Learning path · awards Tier 2 Analyst
Free to learnPro rangesIncident Investigation
Where triage becomes response. A single alert is rarely the whole story, and this stage is about reconstructing the intrusion behind it across hosts and time, deciding what to contain first, and telling the full story of what happened once it's over.
Tier 2 Qualification
Sign in to see which investigations count toward Tier 2 qualification and how many you have passed.
The path
Work these in order. Every Learn page is free to read and needs no account; Learn pages you open are ticked in this browser only and do not count toward the path.
Required from Analyst Foundations: 12 cases
Tier 2 Analyst also requires every case on Analyst Foundations.
- First LightPractice
- ImpactPractice
- GhostwriterPractice
- SwiftPractice
- MagpiePractice
- SignetPractice
- WatchtowerPractice
- TollgatePractice
- DragnetPractice
- CuckooPractice
- TrailheadPractice
- UnderstudyAssessment
- 01LearnIncident Response
- 02LearnScoping and Timelines
- 03Case · Required · PracticeOperation Silverfish
- 04Case · Required · PracticeOperation Nightjar
- 05Case · Required · PracticeOperation Ptarmigan
- 06Case · Required · AssessmentOperation Locust
What this path covers
- The incident lifecycle: detection, triage, containment, eradication, recovery
- Reconstructing a multi-stage intrusion from scattered telemetry
- Deciding containment order under time pressure
What you should be able to do
- Pivot across hosts and log sources to rebuild an attack chain
- Identify patient zero and the blast radius around it
- Prioritize containment when everything looks urgent
Every technique these paths touch is written up in the TTP Catalog, which spans all three paths rather than belonging to any one of them.