Free

Field Guides

Practitioner references for the work security teams actually do. Cloud security detection, digital forensics and incident response, and the adversary tradecraft that informs both. Every guide is built to be used on the job, not skimmed once. No account needed.

Cloud Security DFIR Tradecraft

Cloud Security

10 guides

Detecting and defending Microsoft 365 and Entra ID. The detection reference anchors this set, with deeper guides on the query language, the identity plane, and the engineering discipline behind production detection.

Reference Hub The M365 & Entra ID Detection Reference Every technique that appears in real M365 intrusions, mapped to the ATT&CK Identity Provider and Office Suite matrices, with the KQL to detect it. The anchor of the cloud security set.

MITRE ATT&CKKQLSentinel

KQL Query Reference Production detection queries for Sentinel and Defender XDR, organized by ATT&CK tactic.

KQLSentinelDefender XDR

Entra ID Security Sign-in forensics, conditional access, token security, PIM, and workload identity under attack.

Entra IDSign-in logsCA

Detection Engineering Rule anatomy, coverage measurement, testing and tuning, and detection as code.

DetectionSigmaTesting

M365 Threat Hunting The hypothesis-driven hunt method and hunts by objective across the M365 attack surface.

HuntingKQLM365

M365 SOC Alert Triage Triaging the alerts an M365 SOC sees daily, with the enrichment and decision logic for each.

SOCTriageM365

M365 Security Architecture The security controls across the M365 stack and how they fit into a defensible design.

M365ArchitectureControls

Identity & Access Management Identity governance, access control, and the IAM decisions that shape your attack surface.

IAMEntra IDAccess

PowerShell for Security Operations The Graph and Exchange Online commands security operators run, with investigative context.

PowerShellGraphExchange

ASR Rules Quick Reference Attack surface reduction rules, what each blocks, and how to deploy them without breaking work.

ASRDefenderHardening

DFIR

11 guides

Digital forensics and incident response. Artifact references, native command guides, and the searchable investigation tools a responder keeps open on the second monitor. Guides marked Interactive are searchable apps rather than reading references.

Incident Response The response lifecycle from detection to recovery, with the actions and decisions at each phase.

IRContainmentNIST

Native Windows Forensic Commands The built-in Windows commands for live response and evidence collection, no third-party tools required.

WindowsLive responseCLI

Memory Forensics Volatile memory analysis: process, network, injection, and credential artifacts in a memory image.

MemoryVolatilityInjection

Network Forensics Packet and flow analysis, protocol reconstruction, and the network evidence of an intrusion.

NetworkPCAPProtocols

Linux Forensic Artifacts Where evidence lives on a Linux host: logs, persistence, execution, and account activity.

LinuxArtifactsLogs

EZ Tools & KAPE Eric Zimmerman's tools and KAPE for triage collection and artifact parsing, with usage patterns.

KAPEEZ ToolsTriage

Interactive DFIR Investigation Runbooks Seven searchable investigation runbooks: triage, evidence collection, scoping, and containment by incident type.

RunbooksIRScoping

Interactive Windows Forensic Artifacts A searchable catalog of Windows artifacts with registry paths, extraction tools, and investigative meaning.

WindowsRegistryArtifacts

Interactive Windows Event ID Reference Searchable Security, Sysmon, PowerShell, and Defender event IDs with investigative context for each.

Event IDsSysmonSecurity log

Interactive Event Log Triage Analyzer Paste event data and surface the security-relevant signal, with the analysis logic built in.

EVTXTriageAnalysis

Interactive Incident Triage Scorecard Score an alert against weighted criteria to reach a defensible triage classification.

TriageScoringAlerts

Tradecraft

2 guides

The adversary methodology that sharpens detection and response. Offensive thinking from the defender's seat, and the purple-team loop that validates whether your detections actually fire.

Offensive Security for Defenders The attacker operational lifecycle viewed from the blue side, each phase paired with what you detect.

Attacker TTPsDetectionATT&CK

Purple Teaming Emulate the attack, validate the detection. The purple loop across the ATT&CK kill chain, with a coverage scorecard.

Purple teamEmulationCoverage

Go deeper than the guide

The field guides show you the what. The courses teach you to build it for your own environment, with the data model, the tuning, and the response behind each detection.

Explore the courses