// loading
The track for the people who get paged when something looks wrong on the wire. Pentest fundamentals, SIEM tuning, incident response under time pressure, and hardening the box you just shipped to production.
Each lesson is a 1-line briefing on what you'll practice. Read the briefing, then click Practice in terminal to drop into a real sandbox.
EDR alerts, AD audit logs, email forensics. Most "incidents" are noise : the skill is filtering fast without dismissing real intrusions in the process.
SIEM false-positive tuning, beaconing/C2 detection, cloud posture, Linux priv-esc. You stop reading alerts and start writing the detection logic.
Ransomware containment, WAF change-management, insider-threat investigation, executive write-up. Time pressure + business risk + technical depth, all at once.
The graded assessment uses the same terminal sandbox as these lessons : only it scores you on accuracy, methodology, tool fluency, communication, and real-world fit.