MODULE 1
Endpoint Records Describe Activity, Not Motive
Use host relationships without turning parentage, tool names, or sensor output into unsupported causality.
FREE COURSE / SELF-PACED LEARNING
Endpoint, Network, and Exfiltration Reasoning
Connect endpoint, identity and network evidence to assess possible exfiltration without overstating encrypted traffic in this free course.
Read freely. Create an account to save your completed lessons.
- Experience level
- Advanced
- Curriculum
- 3 modules · 3 lessons
- Estimated reading
- 10 min
- Language
- English
Reading estimates use lesson text and an allowance for diagrams. Reflection, exercises and optional linked resources take additional time. These are estimates, not measured completion times.
KNOW WHAT YOU’RE WORKING TOWARD
What you’ll learn
- Correlate endpoint activity and network observations without assuming they establish motive.
- Identify the additional evidence needed to bound a suspected data-exfiltration chain.
Is this the right course for you?
Who it’s for
Analysts connecting host observations with network and data-movement evidence.
Scope and boundaries
Cross-source analytical reasoning. This course explains evidence limits rather than providing a packet-capture or endpoint-tool lab.
How you’ll learn
Self-paced reading with explanatory diagrams and linked resources. Reflection and optional resource study take additional time.
Before you begin
- Detection Engineering: From Telemetry to Tuned Detections — You should understand the basic detection lifecycle and common telemetry sources.
About this course
Connect host, identity, network, data-access, staging, and transfer evidence while remaining honest about causality and encrypted content. The course is written for one reader and develops its ideas through continuous explanation, realistic thought experiments, and explicit distinctions between fact, assessment, and uncertainty.
TRY THE REASONING / FICTIONAL SCENARIO
A large encrypted transfer
An endpoint record shows a document archive being created. A network sensor later records a large encrypted connection from the same host, but it has no process attribution or payload visibility.
Your task
Write the strongest supported relationship and the evidence still needed to claim that the archive left the organization.
Compare your reasoning
The records support a temporal association on one host. They do not prove that the connection carried that archive. Seek authorized process-to-connection attribution, application or destination receipts, and data-access context. Preserve clock differences and alternative explanations such as a backup. State the suspected chain as a hypothesis until discriminating evidence connects its steps.
This example is a reflection exercise, not a scored assessment.
FOLLOW THE LEARNING PATH
Course curriculum
MODULE 2
Encrypted Networks Still Leave Bounded Evidence
Reason from flows, DNS, TLS, timing, and endpoint context without pretending to see encrypted content.
MODULE 3
Exfiltration Is a Chain Before It Is a Transfer
Follow sensitive information from access through preparation and transfer without relying on one volume threshold.
BUILD ON THE RIGHT FOUNDATION
Related learning paths
These courses address different scopes. Choose the foundation or follow-on that fits your next question.
Sources and editorial review
Reviewed by Threat Intelligence Lab
Sources linked in the lessons provide context and further reading. Check the original documentation for current platform behavior and requirements.
Selected references are shown here; the lessons contain the full reading lists.
About this learning content: Courses, lessons, assessments, explanations and illustrations may be created with the help of artificial intelligence. We review and check the material and do our best to avoid incorrect or outdated information, but mistakes, omissions or ambiguous questions may remain. Please verify information before relying on it for professional, security, legal or operational decisions. Read the full notice or report an issue.