Practice Hub
Every surface here runs against one fictional estate: 810 staff, 865 endpoints, twelve servers, and telemetry generated from real attack chains rather than sampled at random. You write the queries, reach the findings, and make the containment calls, and the engine scores the decision rather than the keystrokes.
Graded environments
You work the problem and the engine scores the decision, not just the answer.
Take an alert from intake through investigation against live telemetry to a containment decision and a written record. Scored throughout, with the reasoning behind every call.
SigninLogs
| where ResultType != 0
| summarize count() by IPAddressThe queue as it actually arrives: several open incidents, competing priorities, and the judgment of which one to take first.
Generated evidence across Windows, Linux and cross-platform intrusions. Examine the artifacts, reach a finding, and defend it.
Write SPL against the same estate the courses investigate, projected into Splunk CIM sourcetypes. Graded on the result your query actually returns.
CloudTrail, VPC flow and GuardDuty against a generated AWS estate. Practitioner drills first, then multi-phase investigations.
SELECT eventName, count(*)
FROM cloudtrail_logs
GROUP BY 1Open practice
No exercise, no grading. The estate and a console.
Reference you keep
Written for the moment you need them rather than for reading end to end.
Incident response, triage, operational process and threat hunting. Every one scoped to a decision: what this is, what to do first, what to preserve, when to escalate.
Stand up your own M365 tenant and forensic workstation, so the detections and configurations you build are production artifacts rather than sandbox exercises.
The datasets, toolkits and configuration baselines a course builds against, packaged to download and run in your own environment.
Free references you reach for mid-incident: artifact locations, query patterns, triage scorecards.
Read a full module before you decide.
Every course opens with lessons you can read in full and queries you can run, without an account. The practice surfaces come with any paid plan.