Track 9 of 12
Defence and monitoring
Know what normal looks like, then notice what does not.
Intermediate 5 lessons Prerequisite: Logs and detection from the security track, and cron from the shell track.
The defender's half of the course, done on a phone. You write down what normal is, watch the files that matter for a change, read logs as a story rather than line by line, make the device tell you when something moves, and walk the six phases of responding to a small incident calmly. Two ideas run through all of it: perfect security does not exist, and detection without a response achieves nothing.
By the end, you can baseline a device, notice a change, build a timeline from logs, and work an incident in order.
Lessons in this track
- 01 Baselines: writing down what normal is You cannot notice a change if you never wrote down what normal was.
- 02 File integrity: noticing a change A hash turns a whole file into one short line, and that line is enough to tell you it changed.
- 03 Reading logs for a story A log is a list of events, and a list of events is a story once you put it in order.
- 04 Alerting on your own device Detection you have to remember to perform is detection you will forget, so make the phone tell you.
- 05 Incident response, in six steps When something looks wrong, a calm order of steps beats a rush, and the last step is the one most people skip.