Skip to content
Sign In
← Learning Paths

Learning path · awards Tier 1 Analyst

Free to learnPro ranges

Analyst Foundations

The entry stage. Before anyone can respond to an incident they have to be able to see one: what the environment normally looks like, what an attack does to it, and how to work the tooling a SOC actually sits in front of all day. Every page of the material is free to read and needs no account; the ranges that put it into practice need a plan, like every other range.

Tier 1 Qualification

Sign in to see which investigations count toward Tier 1 qualification and how many you have passed.

The path

Work these in order. Every Learn page is free to read and needs no account; Learn pages you open are ticked in this browser only and do not count toward the path.

  1. 01LearnFoundationsStart hereStarts free, no account needed. Follow the path in order from here.
  2. 02LearnHow Our Ranges Work
  3. 03LearnNetworking for Investigators
  4. 04LearnReading the Telemetry
  5. 05LearnOne Schema for Every Source
  6. 06LearnSearching with KQL
  7. 07LearnTriaging an Alert
  8. 08LearnThinking in MITRE ATT&CK
  9. 09LearnYour First Investigation
  10. 10LearnDetections and Objectives
  11. 11LearnPractice: The Expired Certificate
  12. 12Case · Required · PracticeFirst Light
  13. 13Case · Required · PracticeImpact
  14. 14Case · Required · PracticeGhostwriter
  15. 15Case · Required · PracticeSwift
  16. 16Case · Required · PracticeMagpie
  17. 17Case · Required · PracticeSignet
  18. 18Case · Required · PracticeWatchtower
  19. 19LearnTracing an Email
  20. 20LearnEmail Telemetry in Microsoft 365
  21. 21Case · Required · PracticeTollgate
  22. 22Case · Required · PracticeDragnet
  23. 23Case · Required · PracticeCuckoo
  24. 24Case · Required · PracticeTrailhead
  25. 25Case · Required · AssessmentUnderstudy

What this path covers

  • Core security concepts and the vocabulary of detection and response
  • MITRE ATT&CK as the map of how adversaries actually operate
  • What a live range is and how a session becomes a graded result
  • Reading raw logs and events, and knowing which fields to trust
  • Working Elastic Security: searching, querying, and using the dashboards
  • Taking a single alert end to end, from first signal to written conclusion

What you should be able to do

  • Recognize normal versus suspicious in real telemetry
  • Navigate a SIEM without a runbook holding your hand
  • Map observed activity to an ATT&CK technique
  • Write up a finding someone else can act on

Every technique these paths touch is written up in the TTP Catalog, which spans all three paths rather than belonging to any one of them.