Tiers

The analyst tier ladder

Three stages, in the order an analyst actually grows through them. Each one names what it covers and what you should be able to do at the end of it. Start at Tier 1 and work down the list.

1
Monitoring & Triage
Free to learnPro ranges
Read the telemetry, work the console, and take an alert from signal to a defensible call.
2
Incident Response
Free to learnPro ranges
Run a full intrusion end to end: reconstruct the chain, contain it, and report what happened.
3
Threat Hunting, Forensics & Malware
In development
Investigation and detection work that doesn't start from someone else's alert.

The TTP Catalog sits across all three stages rather than inside any one of them, and AI in Network Defense stands on its own outside the ladder.

The analyst tier ladder

Monitoring & Triage

Incident Response

Threat Hunting, Forensics & Malware