Courses

Free online courses, built around the jon.glass tools and practice cases. No accounts, nothing to install, and everything runs in your browser.

SOC Operations: From Alert to After-Action

How a security operations center actually works, from the alert arriving to the after-action review. Triage, Windows event logs, timelines, network and identity evidence, file triage and indicators, containment, playbooks and reporting, all on one intrusion you work from start to finish.

Level: new and aspiring SOC analysts · Length: six weeks, twelve lessons · See the course

Agentic SOC Operations (planned)

A separate course on security operations with AI agents in the loop: what to hand to an agent, what to check, and how to run a SOC where some of the analysts aren’t people. It doesn’t depend on the SOC Operations course; take either one on its own.

Advanced DFIR Wizard Master Class

Windows forensics in depth: remote administration and acquisition for incident responders, files of forensic interest, the value of unstructured analysis, and evidence of execution.