Short track · Analyst essentials· ~/academy/tracks/analyst
Analyst Essentials for Engineers
The small set of analyst skills every security engineer needs: reading logs under pressure, running a triage loop that does not miss, and mapping what you see to how attackers actually move.
2
Modules
10
Lessons
5 h
Reading
01
Analyst essentials
Three lessons: logs, triage, attacker movement.
FREE5 lessons
- Reading logs for triageFollow one suspicious login through identity, endpoint and cloud logs. Anatomy of a useful log line, why you read sequences instead of errors, time and normalisation traps, and the shell and SIEM queries that get you to the answer.Must know28 min
- The triage loopA repeatable loop for every alert: validate, scope, contain, collect, decide. How to validate on raw events, pick the smallest containment, write a case note others can act on, and avoid the two classic failures: closing too early and chasing everything.Must know25 min
- Attacker movement: kill chain and ATT&CKHow intrusions actually unfold, the MITRE ATT&CK vocabulary that lets engineers and analysts talk precisely, how to map coverage and find gaps, and how to use both mid-incident to predict the attacker's next move.Must know26 min
- Alert tuning and false positivesMeasure a rule before you touch it, pick the right fix (tune the logic, suppress a duplicate, or allow-list with an owner and an expiry), use baselines instead of gut feel, write tuning tickets an engineer can act on, and avoid the classic mistake of tuning away the true positive.26 min
- Network triage with flows and DNSRead NetFlow and Zeek conn and dns logs to answer who talked to whom, how much and how regularly. Spot beaconing, DNS tunnelling and egress anomalies, and know when a pcap is worth asking for and what it adds.27 min
02
Investigation & threat hunting
Windows and identity logs in depth, a full phishing investigation, and hypothesis-driven hunting that ends in new detections.
🔒 PRO5 lessons
- Windows and identity logsThe Windows Security events that matter (4624, 4625, 4688, 4769 and friends), what logon types and status codes mean, and how to read Entra ID and Okta sign-in logs for spraying, token theft and MFA abuse.32 min🔒
- Phishing investigationA reported email, end to end: read the headers, judge SPF, DKIM and DMARC correctly, triage URLs and attachments safely, scope who received, clicked and submitted, then contain and clean up.Must know30 min🔒
- Hypothesis-driven huntingHunting as a method, not a mood: write testable hypotheses from ATT&CK and intel, baseline what normal looks like, find the long tail with stacking, and turn every hunt into a detection, a telemetry fix or a documented negative.34 min🔒
- Cloud incident investigationInvestigate cloud compromises from the control-plane audit logs: CloudTrail, Azure activity and Entra logs, and GCP audit logs. Trace leaked access keys, unwind AssumeRole chains, read console logins, find IAM persistence, then scope and contain without destroying evidence.34 min🔒
- Malware triage for analystsHandle samples safely, triage them statically (hashes, strings, PE metadata, signatures), read a sandbox report without being fooled by it, pull out IOCs that are actually useful, and know when to hand off to a reverse engineer.31 min🔒