CYBRARY Security operations course
Three units, nine modules. How an industrial site is divided into zones and how IEC 62443 talks about them, the order an intruder works in as ATT&CK names it, and how a SIEM turns raw log records into alerts and a case that can be closed. Every module ends with a check and a link to where the idea is done for real.
Unit 1 — Plant zones and conduits
How an industrial site is cut into zones, what a conduit is, and how IEC 62443 says out loud how well each zone must hold.
- Why a plant is cut into zones12 min
A flat network means one stolen laptop password can reach a controller. Zones exist so it cannot.
- Conduits: the only way across12 min
What a conduit is made of, what it must log, and how attackers use a legitimate one.
- Foundational requirements and security levels14 min
The seven things IEC 62443 asks of every zone, and the four-step scale for saying how hard a zone must be to beat.
Unit 2 — Attacker steps
The order an intruder works in, named the way ATT&CK names it, and what each step looks like on a machine you can open.
- The order an intruder works in12 min
Tactics are the why, techniques are the how. Getting the order right is what makes scoping possible.
- Techniques the range actually performs15 min
Every technique below is executed by a Forge scenario against a machine you can open — not a reading list.
- Turning steps into a timeline12 min
A breach timeline is the attacker's steps and your detections on one clock.
Unit 3 — SIEM alerts and cases
Where log records come from, how a rule turns one into an alert, how to tell a real one from a noisy one, and what the case must hold.
- From log record to alert13 min
Where records come from, what a rule is, and why the same rule behaves differently on two estates.
- Triage: true, false, or not yet known13 min
How to work an alert in a few minutes without either dismissing a breach or escalating noise.
- The case record, and closing it honestly12 min
What a case has to hold before it can close, and why the closing line is the valuable part.
The identifiers here — foundational requirement numbers, security levels, ATT&CK technique ids — are the published ones. The mapping between them and Forge content is ours, offered for planning, and is not an accreditation. Foundations covers the same ground with no identifiers at all.