Start with one tool
Predict. Observe. Explain.
Read the lab instructions, name the question and predict the result before running anything. Work in short stages and keep your own notes separate from the supplied example.
The small local applications use fictional records and bind only to this computer's loopback address. Packet fixtures and sample Windows events are explicitly synthetic. The Windows collection exercise belongs in a disposable lab VM.
The Python utilities use the standard library. Wireshark, Burp Community, Snort 3 and Sysmon are separate tools with their own setup instructions. No real cloud account or external target is needed.
These pages publish the exercise materials and their checks. They do not claim that Jeremy has independently completed the tool workflows. A passing utility test is not a personal packet capture, a manual Burp session, a Snort alert or a Sysmon collection. Personal evidence can be added after the activity and explanation have been checked.
Build recall through use
Keep the reasoning when the example changes.
- Follow the worked example and explain each observation.
- Repeat with a short checklist and the answer closed.
- Change one meaningful condition and predict the difference.
- Complete an unfamiliar variant independently, using command help when needed.
- Give a short handover: evidence, conclusion, uncertainty and next check.
- Return on another day and again about a week later.
Record help used and what remains uncertain. Accurate reasoning and a repeatable result matter more than memorising flags or working quickly.