection once in Sigma and run it on Splunk, Microsoft, and Elastic

Build, tune, deploy, and validate a Sysmon config end to end: what Sysmon records, the config that captures attacker behavior without the noise, fleet deployment, SIEM collection, Sigma detections mapped to ATT&CK, and the operations that keep coverage real.

• 4 Modules
• Build, tune, deploy, and prove a Sysmon config that catches attacker behavior

Build a detection library for AD attacks from the Windows Security log: Kerberoasting, DCSync, delegation abuse, and domain dominance, rendered for Sigma, Sentinel, Splunk, and XDR alongside the hardening that removes each attack path.

• 12 Modules
• Source-first detections in four surfaces: Sigma, Windows, KQL, SPL

Master the structured methodology from alert to containment: classify incidents, scope compromises, and hand off with confidence before they escalate.

• 12 Modules
• Hands-on triage labs with runnable SPL against the lab corpus

Investigate BEC, identity compromise, ransomware, insider threat, and OAuth abuse end to end, leaving with IR playbooks, KQL investigation queries, and containment runbooks.

• 13 Modules
• Incident Lab Scenarios + Guided Walkthroughs

Investigate compromised Linux hosts end to end: volatile evidence collection, filesystem forensics, memory analysis, and log reconstruction, building your forensic toolkit on your own hardware.

• 10 Modules
• Lab Exercises with Volatility, Log2Timeline

Collect the artifacts that answer the question, prove the collection matched what you specified, drive the parsers that make it readable, and work on evidence somebody else collected. Built on the 2026 licensing position, which most published material predates.

• 7 Modules

Investigate and contain AWS intrusions across CloudTrail, GuardDuty, and VPC Flow Logs, from leaked keys through privilege escalation to data exfiltration, producing a written investigation report.

• 12 Modules
• AWS Query Lab + Guided Investigations

The specific PowerShell you run mid-incident: the object pipeline, fan-out collection with remoting, the first-response evidence script, event log timelines, persistence hunting, and M365 containment.

• 7 Modules
• The PowerShell you reach for mid-incident, from the pipeline to fleet-wide collection

Investigate Windows endpoints end to end: registry, filesystem, memory, event logs, and timeline reconstruction, producing investigation reports and a forensic field manual.

• 13 Modules
• 2 Capstone Investigations + 32 Fieldcraft Procedures

Investigate volatile memory to surface fileless malware, injected code, and stolen credentials that never touch disk, leaving with a repeatable Volatility 3 workflow and report templates.

• 10 Modules
• 33 hands-on exercises + 10 guided walkthroughs

Investigate macOS endpoints from APFS forensics through unified logging, persistence, execution provenance, and cross-device correlation, producing investigation reports you apply to any Mac engagement.

• 14 Modules
• Full Capstone Investigation + macOS Fieldcraft Procedures