Learn. Investigate. Build.

What you will learn

• What cybersecurity is and why it matters.
• The CIA triad: confidentiality, integrity and availability.
• Security principles and security controls.
• Assets, threats, vulnerabilities and risks, and how they differ.
• Common cybersecurity terminology.
• Malware: ransomware, spyware, trojans and viruses.
• Phishing and social engineering.
• Password attacks and brute-force techniques.
• SQL injection and cross-site scripting.
• Attack vectors and common exploitation techniques, explained in theory.
• How computer networks work: network types and topologies.
• IP addressing and subnetting fundamentals.
• Ports and protocols, the TCP/IP model and the OSI model.
• DNS, HTTP and HTTPS.
• Firewalls, traffic filtering and access control, as concepts.
• Introduction to packet analysis.
• Windows operating system fundamentals.
• Linux fundamentals and command-line basics.
• Users, groups and permissions.
• File systems and access control.
• Basic system administration and system logs.
• Introduction to system hardening.
• Encryption and decryption, symmetric and asymmetric encryption.
• Hashing and digital signatures.
• Authentication and access management.
• Data protection and privacy principles.
• Introduction to cybersecurity risk management: identifying and assessing risks.
• Vulnerability management.
• Security policies and procedures.
• Cybersecurity career paths: SOC, GRC, penetration testing and ethical hacking, vulnerability assessment, application security, cloud security, digital forensics and incident response.

Hands-on

• Windows navigation and basic usage: desktop, files and folders, settings and basic system tools.
• Linux navigation and basic commands: moving around the file system and using the terminal.
• Network traffic capture and basic analysis with Wireshark.
• Basic vulnerability assessment.
• File integrity monitoring.
• System patching and updates.
• Introductory cryptography exercises.

What you will be able to do

• Explain fundamental cybersecurity concepts.
• Identify common cyber threats and vulnerabilities.
• Understand basic networking and operating system concepts.
• Use Windows and Linux confidently at a beginner level.
• Explain fundamental cryptographic techniques.
• Understand cybersecurity risk.
• Identify different cybersecurity career specialisations and make informed decisions about your next learning path.

What you will learn

• What cybersecurity is and why it matters.
• The CIA triad: confidentiality, integrity and availability.
• Security principles and security controls.
• Assets, threats, vulnerabilities and risks, and how they differ.
• Common cybersecurity terminology.
• Malware: ransomware, spyware, trojans and viruses.
• Phishing and social engineering.
• Password attacks and brute-force techniques.
• SQL injection and cross-site scripting.
• Attack vectors and common exploitation techniques, explained in theory.
• How computer networks work: network types and topologies.
• IP addressing and subnetting fundamentals.
• Ports and protocols, the TCP/IP model and the OSI model.
• DNS, HTTP and HTTPS.
• Firewalls, traffic filtering and access control, as concepts.
• Introduction to packet analysis.
• Windows operating system fundamentals.
• Linux fundamentals and command-line basics.
• Users, groups and permissions.
• File systems and access control.
• Basic system administration and system logs.
• Introduction to system hardening.
• Encryption and decryption, symmetric and asymmetric encryption.
• Hashing and digital signatures.
• Authentication and access management.
• Data protection and privacy principles.
• Introduction to cybersecurity risk management: identifying and assessing risks.
• Vulnerability management.
• Security policies and procedures.
• Cybersecurity career paths: SOC, GRC, penetration testing and ethical hacking, vulnerability assessment, application security, cloud security, digital forensics and incident response.
• How a SOC works: structure, responsibilities and Tier 1 and Tier 2 analyst work.
• Security monitoring, alert triage, prioritisation and severity.
• Incident escalation and the incident response lifecycle.
• Windows and Linux logs: event collection, analysis and correlation.
• Common attack indicators.
• Sysmon: detailed Windows event logs and endpoint telemetry.
• CrowdStrike Falcon: endpoint protection and EDR, investigating endpoint alerts and suspicious activity, and responding to endpoint threats.
• Windows Defender Firewall and pfSense: firewall log analysis, blocked connections, suspicious traffic and investigating firewall-related security events.
• Network security monitoring using firewall logs.
• Wazuh: log collection, endpoint monitoring and detection, vulnerability detection and alert investigation.
• Splunk Enterprise: Search Processing Language (SPL), searching machine-generated data, dashboards and detection use cases.
• Microsoft Sentinel (introduction): data connectors, introduction to Kusto Query Language (KQL), alert investigation and automated response.
• Threat intelligence: indicators of compromise, suspicious IP addresses, domains and file hashes, and threat intelligence platforms.
• MITRE ATT&CK: attacker tactics and techniques.
• Threat hunting: identifying suspicious patterns and behaviour.
• Incident investigation: suspicious logins, phishing emails, brute-force attacks, and endpoint and network cases.
• Evidence collection, incident severity, containment, remediation recommendations and professional incident documentation.
• Active Directory monitoring: domain controllers and users, authentication events, failed logins, suspicious account behaviour and common attack techniques.
• Attack simulation in the lab: how attacks generate security events and alerts.
• Detection rules and developing detection logic, mapped to MITRE ATT&CK.
• Shuffle: building security automation workflows and automated response.
• TheHive: creating and managing incident cases, observables, investigation workflows and incident tracking.

Hands-on

• Windows navigation and basic usage: desktop, files and folders, settings and basic system tools.
• Linux navigation and basic commands: moving around the file system and using the terminal.
• Network traffic capture and basic analysis with Wireshark.
• Basic vulnerability assessment.
• File integrity monitoring.
• System patching and updates.
• Introductory cryptography exercises.
• SIEM installation and configuration.
• SIEM investigation exercises.
• Security event and log analysis.
• Endpoint alert investigation.
• Firewall log analysis.
• Threat hunting exercises.
• Controlled attack simulation and detection exercises.
• Incident investigation reports.
• TheHive incident cases.
• Shuffle automation exercises.
• Remediation and security recommendations.

What you will be able to do

• Explain fundamental cybersecurity concepts.
• Identify common cyber threats and vulnerabilities.
• Understand basic networking and operating system concepts.
• Use Windows and Linux confidently at a beginner level.
• Explain fundamental cryptographic techniques.
• Understand cybersecurity risk.
• Identify different cybersecurity career specialisations and make informed decisions about your next learning path.
• Analyse security logs and events.
• Investigate suspicious activities and alerts.
• Work with SIEM, endpoint and firewall tools.
• Understand threat intelligence and threat hunting.
• Investigate simulated cyberattacks.
• Document and manage security incidents.
• Recommend appropriate remediation measures.
• Understand SOC workflows and security automation.
• Build practical skills for SOC analyst responsibilities.

What you will learn

• How a SOC works: structure, responsibilities and Tier 1 and Tier 2 analyst work.
• Security monitoring, alert triage, prioritisation and severity.
• Incident escalation and the incident response lifecycle.
• Windows and Linux logs: event collection, analysis and correlation.
• Common attack indicators.
• Sysmon: detailed Windows event logs and endpoint telemetry.
• CrowdStrike Falcon: endpoint protection and EDR, investigating endpoint alerts and suspicious activity, and responding to endpoint threats.
• Windows Defender Firewall and pfSense: firewall log analysis, blocked connections, suspicious traffic and investigating firewall-related security events.
• Network security monitoring using firewall logs.
• Wazuh: log collection, endpoint monitoring and detection, vulnerability detection and alert investigation.
• Splunk Enterprise: Search Processing Language (SPL), searching machine-generated data, dashboards and detection use cases.
• Microsoft Sentinel (introduction): data connectors, introduction to Kusto Query Language (KQL), alert investigation and automated response.
• Threat intelligence: indicators of compromise, suspicious IP addresses, domains and file hashes, and threat intelligence platforms.
• MITRE ATT&CK: attacker tactics and techniques.
• Threat hunting: identifying suspicious patterns and behaviour.
• Incident investigation: suspicious logins, phishing emails, brute-force attacks, and endpoint and network cases.
• Evidence collection, incident severity, containment, remediation recommendations and professional incident documentation.
• Active Directory monitoring: domain controllers and users, authentication events, failed logins, suspicious account behaviour and common attack techniques.
• Attack simulation in the lab: how attacks generate security events and alerts.
• Detection rules and developing detection logic, mapped to MITRE ATT&CK.
• Shuffle: building security automation workflows and automated response.
• TheHive: creating and managing incident cases, observables, investigation workflows and incident tracking.

Hands-on

• SIEM installation and configuration.
• SIEM investigation exercises.
• Security event and log analysis.
• Endpoint alert investigation.
• Firewall log analysis.
• Threat hunting exercises.
• Controlled attack simulation and detection exercises.
• Incident investigation reports.
• TheHive incident cases.
• Shuffle automation exercises.
• Remediation and security recommendations.

What you will be able to do

• Analyse security logs and events.
• Investigate suspicious activities and alerts.
• Work with SIEM, endpoint and firewall tools.
• Understand threat intelligence and threat hunting.
• Investigate simulated cyberattacks.
• Document and manage security incidents.
• Recommend appropriate remediation measures.
• Understand SOC workflows and security automation.
• Build practical skills for SOC analyst responsibilities.

What you will learn

• IAM fundamentals and the role of identity in cybersecurity.
• Identification, authentication, authorisation and access control.
• Role-Based Access Control (RBAC) and the principle of least privilege.
• Active Directory Domain Services (AD DS), domains, domain controllers and organisational units.
• User and group administration, permissions and Group Policy.
• Identity lifecycle management: onboarding, role changes and offboarding.
• Microsoft Entra ID and cloud identity management.
• Multi-Factor Authentication (MFA), Conditional Access and Privileged Access Management (PAM).
• Service accounts, privileged identities and identity security.
• Identity monitoring, auditing and investigation of suspicious authentication activities.

Hands-on

• Build and configure an Active Directory domain environment.
• Create and manage users, groups and organisational units.
• Join Windows client machines to a domain.
• Configure permissions, group memberships and Group Policy.
• Apply least privilege and role-based access.
• Simulate employee onboarding, role changes and offboarding.
• Create and manage cloud identities in Microsoft Entra ID.
• Explore MFA and Conditional Access where licensing permits.
• Review authentication logs and investigate suspicious sign-ins.
• Audit privileged accounts and document findings.

What you will be able to do

• Administer users, groups and access permissions.
• Apply identity security policies and access controls.
• Manage identities across on-premises and cloud environments.
• Identify suspicious identity activities and access-related risks.
• Perform basic IAM administration, auditing and investigation tasks.

What you will learn

Cybersecurity foundations for IAM

• Introduction to cybersecurity and why it matters.
• Security principles, including confidentiality, integrity and availability.
• Understanding assets, threats, vulnerabilities and risks.
• Common cyber threats, phishing, malware and password attacks.
• Basic networking concepts, IP addressing, ports and protocols.
• Introduction to Windows and Linux operating systems.
• User accounts, permissions and access control.
• Authentication, authorisation and the importance of protecting identities.

Identity and Access Management

• IAM fundamentals and identity security.
• Identification, authentication and authorisation.
• Access control models, RBAC and least privilege.
• Active Directory, domains, domain controllers and organisational units.
• User and group management.
• Permissions, access policies and Group Policy.
• Identity lifecycle management.
• Microsoft Entra ID and cloud identity.
• MFA, Conditional Access and privileged access concepts.
• Identity monitoring, auditing and common identity-related threats.

Hands-on

• Navigate Windows and Linux environments.
• Work with user accounts, groups and permissions.
• Build an Active Directory lab environment.
• Create and manage domain users and groups.
• Configure access permissions and Group Policy.
• Practise least privilege and role-based access.
• Simulate employee onboarding, role changes and offboarding.
• Create and manage identities in Microsoft Entra ID.
• Explore MFA and Conditional Access where licensing permits.
• Review authentication logs and investigate suspicious login activities.

What you will be able to do

• Understand essential cybersecurity concepts and how they relate to identity security.
• Create and manage users, groups and permissions.
• Administer basic Active Directory environments.
• Apply access control and identity security principles.
• Work with on-premises and cloud identity environments.
• Recognise and investigate basic identity-related security issues.

What you will learn

Cybersecurity foundations

• Introduction to cybersecurity and security principles.
• CIA triad, security controls and fundamental security concepts.
• Assets, threats, vulnerabilities and risk management.
• Common cyber threats, malware, phishing and attack techniques.
• Networking fundamentals, IP addressing, ports and protocols.
• Windows and Linux operating system fundamentals.
• User accounts, permissions and access control.
• Encryption, hashing and basic data protection concepts.

Security Operations Centre (SOC)

• SOC operations, roles and responsibilities.
• Security monitoring and log analysis.
• SIEM concepts and practical use of Wazuh, Splunk Enterprise and Microsoft Sentinel.
• Windows security events and Sysmon telemetry.
• Endpoint protection and investigation using CrowdStrike Falcon.
• Windows Defender Firewall and pfSense.
• Alert triage, investigation and incident response.
• Threat intelligence, threat hunting and MITRE ATT&CK.
• Active Directory security monitoring.
• Security incident documentation and reporting.
• SOAR concepts and workflow automation using Shuffle.
• Incident and case management using TheHive.

Identity and Access Management

• IAM fundamentals and identity security.
• Authentication, authorisation and access control.
• RBAC and least privilege.
• Active Directory administration and Group Policy.
• User and group management.
• Identity lifecycle management.
• Microsoft Entra ID and cloud identity.
• MFA, Conditional Access and privileged access concepts.
• Identity monitoring, auditing and investigation.
• Common identity attacks and suspicious authentication activities.

Hands-on

• Windows and Linux familiarisation exercises.
• Network traffic capture and basic analysis using Wireshark.
• Basic vulnerability assessment, file integrity monitoring and system patching.
• Introductory cryptography exercises.
• Install and configure SIEM platforms.
• Collect, analyse and investigate security logs.
• Investigate endpoint alerts and suspicious activities.
• Configure firewall rules and review relevant security logs.
• Perform threat-hunting and controlled attack-and-detection exercises.
• Investigate incidents and document findings using TheHive.
• Build basic automated security workflows using Shuffle.
• Build and administer an Active Directory environment.
• Manage users, groups, permissions and Group Policy.
• Practise identity lifecycle management and least privilege.
• Configure cloud identities and explore MFA in Microsoft Entra ID.
• Investigate suspicious sign-ins and identity-related security events.

What you will be able to do

• Apply foundational cybersecurity knowledge.
• Monitor and investigate security events using SIEM tools.
• Perform basic alert triage, threat investigation and incident documentation.
• Understand endpoint protection, firewall monitoring and security automation.
• Administer users, groups and access permissions.
• Work with Active Directory and cloud identity environments.
• Identify and investigate basic identity-related threats.
• Understand how SOC operations and IAM work together to protect an organisation.