LFM-101 Linux for Security Operators
Linux internals from the security operator’s chair. Boot/init, kernel modules, systemd, journald, networking, hardening, and containers.
Preview the syllabus →Seven courses across the kill chain. Every technique paired with the Sysmon, Event ID, or Zeek signal that exposes it. Written by the practitioners who wrote the Field Manuals.
By Tim Bryant, author of the Purple Team Field Manual, Blue Team Field Manual, Red Team Field Manual, and the rest of the series — published on Amazon and read by thousands of operators.
Every offensive technique is taught next to the Sysmon, Security log, or Zeek signal that exposes it. Read the attack, recognize the alert.
Techniques cited by ATT&CK ID, Event IDs verified against current Windows/Linux/cloud telemetry, tools at their current released versions.
Benign-marker labs validate the path without payloads. Ethics acknowledgement gates the offensive tracks. Built for testers and defenders, not actors.
14-day money-back guarantee, no questions asked. Lifetime access, including updates.
$98 per course
$298 any 4 courses
$74.50 per course — save $94 vs. buying singles
$398 all 7 courses
$56.86 per course — save $288 vs. singles
Compare: CRTO is $399 for one 180-day course. SANS courses start at $5,000+. OSCP is $1,749 with a 90-day exam window. The complete Field Manual library is $398 with lifetime access.
Founding-cohort buyers receive lifetime access — meaning for as long as Field Manual Academy continues to operate as a service. When the hands-on lab range launches, the platform will move to a subscription model for new buyers; founding-cohort buyers keep their original lifetime terms with no additional charge. Access is provided as a service and cannot continue if the service ceases to exist. See terms of service for full details.
The Linux, Windows, and Python toolkit every operator and defender uses daily.
The full cyber kill chain, MITRE-mapped, with the defensive signal for every technique.
Detection & response along the reversed kill chain using the DCOA / 6 D’s framework.
Paired attack/detect across surfaces, plus how to build and run the program.
Seven courses, 102 modules. Every chapter ships with a knowledge-check quiz and feeds a stackable certificate.
Linux internals from the security operator’s chair. Boot/init, kernel modules, systemd, journald, networking, hardening, and containers.
Preview the syllabus →Windows internals for defenders and operators. PowerShell, registry, services, scheduled tasks, event logs, WMI/CIM, Sysinternals, GPO/AD client.
Preview the syllabus →Python as a security tool. Data model, files/IO, subprocess, argparse, dates, serialization, asyncio, logging, testing, packaging, networking, hashing.
Preview the syllabus →The full cyber kill chain from the operator’s chair, mapped to MITRE ATT&CK v19. Every technique paired with its defensive signal so you see both sides.
Preview the syllabus →Defensive work along the reversed kill chain using the DCOA / 6 D’s framework. Telemetry foundations, hunting, triage, IR as a running program.
Preview the syllabus →The paired-discipline capstone. Each technique walked attack-first, detect-second across Windows, Linux, cloud/identity, containers, network, modern C2, AI.
Preview the syllabus →How to operate a purple-team program. Business case, maturity, org design, hiring, engagement models, emulation, metrics, reporting, sustaining.
Preview the syllabus →Every module is a structured Book with Why this matters / How it works / Try it / Watch out for / Section summary scaffolding.
~10 curated questions per module, ≥80% to pass. Designed to test recall and recognition of detection signatures.
Pass the capstone quiz and your verifiable, branded certificate is delivered by email and on your profile.
Each course awards a portable Open Badge you can display on LinkedIn or in a credentialing wallet.
Coming soon. Each "Try it" prompt will launch into a sandboxed range over LTI 1.3 — your sanctioned playground.
Buy a course once, keep it forever including updates. We re-tag for ATT&CK and tooling versions twice a year.
Practitioners. Pen-testers and red-teamers building detection-aware tradecraft; defenders building attack-aware detection; purple-team leads building programs. Working professionals, not absolute beginners — the Foundations track is the entry point if you need to backfill OS or scripting fundamentals.
You should be comfortable on a terminal and have touched either Windows administration or Linux. The Foundations track is designed to take you from "shell user" to "competent operator." The 200- and 300-level courses assume Foundations or equivalent.
Those are certifications that gate on a hands-on exam. Field Manual Academy is the structured study material — the curriculum that prepares you for that level of role, organized around the manuals we already published. Pair us with whichever exam you want to write next.
The lab range launches into the LMS via LTI 1.3 once the sandboxed range build is complete. Master Series buyers get first access; track and single-course buyers get added as it stabilizes.
Yes. The same content underpins OSCP/CRTO/GPEN study material. You acknowledge our authorized-use clause at signup; all "Try it" exercises use benign markers (timestamps, lab canaries) that prove the path without firing real malware.
14-day money-back, no questions asked. Refund the charge in your Stripe receipt or email support@fieldmanualacademy.com.
It means for as long as Field Manual Academy continues to operate as a service. Founding-cohort buyers are grandfathered onto these original terms even after we move to a subscription model for new buyers (planned with the hands-on lab range launch). You won't be re-billed and you won't lose what you paid for. Access does not transfer between people and cannot continue if the service stops operating — see the next question.
Honest answer: access is provided as a service. If Field Manual Academy stops operating, ongoing access ends. We have no way to keep a Moodle instance running for you after that. If we ever wind down, we'll give 60 days notice and make every course's content downloadable as PDF + completion certificates exportable, so you keep the material and your earned credentials. The underlying Field Manual books are independently available on Amazon and won't be affected.
No. Founding-cohort buyers (anyone who buys before the lab range launches) are grandfathered onto lifetime terms at the price you paid. The subscription model applies only to new buyers post-lab-launch. You'll get an email confirming your grandfather status before any pricing change.
Create a free account, preview every syllabus, and enrol in the one that fits.