Coming soon. This course is planned; lessons and labs are not available yet. No release date has been announced.
Investigate host exposure and access using bounded evidence, make a least-privilege change and check intended behavior still works.
Intermediate ยท Host exposure and evidence
Know Linux accounts, files, services, network ports and basic logs. Be able to inspect an intended client request and distinguish allowed from unintended access.
The planned project asks you to locate an unintended host exposure, preserve the evidence, make a bounded correction and prove legitimate access remains.
One Linux host and a scoped incident; enterprise identity design and compliance certification are separate.
3 planned chapters and 6 lesson outlines.
State which identities and network paths should reach the service before changing policy.
Planned task: List service identities, listeners, files and expected client paths.
Changed case to investigate: A new service account shares a role; distinguish a real dependency from excess access.
Planned task: Compare listener, route and firewall evidence to the intended boundary.
Changed case to investigate: A management port becomes reachable from a second subnet; identify the narrowest correction.
Use logs and host-state queries without treating missing records as proof of safety.
Planned task: Inspect relevant Linux Audit records with timestamps and source context.
Changed case to investigate: Audit collection was disabled during part of the event; state what cannot be concluded.
Planned task: Use an osquery result and direct system inspection to test a suspected exposure.
Changed case to investigate: A query returns no rows because a table or collection path is unavailable; investigate the gap.
Change one control, preserve intended access, and check for regression.
Planned task: Apply a scoped permission, service or firewall correction with a recovery path.
Changed case to investigate: The restriction also blocks an authorized client; refine the rule rather than disabling it.
Planned task: Limit a second affected endpoint, retain evidence and test legitimate behavior after remediation.
Changed case to investigate: A related host may be involved but lacks the same logs; report uncertainty and the next safe check.