Where Do You Want to Be in Six Months?

Operate the unified Microsoft security platform across Defender XDR, Sentinel, and Purview, building your SOC playbook from alert to shift handoff with live detections deployed to your tenant.

• 18 Modules
• Lab Exercises with Sentinel, Defender XDR

Design Conditional Access architectures, deploy phishing-resistant MFA, govern app registrations, and detect identity-based attacks, leaving with production-ready policies and detection rules you deploy immediately.

• 21 Modules
• Lab Exercises with Entra, Conditional Access, KQL

Harden endpoints with ASR rules, compliance policies, and Defender for Endpoint detection configurations you deploy to your environment today.

• 16 Modules
• Lab Exercises with KAPE, Sysmon, MDE

Architect Zero Trust infrastructure across the full M365 stack, producing ADRs, decision matrices, a risk register, architecture diagrams, and a board-ready executive summary.

• 17 Modules
• M365 E5 Developer Tenant + Azure Subscription

Build a governed identity program where every identity, human and machine, has an owner, a lifecycle, and compliance evidence that survives audit.

• 17 Modules

Master KQL from first query to production detection rules, building a reusable query library you carry into every hunt and investigation.

• 16 Modules
• 68 KQL Exercises

Build SOC operational playbooks for triage, escalation, shift handover, and the metrics that prove your team is improving, ready to implement this week.

• 16 Modules
• Lab Exercises with Sentinel, KQL

Design, build, test, and deploy production KQL detection rules mapped to real attack chains, leaving with a detection-as-code pipeline and the methodology to ship a validated detection for any technique.

• 14 Modules
• 71 Production Detection Rules

Automate containment and evidence collection with Sentinel playbooks and Logic Apps, building fully functional auto-response workflows you deploy to your environment.

• 16 Modules
• Lab Exercises with Logic Apps, Sentinel

Run hypothesis-driven hunt campaigns across identity, email, and endpoint telemetry, building Sentinel playbooks ready for your environment.

• 18 Modules
• 10 Complete Hunt Campaigns

Execute real attacker techniques, observe the telemetry they produce, and translate TTPs into production Sentinel and Defender XDR detections.

• 13 Modules
• Campaign-Level Detection Thinking

Master the structured methodology from alert to containment: classify incidents, scope compromises, and hand off with confidence before they escalate.

• 13 Modules
• Hands-on triage labs with runnable SPL against the lab corpus

Investigate BEC, identity compromise, ransomware, insider threat, and OAuth abuse end to end, leaving with IR playbooks, KQL investigation queries, and containment runbooks.

• 15 Modules
• Incident Lab Scenarios + Guided Walkthroughs

Investigate and contain AWS intrusions across CloudTrail, GuardDuty, and VPC Flow Logs, from leaked keys through privilege escalation to data exfiltration, producing a written investigation report.

• 15 Modules
• AWS Query Lab + Guided Investigations

Investigate Windows endpoints end to end: registry, filesystem, memory, event logs, and timeline reconstruction, producing investigation reports and a forensic field manual.

• 15 Modules
• 2 Capstone Investigations + 32 Fieldcraft Procedures

Investigate compromised Linux hosts end to end: volatile evidence collection, filesystem forensics, memory analysis, and log reconstruction, building your forensic toolkit on your own hardware.

• 11 Modules
• Lab Exercises with Volatility, Log2Timeline

Investigate macOS endpoints from APFS forensics through unified logging, persistence, execution provenance, and cross-device correlation, producing investigation reports you apply to any Mac engagement.

• 17 Modules
• Full Capstone Investigation + macOS Fieldcraft Procedures

Investigate volatile memory to surface fileless malware, injected code, and stolen credentials that never touch disk, leaving with a repeatable Volatility 3 workflow and report templates.

• 11 Modules
• 33 hands-on exercises + 10 guided walkthroughs

Master KQL from first query to production detection rules, building a reusable query library you carry into every hunt and investigation.

• 16 Modules
• 68 KQL Exercises

Write tstats-accelerated detections over CIM data models, hunt across identity, endpoint, network, and cloud, and run a Splunk incident from alert to report.

• 16 Modules
• Runnable SPL against the NE corpus

Build a detection library for AD attacks from the Windows Security log: Kerberoasting, DCSync, delegation abuse, and domain dominance, rendered for Sigma, Sentinel, Splunk, and XDR alongside the hardening that removes each attack path.

• 15 Modules
• Source-first detections in four surfaces: Sigma, Windows, KQL, SPL

Build risk registers, compliance mappings, audit evidence packages, and board reports: the governance program your assessor recognizes as production-grade.

• 18 Modules

Integrate AI into investigation, detection engineering, IR documentation, and governance workflows, building prompt libraries, detection templates, and deployment playbooks with verification discipline.

• 12 Modules

Operate the unified Microsoft security platform across Defender XDR, Sentinel, and Purview, building your SOC playbook from alert to shift handoff with live detections deployed to your tenant.

• 18 Modules
• Lab Exercises with Sentinel, Defender XDR

Operate the unified Microsoft security platform across Defender XDR, Sentinel, and Purview, building your SOC playbook from alert to shift handoff with live detections deployed to your tenant.

• 18 Modules
• Lab Exercises with Sentinel, Defender XDR

Master KQL from first query to production detection rules, building a reusable query library you carry into every hunt and investigation.

• 16 Modules
• 68 KQL Exercises

Harden endpoints with ASR rules, compliance policies, and Defender for Endpoint detection configurations you deploy to your environment today.

• 16 Modules
• Lab Exercises with KAPE, Sysmon, MDE

Design Conditional Access architectures, deploy phishing-resistant MFA, govern app registrations, and detect identity-based attacks, leaving with production-ready policies and detection rules you deploy immediately.

• 21 Modules
• Lab Exercises with Entra, Conditional Access, KQL