Learning Path

How to grow from "I can use Splunk" to someone who can read a packet and understand the attack, explain what Windows and Linux are doing internally, reproduce attacker behaviour in a lab, find the endpoint and network evidence, analyse the malware, and write the detection. That combination is what senior threat hunters, DFIR analysts, malware analysts and red teamers have in common.

Page	Use it for
Roadmap	The order to learn things in, and why — eight pillars from fundamentals to detection engineering
Purple-team weekly loop	The study method: one ATT&CK technique per week, attack → artifacts → query → note. Fully worked example for T1059 (PowerShell)
24-month curriculum	Month-by-month plan with goals and checkpoints
Training resources	Free and paid labs, courses and books, grouped by pillar

The one-sentence version

Depth beats breadth: learn networks → Windows internals & Active Directory → offensive techniques → malware & reverse engineering → detection engineering, and study every attack together with its detection.