Learning path
Security analyst starter
4 labs1.6 hours225 pointsintermediate
Read the evidence: spot a phishing email, read a server log and sign-in logs, then respond to an incident without overreacting.
Finish every lab to earn a certificate.
Spot the phishing emailNext
Read the headers and the message the way a security analyst does: check who really sent it, find the lines that give a scam away, leave the real mail alone and respond to the bad ones.
beginner20 min
Read a Linux auth log
Read the authentication log of a Linux server: spot the password-guessing run, find the account an attacker created after getting in, and tell it from the nightly backup that only looks alarming.
intermediate25 min
Review sign-in logs
Read a sign-in report and tell an attack from an ordinary day: impossible travel, a flood of approval requests, an old protocol that skips multifactor, and a trip that only looks suspicious.
intermediate25 min
Respond to a compromised account
A phishing click became a stolen session and a quiet forwarding rule. Read the timeline, contain the account in the right order without overreacting, and write the handover note.
advanced25 min