Explore courses and learning paths built around practical cybersecurity work. See what you’ll practice, then continue in Guardian Foundry.
Courses focus on a topic. Learning paths combine related courses into a guided sequence and can include assessments.
36 results
Build an IT foundation in Windows, Linux and networking, then configure an Active Directory environment and resolve helpdesk tickets. The path concludes with the Cyber Defense Technician (CDT) assessment.
Progress from IT and networking foundations to phishing analysis, Windows host triage and SIEM investigations. Practice report writing and work a Virtual SOC alert queue, with CDT, CDA, CDR and CDCA assessments along the path.
Study how attackers exploit weaknesses, establish persistence and move through systems. Practice vulnerability scanning, scoring and validation, then document a finding in a report.
Turn intelligence requirements into a focused investigation. Work through collection, threat analysis and case studies, then write a report that connects the evidence to a defender's needs.
Learn how hashing, encoding and encryption support secure communications and data protection. Explore digital signatures and certificates, then work with encoded and encrypted data in CyberChef.
Explore the intelligence lifecycle through breach reports and threat actor case studies. Use the Cyber Kill Chain, Pyramid of Pain and MITRE ATT&CK to organize what you learn about an attack.
Build a foundation in the concepts security teams use every day. Explore security controls, identity and access management, defense in depth, common threat actors and the ways attacks reach an organization.
Build and test YARA, Snort and Sigma detections, manage detection code in GitHub and use adversary emulation to assess coverage. Progress through practical detection challenges to the Certified Detection Engineer & Threat Hunter (CDETH) assessment.
Analyze Windows and Sysmon event logs and write Sigma rules for suspicious behavior. Work through detection challenges involving reconnaissance, encoded commands, persistence and credential attacks.
Start with the principles behind useful detections. Explore detection engineering practices, documentation standards, indicator and behavior analysis, and the Pyramid of Pain in this free introductory course.
Examine cloud security through breach case studies involving AWS, Azure and Google Cloud. Explore security boundaries, exposed secrets and DevSecOps practices in GitHub, then apply the concepts in practical exercises.
Investigate endpoint and network evidence with tools including Velociraptor, Volatility, osquery and Hayabusa. Explore execution artifacts, persistence, memory analysis and timelines to reconstruct suspicious activity.
Connect security frameworks and risk assessments to the work of managing systems. Practice Windows Server hardening with CIS Benchmarks and review a security audit.
Build and administer a Windows Active Directory environment, then work through helpdesk tickets. Practice user and policy management, remote administration, system hardening and troubleshooting.
Write endpoint detections with Sigma and YARA, then test them through adversary emulation. Connect detection logic to the behavior and artifacts produced by an attack simulation.
Get comfortable navigating a Linux system through its desktop and command line. Work with files, processes, logs, users and permissions while learning the operating system's basic structure.
Use command-line tools on Windows and Linux to inspect hosts, test connections and explore network services. Practice DNS lookups, remote connections, file transfers and basic network discovery.
Examine DNS, ICMP, HTTP and TLS traffic with Wireshark. Follow protocol exchanges, inspect request details and correlate activity across protocols during a packet-capture investigation.
Progress from networking foundations and command-line tools to packet analysis and network threat hunting. Investigate DNS, HTTP, TLS and ICMP traffic, then document suspicious activity in a network forensics report.
Investigate packet captures for malware activity and suspicious network behavior. Follow evidence across traffic-analysis challenges and bring your findings together in a network forensics report.
Learn to navigate and filter packet captures in Wireshark. Explore ARP, TCP and HTTP, extract endpoint metadata and identify traffic that deserves further investigation.
Learn how devices connect and exchange data. Explore network models, topologies and equipment, then work through addressing, subnetting, ports and the differences between TCP and UDP.
Follow an introductory web application penetration test in a training environment. Start with rules of engagement and reconnaissance, then investigate vulnerabilities, gain a foothold and explore privilege escalation.
Investigate a supply-chain compromise using a case artifact pack. Extract indicators, write YARA, Snort and Sigma detections, develop a threat hunt and assemble an incident report.
Investigate a business email compromise phishing campaign through a sequence of challenges. Examine the bait, extract indicators and decode hidden payloads, then write a campaign report.
Build PowerShell skills from basic commands to reusable scripts. Work with files, objects and the pipeline, then apply scripting to Windows processes, services, the registry and Active Directory tasks.
Practice the command-line tasks used to maintain a Linux system. Manage processes, services, scheduled jobs and software, then bring scripting and file operations together in a backup tool.
Learn Python fundamentals through tasks relevant to security work. Move from variables and control flow to files and network requests, then use those skills to build a security tool.
Turn investigation evidence into a clear incident report for technical and executive readers. Critique an existing report, then build your own analysis, summaries and recommendations from raw evidence.
Practice the investigations a SOC analyst encounters across email, Windows hosts and security logs. Examine phishing messages, malware behavior and persistence, then use ELK queries and detection tools to follow the evidence.
Go deeper into Windows internals, compromised-host investigations and threat hunting in ELK. Examine memory, persistence and log evidence, then document findings in DFIR and threat hunt reports.
Build investigation skills across network protocols, Windows triage, threat intelligence, vulnerability management and digital forensics. Apply them to escalated Virtual SOC alerts and the Cyber Defense Certified Professional (CDCP) assessment.
Explore the technical disciplines that branch out from SOC analysis. Try PowerShell and Python scripting, detection engineering, cloud security, DevSecOps and web application testing to identify a direction for further study.
Try a free phishing investigation and write a short incident report, then submit your work for instructor feedback. This introductory course welcomes newcomers and requires no virtual machine setup.
Work through escalated alerts in a simulated SOC environment. Investigate malicious DNS, unusual user activity, network anomalies and endpoint malware detections using the evidence available in each case.
Learn the structure of Windows and practice its core administration tools. Explore files, accounts, permissions, processes and services, then use the command line, registry and Event Viewer to inspect the system.
Exercise counts include distinct answer-based activities and labs. Assessments are shown separately. Durations are authored estimates when available; your pace may vary.