Defence and hardening

61 courses, 909 lessons. A real Kali Linux lab in the browser.

System security fundamentals: UFW, sudoers (Level 101, 19 lessons): Hardening principles, patching and least privilege.
Windows security basics: accounts, UAC, Defender (Level 101, 14 lessons): You get to know a Windows computer’s security settings from scratch and learn to check local accounts, UAC, Microsoft Defender, the firewall and updates.
Endpoint protection basics: antivirus and EDR (Level 101, 14 lessons): You learn with examples how endpoint protection works, from signature-based antivirus to behaviour-based EDR, what it sees and what it misses.
Network defence basics: segments, firewalls, VPN (Level 101, 13 lessons): You draw an organisation’s network with a defender’s eye and learn with examples what firewalls, segmentation, VPNs and network monitoring do against which threats.
Log management basics: syslog and the Windows event log (Level 101, 14 lessons): You learn where logs come from, how they are formatted and why they are kept; you read Linux and Windows records, align time and find events with simple questions.
Introduction to vulnerability management: CVE, CVSS and patching (Level 101, 13 lessons): You learn how a vulnerability is found, named, scored and closed, and you find and patch known vulnerabilities on your own server.
Domain administration basics: users, groups, GPO (Level 101, 13 lessons): You learn from scratch to manage users, groups and organisational units in Active Directory, apply Group Policy and organise them along least-privilege lines.
Security monitoring basics: alerts, events, cases (Level 101, 13 lessons): You start without knowing what a security operations centre does and learn with simple examples the difference between events, alerts and cases, how to take a first look and how to ask the right question.
Linux server hardening: SSH, PAM, sysctl (Level 201, 20 lessons): You harden a freshly installed Linux server step by step, securing SSH, password and session policy, kernel network settings and mount options.
Windows server hardening: security policy, GPO, RDP, SMB (Level 201, 17 lessons): You harden a Windows server with local security policy and Group Policy, configuring RDP, SMB, legacy protocols and PowerShell logging securely.
Windows telemetry with Sysmon (Level 201, 17 lessons): You install and configure Sysmon, learn to read process, network, registry and file events, and make attack traces visible with a configuration that cuts noise.
Malware detection with ClamAV and YARA (Level 201, 15 lessons): You scan servers and file shares with ClamAV, write your own detection rules with YARA and set up regular scanning while weeding out false positives.
Firewalling with firewalld (Level 201, 17 lessons): Zones, services and rules.
Email security: SPF, DKIM, DMARC and phishing analysis (Level 201, 16 lessons): You set up email authentication for a domain with SPF, DKIM and DMARC, tell forged mail apart by reading headers and safely examine suspicious messages.
SOC fundamentals: SIEM, alert triage and playbooks (Level 201, 21 lessons): You collect logs with Wazuh and Elastic, triage and enrich alerts, respond with playbooks and hand over shifts properly.
SIEM with Wazuh: agents, rules, active response (Level 201, 16 lessons): You connect Linux and Windows agents to a Wazuh manager, write decoders and rules, enable integrity and vulnerability modules and block an attacking IP automatically with active response.
Introduction to detection engineering: Sigma rules (Level 201, 16 lessons): You learn to turn attack behaviour into a detection rule, write product-neutral rules with Sigma, convert them to different SIEM query languages and test them on real logs.
Introduction to threat hunting: hypothesis, data, ATT&CK (Level 201, 15 lessons): You learn to look for attacker traces without waiting for an alert: you form a hypothesis, choose the data to examine, interpret the results and turn findings into new detections.
Vulnerability management: Nikto, Nuclei, Exploit-DB (Level 201, 16 lessons): Scanning, prioritising and the fix cycle.
Network vulnerability scanning with OpenVAS (Level 201, 15 lessons): You scan a network with Greenbone/OpenVAS, compare authenticated and unauthenticated scans, interpret the results and set up a regular scanning programme that tracks fixes.
Patch management: Linux and Windows (Level 201, 15 lessons): You test, schedule, roll out in stages and if needed roll back patches on Linux and Windows, and prepare a fast track for emergency patches and a coverage report.
Active Directory security: auditing and hardening (Level 201, 22 lessons): You audit a Windows domain with a defender’s eye: you find privileged groups, forgotten and service accounts, the password policy, shares and traces of attacks, and report them with hardening advice.
Incident handling: from preparation to recovery (Level 201, 16 lessons): You learn the defence team’s steps in a security incident (preparation, detection, classification, containment, eradication, recovery and lessons learned) and apply each step to a small incident.
Scenario: your first week at Ardic Logistics (Level 201, 15 lessons): You start as the only security person at a small logistics company; over five days you build an inventory, close holes, switch on logging and respond to your first incident at the end of the week.
Auditing Linux against CIS benchmarks: Lynis, OpenSCAP (Level 301, 16 lessons): You learn how international security benchmarks are read, measure a server with Lynis and OpenSCAP, fix the findings and prove compliance.
Confining applications with AppArmor (Level 301, 16 lessons): You write AppArmor profiles that let a service reach only the files and capabilities it needs, test them in complain mode and move them to enforce mode.
SELinux administration (Level 301, 16 lessons): Contexts, policies and resolving denied accesses.
Windows security baselines: CIS and Microsoft benchmarks (Level 301, 15 lessons): You compare published Windows security baselines, measure current settings, close the gaps with GPOs and check for drift regularly.
Host security and auditing: AIDE, auditd (Level 301, 16 lessons): auditd, integrity checking and behaviour monitoring.
Endpoint visibility with osquery (Level 301, 15 lessons): You query the operating system like a database with SQL and regularly watch processes, listening ports, users and persistence points across the fleet.
Firewalling with nftables (Level 301, 16 lessons): You build tables, chains, sets and maps with nftables, Linux’s modern packet filtering framework, and write stateful firewalls for a server and a gateway.
Security analytics with Elastic: ECS, KQL, EQL, dashboards (Level 301, 16 lessons): You ingest security data into the Elastic Stack, map it to the common schema, write complex queries with KQL and EQL, and build detection rules and analyst dashboards.
Network-based detection with Suricata (Level 301, 16 lessons): You run Suricata as a network sensor, manage rulesets, write your own signatures, examine the EVE JSON output and block attacks in inline mode.
Network security monitoring with Zeek (Level 301, 15 lessons): You read the connection, DNS, HTTP, TLS and file records Zeek produces, analyse them with zeek-cut, write your own scripts and find suspicious behaviour that has no signature.
Network threat hunting: beaconing, DNS, unusual flows (Level 301, 15 lessons): You hunt command-and-control traffic, DNS tunnels and data exfiltration hiding in flow, DNS and TLS records, using statistics and intuition.
Endpoint threat hunting: persistence, process trees, legitimate tools (Level 301, 15 lessons): You search process, persistence and session data from Windows and Linux endpoints for attacker traces and tell legitimate admin work apart from abuse.
Risk-based prioritisation: CVSS v4, EPSS, KEV, SSVC (Level 301, 15 lessons): You learn to pick what really matters out of thousands of findings, deciding by combining scores, exploitation likelihood, actively exploited lists and asset importance.
Hardening Active Directory in practice (Level 301, 17 lessons): You actually close the problems an audit finds: shrinking privileged groups, applying tiered administration, rolling out LAPS and protected users, and removing legacy protocols and dangerous permissions.
Alert investigation practice: phishing, identity, endpoint, network (Level 301, 16 lessons): You solve realistic cases for each of the most common alert types, collecting evidence, setting the scope, making a call and writing a case note the next shift will understand.
Containment and eradication: network, accounts and hosts (Level 301, 15 lessons): You stop an attack while it spreads: network-level isolation, revoking accounts and sessions, cleaning up persistence and returning systems safely to service.
Scenario: ransomware night at Sedir Hospital (Level 301, 15 lessons): Starting from the first alert in a hospital’s SIEM on the night shift, you trace the attack, stop the spread, prioritise patient services and report to management in the morning.
Career capstone: SOC analyst (Level 301, 15 lessons): You live a SOC analyst’s week from start to finish, managing the alert queue, investigating cases, suggesting detections, handing over shifts and presenting the weekly report.
Kernel, boot and service isolation (Level 401, 15 lessons): You protect the boot chain and kernel that attackers use for persistence, isolate services with systemd and narrow system calls with seccomp.
Advanced Windows protection: AppLocker, WDAC, Credential Guard, ASR (Level 401, 16 lessons): You let only approved programs run with application control, protect credentials from being stolen from memory and roll out attack surface reduction rules.
EDR operations: collection, isolation and response with Velociraptor (Level 401, 14 lessons): You deploy Velociraptor clients to endpoints, collect evidence during an incident, isolate a suspicious machine and tune detections for your organisation.
Web application firewall: ModSecurity and OWASP CRS (Level 401, 13 lessons): You put ModSecurity and the OWASP Core Rule Set in front of a web application, tune false positives, write virtual patches and read attacks from WAF logs.
SIEM engineering: data model, correlation, capacity (Level 401, 13 lessons): You don’t just use a SIEM, you design it: deciding what data to collect, how to normalise it, and how to manage correlation rules and capacity.
Detecting Windows attacks (Level 401, 15 lessons): You study the traces real attack techniques leave in Windows and Sysmon logs and write tested detection rules for credential theft, lateral movement and persistence.
Detecting Linux attacks: auditd, Falco, eBPF (Level 401, 13 lessons): You catch web shells, persistence, privilege escalation and container escape attempts on Linux servers with auditd rules and Falco, using the visibility eBPF brings.
Intelligence-driven hunting: MISP, IOCs and TTPs (Level 401, 12 lessons): You collect threat intelligence, organise it in MISP, search your own data for indicators and attacker behaviours, and turn the results into shareable intelligence.
Running a vulnerability management programme: inventory, SLAs, exceptions, metrics (Level 401, 12 lessons): You move from one-off scans to a continuous programme, designing the asset inventory, ownership, remediation deadlines, exceptions and the metrics reported to management.
Detecting Active Directory attacks (Level 401, 13 lessons): You build detections that catch Kerberos, NTLM, replication, certificate and GPO abuse from domain controller logs and network traffic, and spot attackers early with decoy accounts.
Case management and SOAR: TheHive, Cortex, Shuffle (Level 401, 13 lessons): You send alerts into a case management system, automate enrichment and turn repetitive response steps into approved automation workflows.
Ransomware readiness and response (Level 401, 12 lessons): You learn the stages of a ransomware attack, make backups attack-resistant, watch for early warning signs and lead the response in a safe simulation.
Hardening a server fleet: Ansible, drift detection, compliance evidence (Level 501, 13 lessons): You bring dozens of servers to the same security baseline with Ansible, catch configuration drift and produce evidence an auditor can use, automatically.
Segmentation and zero trust architecture (Level 501, 12 lessons): You plan how to split a flat corporate network, make lateral movement harder with micro-segmentation and zero trust principles, and run the migration without downtime.
Detection as code: rule repository, tests and coverage (Level 501, 13 lessons): You manage detection rules like software: version control, review, automatic tests, validation with attack simulation and an ATT&CK coverage map that shows the gaps.
Long-haul hunting: tracing an intrusion campaign end to end (Level 501, 12 lessons): You trace an intrusion spread over weeks across several data sources, link every attacker step from initial access to exfiltration with evidence and present it to management.
Recovering a compromised domain (Level 501, 12 lessons): When an attacker has become domain admin, you determine the scope, clean up persistence, safely reset krbtgt and privileged accounts and, if needed, recover the forest from backup.
Building and running a SOC (Level 501, 12 lessons): You design a SOC from scratch: scope, use cases, shift patterns, metrics, maturity assessment and working with an external provider.
Career capstone: security engineer (Level 501, 12 lessons): As the security engineer of a mid-sized company you take responsibility for a quarter: assessing risk, running hardening, monitoring and vulnerability management projects and measuring the results.

Projects

Protect the clinic’s new server from day one (UFW, sudoers): On Lavinya Klinikleri’s new appointment server you open only the needed ports with UFW, narrow sudo rights per person, and hand over a checklist of what you did.
Make the law office’s Windows computer safe: At Sedirli Hukuk Bürosu you set up accounts, UAC and Defender on a new lawyer’s Windows computer and show the result in a before-and-after table.
Collect the school servers’ logs in one place: You gather the logs of two Gelincik Okulları servers on a central server with rsyslog and produce a daily report summarising failed login attempts.
Build a patch priority list and apply the first patches: You match Karaçam Mobilya’s server inventory against published CVEs, prepare a patch priority list by CVSS score, and apply the two most urgent patches.
Respond to a leaked API key: You respond to an API key accidentally published in a public repository by revoking it, reviewing its use, and writing steps to prevent a repeat.
Secure a publicly readable storage bucket: You find a storage bucket that anyone can read, lock down access, and confirm only authorised users can get in.
Repair a broken HTTPS deployment: You investigate a site that shows certificate errors, fix its HTTPS setup, and deliver it showing the browser no longer warns.
Close an exposed database port: You find a database port left open to the internet, close it with a firewall, and show it is no longer reachable from outside while the application still works.
Harden an application that uses Redis: You tighten the password, network access and permissions of an application using Redis, and show the improvement over the weak settings with a checklist.
Harden the jump server (SSH, PAM, sysctl): On the jump server Kuzeyyıldızı Kargo’s administrators connect through, you switch SSH to key login, set up account lockout with PAM, tighten sysctl settings and show the result with audit output.
Analyse the fake invoice email and protect the domain: You analyse the headers of a fake invoice email sent in Mercanköşk Otelcilik’s name, add SPF, DKIM and DMARC records to the lab domain, and show the forged message is now rejected.
Catch and block password guessing with Wazuh: You install Wazuh agents on two Turnalı Perakende servers, write a rule for repeated failed SSH logins, and turn on an active response that blocks the source automatically.
Detect unauthorized uploads with Suricata: You write a Suricata rule that notices unauthorised file uploads in network traffic, and show in your own lab that the alert fires at the right time.
Audit a server for tampering (AIDE, auditd): You confirm a suspected unauthorised change on a server with AIDE and auditd records and report what was changed and by whom.
Build a three-zone gateway with nftables: On the gateway separating Ayçiçeği Gıda’s office, server and guest networks you write the nftables rule set, add NAT and logging, and prove allowed and blocked flows with a test table.
Audit a server against CIS and raise its score: You audit Demirsu Enerji’s billing server with Lynis and OpenSCAP, fix the most important findings, and report the score change together with justified exceptions.
Confine the report service with an AppArmor profile: You write an AppArmor profile for Göktaşı Yazılım’s file-reading report service, test it in complain mode, switch it to enforce mode, and show the service can reach only its own directories.
Sweep servers for persistence with osquery: You write an osquery pack that queries scheduled jobs, services, authorised SSH keys and listening ports on three Mavikaya Lojistik servers, and collect the unexpected entries in a deviation report.
Rank scan results by risk and write a remediation plan: You scan Saklıvadi Üniversitesi’s lab network with OpenVAS, re-rank the findings with CVSS, EPSS and KEV data, and present a 30-day remediation plan.
Clean up privileges in the municipality’s domain: In Selvikent Belediyesi’s Active Directory you audit and fix privileged group memberships, unused accounts and a weak password policy, and document the changes in a hardening report.
Put a WAF in front of the booking site and tune false alarms: You place ModSecurity and the OWASP CRS in front of Mercanköşk Otelcilik’s booking application, remove false alarms with targeted exclusion rules, and justify the move to blocking mode with test results.
Roll out application control on branch computers: For Yelkovan Bankası’s branch computers you test AppLocker rules in audit mode, add ASR rules, and deliver an evidence-backed plan for moving to enforcement without breaking business applications.
Ransomware readiness drill: backup, isolation, recovery: For Ilgıntepe Tekstil’s production planning server you time a restore from backup, carry out the network isolation steps, and list the gaps in a readiness report.
Write rules that catch domain attacks from event logs: In prepared event logs from Yakamoz Telekom’s domain controller you find unusual ticket requests and directory replication traces, write detection rules that catch them, and measure the false alarm rate.
Normalise store logs and build a correlation: You map Turnalı Perakende’s till, VPN and server logs to the common field model (ECS) in Elastic and prepare a correlation rule joining the three sources plus a dashboard for the shift team.
Manage detections as code: repository, tests, coverage: You gather Göktaşı Yazılım’s scattered Sigma rules in a repository, write tests that run each rule against sample logs, build a check pipeline that stops a faulty rule, and produce an ATT&CK coverage map.
Harden a server fleet with Ansible and catch drift: You harden four Lodoskaya Denizcilik servers with one Ansible role, catch a manual change with a drift check, and prepare a compliance evidence pack for the auditor.
Design and build zero-trust access to admin panels: You move the admin panels on Demirsu Enerji’s flat network into their own zone, route access through a proxy that requires client certificates, and verify it with a policy table covering identity, device and network conditions.