Security resources
Browse practical reminders for alert triage, Windows logs, detection reviews, and AWS investigations. Use them alongside—not instead of—guided training.
Each reference is designed to prompt the next useful question during an investigation or detection review.
A repeatable sequence for validating an alert, establishing scope, collecting evidence, and recording escalation decisions.
A compact investigation map for authentication, process creation, services, scheduled tasks, and account activity.
Questions to answer before releasing or tuning behavioral detection logic.
High-signal questions for CloudTrail, IAM, GuardDuty, and EC2 investigations.
The flagship programs turn these reference points into guided investigations, detections, hunts, and reports.