A complete Blue Team path from triage, telemetry, SIEM, and detection through incident response, forensics, and threat hunting to cloud, OT/ICS, and AI security. Knowledge builds on worked scenarios, and every module ends with a knowledge check.
From the first alert to a defensible decision: learn the SOC mission, boundaries of responsibility, the analyst loop, maps of people and data, escalation, handover, confidentiality, and quality measures. Every tool follows an analytical question and includes an explained Linux command example. The module ends with a knowledge check and requires no downloads or lab work.
A trace-oriented map of the environment: assets and identities, processes, services, files, connections, DNS, HTTP, TLS, remote administration, directories, and the cloud control plane. Every lesson asks where telemetry originates, what it cannot show, and how to read it without overclaiming.
From a raw record to a defensible conclusion: log anatomy, entities, identifiers, time, provenance, integrity, correlation, retention, and data gaps. The module shows why an alert is not an incident and why silence in logs does not prove an absence of activity.
The complete Incident Response cycle aligned with NIST CSF 2.0 and SP 800-61r3: preparation, intake, analysis, scoping, containment, eradication, recovery, communication, and lessons learned. One closed Helios case demonstrates decision roles, safe actions, and transition criteria.
The operational L1 core: from alert data-quality checks through classification, user and asset context, severity, priority, and confidence to rapid pivots, escalation, closure codes, and detection feedback. The finale works through a five-alert queue requiring different decisions.
The Windows Event Log model read through provider, channel, Event ID, Record ID, and XML. Sign-in sessions, processes, tokens, accounts, groups, services, tasks, policies, and Windows Event Forwarding are analyzed as behavior dependent on audit configuration rather than a list of numbers to memorize.
Sysmon as a configurable sensor rather than a verdict engine. Process GUIDs, process trees, network connections, files, registry, images, drivers, and process access are joined into a narrative while accounting for filters, collection cost, event loss, and sensor health.
PowerShell, cmd, and WSH as legitimate tools and possible parts of an attack chain. The module combines 4688, Sysmon Event 1, PowerShell 4103/4104, protected log content, parent-child relationships, network activity, and automation context without treating encoding or obfuscation as automatic proof of a threat.
Persistence, access to authentication material, and lateral movement analysed as a sequence of processes, files, registry, services, tasks, logons, and network activity. The module teaches multi-host scoping and ransomware precursors without instructions for credential dumping or system compromise.
The domain as an identity control plane: Kerberos, NTLM, spraying, accounts, groups, GPO, ACLs, delegation, AD CS, and replication. Event IDs are entry points; decisions come from the subject, target, operation, source, time, audit policy, and baseline.
From capture vantage point and quality through packets, flows, DNS, HTTP, TLS, and SMB to beaconing and possible Command and Control. Wireshark/TShark and Zeek answer scoped questions rather than supply magic filters; encryption and telemetry gaps remain explicit.
SIEM as a system of questions, data, and decisions. The module moves from data contracts and search through normalisation, aggregations, baselines, joins, correlation, and dashboards to cost, performance, and detection quality, comparing ES|QL, KQL, and SPL patterns.
Proactive search not initiated by an alert: hypothesis, scope, MITRE ATT&CK, indicators and behaviours, data readiness, pivots, negative results, and transfer of discoveries into detection and Incident Response. The final section presents a complete Helios hunt without fitting the story after the fact.
From behaviour and data requirements to a maintainable detection. This module explains Sigma anatomy and conditions, translation through backends and pipelines, safe YARA rules, positive and negative tests, tuning, versioning, and quality metrics through a complete Helios package.
An investigation joining the message layer, domain authentication, safe URL and attachment triage, mailbox rules, sign-ins, tokens, and OAuth consent. The module separates lure content from technical evidence and leads through scoping, containment, and communication.
Coordinated response from declaration and safe containment through endpoint triage, ransomware precursors, multi-host and identity scoping, evidence protection, eradication, and recovery validation. The final case separates facts, decisions, communication, and closure criteria.
From a forensic question and order of volatility through acquisition, integrity, file-system metadata, Windows artefacts, and memory to a defensible reconstruction. The module teaches how to separate a trace from its interpretation and document limitations, chain of custody, and negative results.
Control planes, identities, and APIs as the main cloud investigation axis. This module compares CloudTrail, Azure Activity Log, Microsoft Entra, and Google Cloud Audit Logs, then analyses permission changes, data access, workload identities, keys, cross-account activity, and safe containment and recovery.
From selecting a good automation candidate through playbook contracts, enrichment, idempotency, retries, deduplication, and human gates to secrets, audit, rollback, and measurement. The final case shows a Helios playbook that accelerates triage without automating an uncertain verdict.
Linux host telemetry from journald and authentication through processes, systemd, cron, Linux Audit, file integrity, sockets, and privilege controls to safe incident response. The final case reconstructs an SSH intrusion at Helios without turning a single trace into a verdict.
Defence from image and workload to the API server, RBAC, audit events, runtime, network, service accounts, secrets, and admission control. The module teaches how to correlate an ephemeral Pod identity with the control plane and plan response without destroying evidence or mistaking a restart for root-cause removal.
CTI as a process for answering decision requirements, not a collection of indicators. The module covers the intelligence cycle, source evaluation, confidence, bias, the IOC lifecycle, TTPs, STIX/TAXII, TLP 2.0, privacy, operationalisation, and measuring value for the SOC.
Safe analysis from the question and sample provenance through hashing, file format, strings, imports, and a sandbox report to packer limitations, IOC/TTP extraction, YARA, and response. The module never executes samples; it teaches defensible assessment from static artefacts and prepared behaviour reports.
From a reliable asset and software inventory through product matching, CVE, CWE, advisories, and CVSS 4.0 to EPSS, CISA KEV, reachability, compensating controls, SLAs, exceptions, and remediation verification. Priority follows real exposure and impact, not a scanner score alone.
Controlled validation from a question and threat-informed test plan through authority, guardrails, telemetry paths, analytic logic, and an evidence matrix to false-negative analysis, regression, and coverage. Purple Teaming is a shared learning loop, not a demonstration of offensive tools.
From detection requirements and data contracts through source onboarding, transport, buffering, parsing, OCSF/OTel normalization, time and enrichment to quality SLOs, retention, cost, privacy, and safe schema change. The module shows how to prove pipeline completeness instead of trusting an agent's status alone.
Application defence from an edge–proxy–application–identity–data telemetry map through request correlation, login and session abuse, BOLA and business logic to signals of injection, upload, SSRF, automation, and resource exhaustion. Response protects the service and evidence without treating every WAF alert as an incident.
Data-loss investigations from the question about protected information and potential harm through classification, entitlements, staging, network and cloud channels, removable media, email, and printing to privacy-aware insider risk, containment, and legal/HR coordination. Behaviour is a signal to examine, not proof of a person's intent.
From a code–build–artifact–deployment trust map through repositories, CI/CD identities, runner telemetry, dependencies, SBOM, provenance, and signatures to registry, secret, and build-runner compromise. Response reconstructs a trusted chain and proves a replacement artifact's origin instead of merely rerunning the pipeline.
Defending cyber-physical systems with process safety first: authority models, inventory, zones and conduits, passive protocol telemetry, HMIs, engineering workstations, historians, remote access, and process correlation. Containment and recovery are agreed with operators and engineers, never imposed by an IT SOC.
Monitoring an AI system as a complete dataflow: model, data, retrieval, prompt, policy, tools, memory, and actions. The module covers privacy-aware observability, prompt injection, excessive agency, model supply chains, RAG poisoning, data leakage, and response. Model content is untrusted input; deterministic controls outside the model authorize actions.
The path finale combines a SOC mandate and service catalogue, control ownership, case QA, value metrics, handover, capacity, and wellbeing with major-incident command, communications, tabletop exercises, and continuous improvement. The Helios capstone requires one timeline, explicit confidence, and a business decision spanning IT, cloud, OT, supply chain, and AI.
