How the Book and Practical Course Work Together
Alerts to Answers uses two complementary forms of practice. Chapter Exercises are focused activities embedded in the chapter where a concept is introduced. Progressive Labs are larger, standalone investigations that build cumulatively across the course.
Progressive Lab numbers do not correspond directly to chapter numbers. A Progressive Lab may draw on several chapters, and a chapter may prepare students for several Progressive Labs. The PL-xx identifier makes that many-to-many relationship explicit and prevents a standalone lab such as PL-07 from being mistaken for the exercise associated only with Chapter 7.
Naming Convention
| Learning component | Format | Purpose |
|---|---|---|
| Chapter Exercise | Chapter Exercise 7.1 | Focused practice embedded in a chapter |
| Progressive Lab | Progressive Lab PL-07 | Standalone, cumulative course investigation |
| Supplemental Progressive Lab | Progressive Lab PL-00A | Optional or supporting investigation outside the main sequence |
Existing website routes and downloadable filenames may retain their historical lab-xx names for compatibility. The learner-facing title and course references use the PL-xx identifier.
Chapter-to-Lab Alignment
| Chapter | Primary Progressive Labs | How the Work Connects |
|---|---|---|
| Chapter 1 — Introduction to Security Operations Centers | PL-00, PL-01 | Validates the environment and introduces the analyst workflow and SOC operating context. |
| Chapter 2 — Understanding SIEM | PL-01, PL-02 | Applies SIEM navigation, event interpretation, configuration, and attack analysis. |
| Chapter 3 — Building the Wazuh SOC Laboratory | PL-00, PL-09 | Establishes the platform, validates telemetry, and develops systematic diagnostic skills. |
| Chapter 4 — Dashboard Navigation and Security Investigations | PL-01, PL-02, PL-03, PL-04 | Moves from dashboard orientation through structured investigation and ransomware analysis. |
| Chapter 5 — Detection Engineering | PL-05, PL-06, PL-07 | Builds endpoint rules, network signatures, and intelligence-backed detections. |
| Chapter 6 — Threat Hunting | PL-05, PL-06, PL-07, PL-08 | Uses endpoint, network, and threat-intelligence evidence for hypothesis-led hunting and correlation. |
| Chapter 7 — Digital Forensics and Incident Response | PL-04, PL-05, PL-06, PL-08 | Preserves, correlates, reconstructs, and communicates endpoint and network evidence. |
| Chapter 8 — Security Operations Automation | PL-07, PL-08 | Operationalizes intelligence and applies carefully validated automated response. |
| Chapter 9 — Operating the Platform | PL-00, PL-09 | Reinforces validation, maintenance, troubleshooting, and evidence-based platform operations. |
Progressive Lab Sequence
| Progressive Lab | Investigation | Course Role |
|---|---|---|
| PL-00 | Initial Testing and Validation | Establish a known-good, evidence-producing SOC environment. |
| PL-00A | EICAR, YARA, Microsoft Defender, and Wazuh Validation | Validate a safe malware-detection chain across complementary controls. |
| PL-01 | SIEM Familiarization | Learn the analyst interface and confirm end-to-end telemetry. |
| PL-02 | SIEM Configuration and Attack Analysis | Configure the SIEM and interpret controlled attack evidence. |
| PL-03 | Analyst Use-Case Walkthrough | Apply a repeatable qualification and escalation workflow. |
| PL-04 | Ransomware Investigation | Reconstruct a ransomware scenario from observable evidence. |
| PL-05 | Sysmon Investigation | Hunt endpoint behavior and create a durable Wazuh detection. |
| PL-06 | Emerging Threats Investigation | Investigate network behavior and build a Suricata signature. |
| PL-07 | Threat Intelligence Investigation | Enrich indicators, reach defensible verdicts, and operationalize confirmed intelligence. |
| PL-08 | Capstone Correlation | Correlate endpoint, network, and intelligence evidence into one incident narrative. |
| PL-09 | Diagnostic Challenge | Diagnose failures methodically and restore trustworthy platform operation. |
Recommended Progression
Complete PL-00 before the main sequence. PL-00A can be used immediately after PL-00 or before the first malware-focused investigation. Continue through PL-01 to PL-09 in order when the full course is taught. In shorter courses, instructors may select labs using the chapter-to-lab alignment table, provided that prerequisite environment validation and telemetry checks have been completed.
Within each chapter, complete the numbered Chapter Exercises when the related concept is introduced. These exercises reinforce individual skills; they do not replace the cumulative Progressive Labs.
Reading the Cross-References
Each chapter includes a Course Progression note identifying the Progressive Labs that prepare for or reinforce its material. Each Progressive Lab retains its own prerequisites and learning outcomes. When a chapter and lab are linked, the relationship indicates shared competencies—not a one-to-one numbering match.