Windows Event IDs
Deck preview · Endpoint
Authentication, process creation, services, and account activity.
← All practice formats
Recall / Format preview
Defender flashcards
Review the high-signal concepts, event IDs, commands, ATT&CK techniques, and investigation patterns defenders use repeatedly.
This public page shows example topics, not an exercise. To work through published activities and save results, use an approved learner account.
Open learner practiceExample topics
What you can practice in this format.
These cards describe sample topics; they are not scored exercises on this public page.
MITRE ATT&CK
Deck preview · Detection
Techniques, telemetry, and practical detection opportunities.
AWS security services
Deck preview · Cloud
CloudTrail, GuardDuty, IAM, Config, and investigation context.
Skills you develop
Practice with a clear purpose.
- Recall high-value telemetry
- Recognize common techniques
- Review efficiently
- Strengthen investigation vocabulary
Find the training
Build the knowledge behind the exercise.
Explore the courses that teach the tools and investigation methods used in these practice formats.