Learning paths¶
The complete course is progressive, but not every learner needs every optional tool. Choose a path. Keep the relative order of the modules you do (do not reorder); skipped modules are deferred, not deleted. Do not skip safety or the foundation concepts. How defenders think is short and belongs on every path.
Hours for each path are only in the time table on the home page. This page says what each path includes.
| Path | Complete | Skip or defer |
|---|---|---|
| Guided beginner | onboarding, modules 1–17, one capstone | optional kind, packet capture, scanners, LLM |
| Standard engineer | modules 1–17 and one capstone | only hardware-heavy options |
| Architecture focus | 1, 3–7, 8–9, 11–13; threat model + review. Skim how defenders think. Defer 14–17. | deep SOC queues |
| Detection/SOC focus | 1–4, 7–12, plus 16 before 17; incident capstone artifacts. Read how defenders think before module 7. Module 5 is the metadata hole and does not name DET-003. Module 10 triages DET-003:alice. Module 11 is where you author more rules (the worked example is DET-001). Defer 14–15. |
optional Kubernetes |
| Preview | onboarding, each module's Visual overview, module summaries, knowledge checks | runnable labs and capstone |
Capstone choice¶
Choose the defensive platform for SOC operations, or the Python vulnerability scanner for application security automation: inventory, focused validation, connected paths, and repair verification. The scanner assumes proficient Python and uses no LLM. Scanner hours are 25–35. Platform hours are 12–20 if you kept the module work, or 25–30 from a cold start. Both figures are in the time table. Doing both capstones adds the scanner’s 25–35 hours. Its course-knowledge map lists the modules it needs and which are optional. The platform capstone has the same map in How to work through.
Recommended beginner rhythm¶
For each module, budget:
- 20 minutes for the visual mental model;
- 45–75 minutes for key concepts;
- 60–120 minutes for the lab;
- 20 minutes for the knowledge check and engineering decision;
- a break before introducing the next layer.
Pause after Modules 3, 6, and 11 for a synthesis exercise. Explain the whole Acme Notes request path without notes and add the new identities, controls, and evidence sources you have learned.
Required versus optional¶
Core labs use the Compose stack, Python, and curl. Anything labeled optional is an enrichment, not a hidden prerequisite. In particular:
- packet capture is optional; application and container logs are sufficient;
- kind/k3d and Kubernetes tools are optional;
- Trivy/Grype are optional;
- hosted or local LLM use is optional—the agent has a deterministic mode;
- a commercial SIEM, EDR, NDR, or SOAR is never required.