Learning path · awards Tier 3 Analyst
Learn units comingPro rangesSpecializations
Tier 3 is where an analyst specializes, in one of four tracks: Detection Engineering, Threat Hunting, Forensics or Malware Analysis. Hunting goes past what an alert shows: starting from threat intelligence about an actor, establish whether there is an intrusion at all, and its full scope across hosts, accounts, time and data. Forensics and malware analysis are the evidence work: reconstructing what happened and what a binary did, well enough to stand behind the answer. Detection engineering turns what you find into detections that fire on their own.
Tier 3 Qualification
Sign in to see which investigations count toward Tier 3 qualification and how many you have passed.
The path
Work these in order. Every Learn page is free to read and needs no account; Learn pages you open are ticked in this browser only and do not count toward the path.
Required from Analyst Foundations and Incident Investigation: 16 cases
Tier 3 Analyst also requires every case on Analyst Foundations and Incident Investigation.
- First LightPractice
- ImpactPractice
- GhostwriterPractice
- SwiftPractice
- MagpiePractice
- SignetPractice
- WatchtowerPractice
- TollgatePractice
- DragnetPractice
- CuckooPractice
- TrailheadPractice
- UnderstudyAssessment
- Operation SilverfishPractice
- Operation NightjarPractice
- Operation PtarmiganPractice
- Operation LocustAssessment
- 01LearnHow a hunt works
- 02Case · Required · AssessmentLow Tide
What this path covers
- Scoping an intrusion across an enterprise's captured telemetry, starting from a threat intelligence report
- Host and memory forensics to reconstruct and defend a timeline of what happened
- Static and dynamic triage of a suspicious binary
- Building the detection that would have caught this
What you should be able to do
- Establish an intrusion's full scope from a threat intelligence lead: the hosts and accounts involved, when, what persisted, how it moved, what data it touched and whether data left
- Call what the evidence supports, and say inconclusive where the telemetry can't settle it
- Recover an attack timeline from host artifacts, and produce evidence that holds up to scrutiny
- Triage unknown malware safely and describe its behavior
- Turn a finding into a rule that fires on its own
Every technique these paths touch is written up in the TTP Catalog, which spans all three paths rather than belonging to any one of them.