Each phase maps to a module in this course. Scroll to see how the curriculum builds, module by module.
1First steps
- •What Python is and why analysts use it
- •Variables and types, explained with the data you will actually handle
- •print, strings and the methods that clean them up
- •Exercise: normalise a list of indicators of compromise
- •Module quiz and flag
2Deciding and repeating
- •if, elif and else: turning a rule into code
- •Lists and the for loop
- •while, and how to avoid an infinite loop
- •Exercise: walk an authentication log line by line
- •Module quiz and flag
3Dictionaries and functions
- •Dictionaries: counting things by key
- •Top-N: which IP address tried the most
- •Functions you can reuse from one case to the next
- •hashlib: computing the hash of a sample
- •Pro: HTK Python Lab with graded challenges
- •Module quiz and flag
4Files and the standard library
- •Opening and reading files
- •csv and json: the formats security tools export
- •Regular expressions with re to extract IPs, domains and hashes
- •datetime: putting events in order
- •Module quiz and flag
5Automating the analyst's work
- •base64 and decoding an obfuscated command
- •From loose lines of code to a script you can reuse
- •Good habits: names, comments and errors that explain themselves
- •Final assignment: a triage script that summarises an incident
- •Module quiz and flag