Zero to SOC · Free open lesson series
Seven lessons. You build a working SIEM in Python, generate real attacks against it, and catch them — every line of code runs right on each lesson page, in your browser. Nothing to download, nothing to install, nothing leaves your machine. One rule: no magic — you build the thing, so you understand the thing.
Lessons 1–6 are the detection arc; Lesson 7 opens the investigation arc.
ingest → parse → detect → alert
Lesson 2 · Detection arccorrelate events; baseline what's normal
Lesson 3 · Detection arcpivot the group-by key
Lesson 4 · Detection arcstretch the horizon; count occasions
Lesson 5 · Detection arcchain detectors — rules that read alerts
Lesson 6 · Detection arcweigh weak signals; sum the risk
Lesson 7 · Investigation arcinvestigate: pivot, timeline, blast radius