Unit 1: Standalone Topics
Each session stands on its own: one analysis topic per video. Watch them in any order.
Course Overview
A series of standalone sessions on how analysts really think: reading an intrusion as a story, building context, going after the indicators that hurt the attacker, and pivoting without getting lost.
Tools change every year; the way a good analyst thinks does not. Investigation & Analysis Insights is a series of standalone sessions, each on one idea that shapes how good analysts investigate. There is no fixed order: pick the topic you need and watch it on its own.
Topics so far:
Intrusion analysis as storytelling (a standalone live session): what an intrusion is, what analysis really means, and how to judge an intrusion the way a journalist judges a story.
Context development: what context is, why an alert means little without it, and how to build it on purpose.
The Pyramid of Pain: why blocking an IP barely slows an attacker, and how going after tools and TTPs forces them to change their whole operation.
Pivoting: how to pick your pivot point, tell a real pivot from noise, and use direct and inferred relationships between data to stay anchored to the evidence.
New topics join the series over time. Built for SOC analysts at every tier, threat hunters, DFIR and IR analysts, whatever tools your team uses.
A note on the recordings: these videos come from an earlier series, recorded before our current production setup, so the audio isn't up to the standard we hold ourselves to today. The content is still valuable, which is why we kept it. Every new course, and every new lesson added to this one, is recorded at the quality you should expect, in both sound and picture.
Before you start
- Basic SOC or blue team experience
- Comfortable reading logs and alerts
- Familiar with common attack techniques
Course Structure
Modules contain units, and each unit contains lessons, labs, and quizzes.
Instructor
Ahmed Thabit
Founder, threat detection & response lead
Ahmed leads threat detection and response engagements at an Egyptian security service provider. He started programming nine years ago, worked as a web developer, then moved into bug hunting and penetration testing before joining the SOC and MDR side, building experience across DFIR, threat intelligence, detection engineering, Windows internals and threat hunting along the way.
He started the academy to build the courses he needed when he started: the short way through the years he spent finding things out the long way.