This course is coming soon — content and pricing shown below may change before launch.
Coming SoonIntermediateNetwork Security12h of content · 2 guided labs750 XP

Network Security Intermediate

Advanced network analysis: encrypted traffic inspection, threat hunting, and custom IDS rule engineering with Suricata and Zeek.

Not on sale yet. Leave your email and we will tell you the day Network Security Intermediate opens — nothing else.

One email, only when it launches. No newsletter.

14-day money-back guarantee · No subscription · Lifetime access

Preview the student experience

No login · Free interactive demo

Try demo →

2

Guided labs

Isolated VM environment

12h

Of content

Labs + practice + exams + simulations

4

Modules

Progressive difficulty

2–4h

Per lab session

Unlimited restarts

HTKWhat's included
  • Full Intermediate course (video lessons + written content)
  • 2-4 guided labs — less guided, more complex than Beginner
  • Advanced per-module exams
  • HTK Intermediate certificate
  • Lifetime access, unlimited lab restarts
  • Expert instructor reviews your reports & assignments
159

One-time payment, no subscription

Notify me

Lab tools you will use

WiresharkNetworkNmapScannerSuricataIDS/IPSZeekNetworktcpdumpCaptureSnortIDS/IPSOpenVASScannerMetasploitExploitationWiresharkNetworkNmapScannerSuricataIDS/IPSZeekNetworktcpdumpCaptureSnortIDS/IPSOpenVASScannerMetasploitExploitation
Burp SuiteProxyNessusScannerSecurity OnionMonitoringWazuhSIEMntopngMonitoringNetworkMinerForensicsOSSECHIDSArgusFlow analysisBurp SuiteProxyNessusScannerSecurity OnionMonitoringWazuhSIEMntopngMonitoringNetworkMinerForensicsOSSECHIDSArgusFlow analysis

Before you start — quick answers

Not for beginner courses. They start from scratch with guided, step-by-step instructions.

Each lab session opens a 2–4 hour maximum VM session window. You can restart it as many times as you need — unlimited restarts are included with your purchase.

Yes. Unlimited restarts are included with your purchase. Practice as much as you want.

Yes. Your HTK certificate is issued upon completing the final lesson of the last module. Course progress is sequential — each lesson unlocks the next.

Course Syllabus

4 modules · 12h of content

Each phase maps to a module in this course. Scroll to see how the curriculum builds, module by module.

1

Module 1

Intermediate

Advanced Network Analysis & Threat Hunting

  • Encrypted traffic analysis: JA3/JA3S fingerprinting and TLS metadata
  • DNS tunneling and covert channel detection techniques
  • Network-based threat hunting: hypothesis-driven and indicator-based
  • Module exam
2

Module 2

Intermediate

Advanced IDS Engineering with Suricata

  • Complex Suricata rule writing: flowbits, thresholds, and lua scripting
  • Performance tuning: rule optimization and suppression strategies
  • Integration with SIEM: alert enrichment and correlation
  • Module exam
3

Module 3

Intermediate

Zeek Scripting & Network Forensics

  • Zeek scripting language: custom analyzers and detection scripts
  • File extraction and protocol analysis from network captures
  • Lateral movement detection: SMB, RDP, and WMI traffic patterns
  • Module exam
4

Module 4

Intermediate

Incident Report + Intermediate Certification

  • Comprehensive network incident report: timeline, kill chain mapping
  • Detection engineering recommendations and network hardening plan
  • HTK intermediate certification exam

What you will learn

  • Inspect encrypted traffic with JA3/JA3S fingerprinting and TLS metadata analysis
  • Detect DNS tunneling, covert channels, and lateral movement (SMB, RDP, WMI)
  • Engineer advanced Suricata rules (flowbits, thresholds, lua) and tune detection performance
  • Write custom Zeek scripts and analyzers, and extract files from network captures
  • Deliver a comprehensive incident report with kill-chain mapping and detection-engineering recommendations

Hands-on Lab

Analyze complex network incidents involving encrypted C2 channels, DNS tunneling, and lateral movement. Write advanced Suricata rules, perform Zeek scripting, and produce comprehensive incident reports with attack timelines.

2⬡ 2 guided labs
2–4hSession window
UnlimitedRestarts
AutoFlag validation
Experience a lab preview →

Requirements

  • ·Recommended: complete the HTK Network Security Beginner course first, or have equivalent hands-on traffic-analysis experience
  • ·Working knowledge of Wireshark, tcpdump, Suricata, and Zeek log analysis from beginner-level work
  • ·Familiarity with TCP/IP, common protocols (DNS, HTTP, TLS), and basic intrusion-detection concepts
  • ·Stable internet connection — the network security lab environment and all tools are fully pre-configured, no local setup required

Frequently Asked Questions

Complete answers about this course, labs, certificates, and refunds

Not for beginner courses. They start from scratch with guided, step-by-step instructions.

Each lab session opens a 2–4 hour maximum VM session window. You can restart it as many times as you need — unlimited restarts are included with your purchase.

Yes. Unlimited restarts are included with your purchase. Practice as much as you want.

Yes. Your HTK certificate is issued upon completing the final lesson of the last module. Course progress is sequential — each lesson unlocks the next.

Yes. 14-day money-back if lesson progress is below 20% and you have not completed the HTK certificate path (all lessons + labs) for that course. Details in our Refund Policy.

Yes. Once purchased, you have permanent access to all course materials and future updates.

Yes. All professional tools come pre-installed and configured in the VM, no local setup needed.

Most students complete the course in 2–4 weeks studying part-time. You set your own pace.

Start from the beginning?

Network Security Beginner

Not ready for intermediate yet? Network Security Beginner covers the foundational skills and guided labs you need before tackling the advanced material.

10h of content1 guided lab119
View Beginner Course →
Ready to level up?

Build real Network Security skills

Get hands-on with real Network Security scenarios, professional-grade tools, and validated flag objectives. No prior experience needed.

From159or 199 € for the complete path

Not on sale yet. Leave your email and we will tell you the day Network Security Intermediate opens — nothing else.

One email, only when it launches. No newsletter.

One-time payment, no recurring chargesLifetime access, course updates included14-day money-back guarantee