These rooms cover the tools and concepts I use at work. Built for people who want to understand what's happening under the hood — not just pass an exam.
How to build a detection pipeline that actually catches things. Full Wazuh + Elastic setup, detection logic from scratch.
Windows is the dominant target in most environments. This room covers the internals you need to understand to defend it.
Servers run Linux. Attacker tooling runs on Linux. Most detection gaps I've seen are on systems people assumed were safe.
Most attacks move over a network. If you don't understand the protocols, you'll miss the indicators.