Build it. Deploy it. Defend the decision.

Design, deploy and harden an endpoint estate: onboarding, compliance and Conditional Access, ASR, antivirus, device and application control, and EDR configuration.

• 10 Modules
• Lab exercises with Sysmon, ASR and MDE

Build the detection rules that catch identity attacks, govern workload and external identities, and operate Entra ID day to day. The companion to ARC401, and takeable first.

• 10 Modules

Operate the unified Microsoft security platform across Defender XDR, Sentinel, and Purview, building your SOC playbook from alert to shift handoff with live detections deployed to your tenant.

• 17 Modules
• Lab Exercises with Sentinel, Defender XDR

Read the verdict, authorize your senders, sign as your domain, reach enforcement on evidence rather than hope, and operate it afterwards. Built on RFC 9989 rather than the standard it replaced.

• 6 Modules
• Audit records, read headers and sort reports in the instruments; leave with the scripts and files

Design, measure and ship a Conditional Access policy set: read verdicts from the record, prove coverage as a number, structure the set around populations, and deploy changes without locking anybody out.

• 6 Modules

Version control for detection rules, IR playbooks, scripts, policy-as-code, and evidence: full history, safe branching and review, secret hygiene, signed provenance, and CI validation.

• 6 Modules
• Version control every security artifact with a provable audit trail and safe review

Build data security in Microsoft Purview from classification through labeling, DLP, endpoint DLP, retention, insider risk, investigation, and AI, ending with configuration guides for building each control in your own tenant.

• 13 Modules
• Full Data Security Program + Config Guides

Architect Zero Trust infrastructure across the full M365 stack, producing ADRs, decision matrices, a risk register, architecture diagrams, and a board-ready executive summary.

• 15 Modules
• M365 E5 Developer Tenant + Azure Subscription

Build a governed identity program where every identity, human and machine, has an owner, a lifecycle, and compliance evidence that survives audit.

• 15 Modules

Read a Conditional Access estate the way an investigator does: what each control covers, which population it misses, and why a correctly configured policy still let the attack through.

• 10 Modules
• Lab Exercises with Entra, Conditional Access, KQL

Design, build, test, and deploy production KQL detection rules mapped to real attack chains, leaving with a detection-as-code pipeline and the methodology to ship a validated detection for any technique.

• 13 Modules
• 71 Production Detection Rules

Learn KQL from your first query to mastery: filtering, joins, parsing, functions, time series and graphs, with every answer checked against a month of real-shaped security data.

• 11 Modules
• Practice console with a month of attack data

Run hypothesis-driven hunt campaigns across identity, email, and endpoint telemetry, building Sentinel playbooks ready for your environment.

• 17 Modules
• 10 Complete Hunt Campaigns

Automate containment and evidence collection with Sentinel playbooks and Logic Apps, building fully functional auto-response workflows you deploy to your environment.

• 14 Modules
• Lab Exercises with Logic Apps, Sentinel

Operate and defend an endpoint estate you did not build: write endpoint detections, hunt the telemetry, triage and contain a compromise, and preserve what an investigation needs.

• 9 Modules
• Lab Exercises with MDE Advanced Hunting and Live Response

Detect and respond in a Microsoft SOC: identity, mail, endpoint and cloud detections, investigation playbooks, automation, and the measures that prove it works.

• 14 Modules
• Practice console with a month of attack data

Execute real attacker techniques, observe the telemetry they produce, and translate TTPs into production Sentinel and Defender XDR detections.

• 12 Modules
• Campaign-Level Detection Thinking

Learn SPL from your first search to mastery: filtering, statistics, lookups, multivalue data, macros, time and data models with tstats, with every answer checked against a month of real-shaped security data.

• 11 Modules
• Practice console with a month of attack data

Build a CI pipeline for detections in your own GitHub: Sigma rules in version control, fixture-based tests, CI that blocks bad rules, and automated deployment to your SIEM.

• 12 Modules
• Build and own a detection pipeline: Sigma rules, CI, automated SIEM deployment

Write detections once in Sigma and run them on any SIEM: durable rules, conversion to KQL, SPL, and Elastic, correlation for multi-event attacks, and validation before they ship.

• 6 Modules
• Write a detection once in Sigma and run it on Splunk, Microsoft, and Elastic

Build, tune, deploy, and validate a Sysmon config end to end: what Sysmon records, the config that captures attacker behavior without the noise, fleet deployment, SIEM collection, Sigma detections mapped to ATT&CK, and the operations that keep coverage real.

• 4 Modules
• Build, tune, deploy, and prove a Sysmon config that catches attacker behavior

Emulate attacker techniques, validate detection coverage, and tune rules end to end across Sentinel, Splunk, and Elastic, proving your detections work before adversaries test them.

• 15 Modules
• 134 ATT&CK Techniques Walked End-to-End

Build a detection library for AD attacks from the Windows Security log: Kerberoasting, DCSync, delegation abuse, and domain dominance, rendered for Sigma, Sentinel, Splunk, and XDR alongside the hardening that removes each attack path.

• 12 Modules
• Source-first detections in four surfaces: Sigma, Windows, KQL, SPL

Make the first hour's calls from the records: confirm the alert, capture what expires, scope and score the incident, contain in an order that removes the access, and hand off.

• 13 Modules
• Runnable KQL and SPL against the lab corpus, timed alert queues, and a five-script triage kit

Investigate BEC, identity compromise, ransomware, insider threat, and OAuth abuse end to end, leaving with IR playbooks, KQL investigation queries, and containment runbooks.

• 11 Modules
• Incident Lab Scenarios + Guided Walkthroughs

Investigate compromised Linux hosts end to end: volatile evidence collection, filesystem forensics, memory analysis, and log reconstruction, building your forensic toolkit on your own hardware.

• 12 Modules
• Lab Exercises with Volatility, Log2Timeline

Collect the artifacts that answer the question, prove the collection matched what you specified, drive the parsers that make it readable, and work on evidence somebody else collected. Built on the 2026 licensing position, which most published material predates.

• 7 Modules

Investigate, detect and respond to attacks in AWS using the evidence AWS records: CloudTrail, GuardDuty, Security Hub, Config and network logs, queried with Athena SQL, from a leaked key to a post-incident review.

• 11 Modules
• Practice console with five weeks of an AWS organization under attack

Deploy Velociraptor, write the queries that ask well, collect from one endpoint in an order that survives a reboot, hunt an entire estate, and turn what comes back into an account somebody else can check.

• 7 Modules
• Full Course Rebuild + Worked Cases and Runbooks

The PowerShell a security analyst uses: triage a Windows host, investigate processes, files, the registry and event logs, read attacker PowerShell, hunt across many hosts, and build tools that make the work repeatable.

• 12 Modules
• Evidence files from Northgate's laptops, servers and tenant, one set per module

Write rules you can defend: what each modifier costs, the denominator behind every false-positive figure, patterns chosen by what it costs an author to change them, and the control that separates a clean estate from a broken rule.

• 7 Modules
• Full Course Rebuild + Worked Cases and Runbooks

Read a file the way somebody who has to decide about it does: its structure, what it is equipped to do, what others have seen, what it does when it runs, and the wording that keeps the verdict honest.

• 7 Modules
• Full Course Rebuild + Worked Cases and Runbooks

Investigate Windows endpoints end to end: registry, filesystem, memory, event logs, and timeline reconstruction, producing investigation reports you can defend.

• 13 Modules
• 2 Capstone Investigations + 39 Cookbook Procedures

Investigate volatile memory to surface fileless malware, injected code, and stolen credentials that never touch disk, leaving with a repeatable Volatility 3 workflow and report templates.

• 10 Modules
• 33 hands-on exercises + 10 guided walkthroughs

Investigate macOS endpoints from APFS forensics through unified logging, persistence, execution provenance, and cross-device correlation, producing investigation reports you apply to any Mac engagement.

• 14 Modules
• Full Capstone Investigation + macOS Fieldcraft Procedures