All courses

Learn the attack and the detection that catches it — in the same module.

Seven courses across the kill chain. Every technique paired with the Sysmon, Event ID, or Zeek signal that exposes it. Written by the practitioners who wrote the Field Manuals.

By Tim Bryant, author of the Purple Team Field Manual, Blue Team Field Manual, Red Team Field Manual, and the rest of the series — published on Amazon and read by thousands of operators.

Pricing

14-day money-back guarantee, no questions asked. Lifetime access, including updates.

Single course

$98 per course

Any one of the 7 courses
Lifetime access + updates
Certificate + Open Badge on completion
14-day money-back guarantee

Get started

Value bundle

$298 any 4 courses

$74.50 per course — save $94 vs. buying singles

Pick any 4 of the 7 courses
Lifetime access + updates
Stackable track credentials on completion
Priority email support
14-day money-back guarantee

Pick your 4

Best value

Complete bundle

$398 all 7 courses

$56.86 per course — save $288 vs. singles

Every course, every track
Field Manual Master Series credential
First access to the hands-on lab range
Quarterly live office hours with the author
14-day money-back guarantee

Get the whole library

Compare: CRTO is $399 for one 180-day course. SANS courses start at $5,000+. OSCP is $1,749 with a 90-day exam window. The complete Field Manual library is $398 with lifetime access.

Founding-cohort buyers receive lifetime access — meaning for as long as Field Manual Academy continues to operate as a service. When the hands-on lab range launches, the platform will move to a subscription model for new buyers; founding-cohort buyers keep their original lifetime terms with no additional charge. Access is provided as a service and cannot continue if the service ceases to exist. See terms of service for full details.

Four tracks. Stackable certificates.

Foundations

Field Manual Operator: Foundations

The Linux, Windows, and Python toolkit every operator and defender uses daily.

LFM-101 Linux for Security Operators
WFM-101 Windows for Security Operators
PyFM-101 Python for Security Automation

Offensive

Field Manual Red Team Operator

The full cyber kill chain, MITRE-mapped, with the defensive signal for every technique.

RTH-201 Red Team Operations (Kill Chain)

Defensive

Field Manual Blue Team Analyst (DCOA)

Detection & response along the reversed kill chain using the DCOA / 6 D’s framework.

BTH-201 Blue Team Detection & Response

Purple Capstone

Field Manual Purple Team Lead

Paired attack/detect across surfaces, plus how to build and run the program.

PTFM-301 Purple Team Attack & Detect
PTOM-401 Building & Running a Purple Team Program

The catalog

Seven courses, 102 modules. Every chapter ships with a knowledge-check quiz and feeds a stackable certificate.

Foundations LFM-101

LFM-101 Linux for Security Operators

Linux internals from the security operator’s chair. Boot/init, kernel modules, systemd, journald, networking, hardening, and containers.

14 modules · ~46K words · 527 LMS pages

Preview the syllabus →

Foundations WFM-101

WFM-101 Windows for Security Operators

Windows internals for defenders and operators. PowerShell, registry, services, scheduled tasks, event logs, WMI/CIM, Sysinternals, GPO/AD client.

16 modules · ~78K words · 535 LMS pages

Preview the syllabus →

Foundations PyFM-101

PyFM-101 Python for Security Automation

Python as a security tool. Data model, files/IO, subprocess, argparse, dates, serialization, asyncio, logging, testing, packaging, networking, hashing.

20 modules · ~80K words · 419 LMS pages

Preview the syllabus →

Offensive RTH-201

RTH-201 Red Team Operations (Kill Chain)

The full cyber kill chain from the operator’s chair, mapped to MITRE ATT&CK v19. Every technique paired with its defensive signal so you see both sides.

11 modules · ~50K words · 192 LMS pages

Preview the syllabus →

Defensive BTH-201

BTH-201 Blue Team Detection & Response (DCOA)

Defensive work along the reversed kill chain using the DCOA / 6 D’s framework. Telemetry foundations, hunting, triage, IR as a running program.

10 modules · ~60K words · 304 LMS pages

Preview the syllabus →

Purple Capstone PTFM-301

PTFM-301 Purple Team Attack & Detect

The paired-discipline capstone. Each technique walked attack-first, detect-second across Windows, Linux, cloud/identity, containers, network, modern C2, AI.

9 modules · ~30K words · 184 LMS pages

Preview the syllabus →

Purple Capstone PTOM-401

PTOM-401 Building & Running a Purple Team Program

How to operate a purple-team program. Business case, maturity, org design, hiring, engagement models, emulation, metrics, reporting, sustaining.

22 modules · ~46K words · 332 LMS pages

Preview the syllabus →

What you get with every course

Self-paced reading

Every module is a structured Book with Why this matters / How it works / Try it / Watch out for / Section summary scaffolding.

Knowledge-check quizzes

~10 curated questions per module, ≥80% to pass. Designed to test recall and recognition of detection signatures.

Auto-issued certificates

Pass the capstone quiz and your verifiable, branded certificate is delivered by email and on your profile.

Open badges

Each course awards a portable Open Badge you can display on LinkedIn or in a credentialing wallet.

Hands-on lab range

Coming soon. Each "Try it" prompt will launch into a sandboxed range over LTI 1.3 — your sanctioned playground.

Lifetime access

Buy a course once, keep it forever including updates. We re-tag for ATT&CK and tooling versions twice a year.

Common questions

Who is this for?

Practitioners. Pen-testers and red-teamers building detection-aware tradecraft; defenders building attack-aware detection; purple-team leads building programs. Working professionals, not absolute beginners — the Foundations track is the entry point if you need to backfill OS or scripting fundamentals.

Do I need prior experience?

You should be comfortable on a terminal and have touched either Windows administration or Linux. The Foundations track is designed to take you from "shell user" to "competent operator." The 200- and 300-level courses assume Foundations or equivalent.

How is this different from OSCP, CRTP, CRTO, GCIH, GCFA?

Those are certifications that gate on a hands-on exam. Field Manual Academy is the structured study material — the curriculum that prepares you for that level of role, organized around the manuals we already published. Pair us with whichever exam you want to write next.

Will the hands-on labs be included?

The lab range launches into the LMS via LTI 1.3 once the sandboxed range build is complete. Master Series buyers get first access; track and single-course buyers get added as it stabilizes.

Is the offensive content legal to learn?

Yes. The same content underpins OSCP/CRTO/GPEN study material. You acknowledge our authorized-use clause at signup; all "Try it" exercises use benign markers (timestamps, lab canaries) that prove the path without firing real malware.

Refunds?

14-day money-back, no questions asked. Refund the charge in your Stripe receipt or email support@fieldmanualacademy.com.

What does "lifetime access" actually mean?

It means for as long as Field Manual Academy continues to operate as a service. Founding-cohort buyers are grandfathered onto these original terms even after we move to a subscription model for new buyers (planned with the hands-on lab range launch). You won't be re-billed and you won't lose what you paid for. Access does not transfer between people and cannot continue if the service stops operating — see the next question.

What if the site stops existing?

Honest answer: access is provided as a service. If Field Manual Academy stops operating, ongoing access ends. We have no way to keep a Moodle instance running for you after that. If we ever wind down, we'll give 60 days notice and make every course's content downloadable as PDF + completion certificates exportable, so you keep the material and your earned credentials. The underlying Field Manual books are independently available on Amazon and won't be affected.

Subscription model later — am I going to get re-charged?

No. Founding-cohort buyers (anyone who buys before the lab range launches) are grandfathered onto lifetime terms at the price you paid. The subscription model applies only to new buyers post-lab-launch. You'll get an email confirming your grandfather status before any pricing change.

Learn the attack and the detection that catches it — in the same module.

Paired by design

MITRE-mapped

Authorized-use first

Pricing

Single course

Value bundle

Complete bundle

Four tracks. Stackable certificates.

Field Manual Operator: Foundations

Field Manual Red Team Operator

Field Manual Blue Team Analyst (DCOA)

Field Manual Purple Team Lead

The catalog

LFM-101 Linux for Security Operators

WFM-101 Windows for Security Operators

PyFM-101 Python for Security Automation

RTH-201 Red Team Operations (Kill Chain)

BTH-201 Blue Team Detection & Response (DCOA)

PTFM-301 Purple Team Attack & Detect

PTOM-401 Building & Running a Purple Team Program

What you get with every course

Self-paced reading

Knowledge-check quizzes

Auto-issued certificates

Open badges

Hands-on lab range

Lifetime access

Common questions

Start with the course that matches what you do.

Field Manual Academy

Value Bundle — any 4 courses you pick

Complete Library Bundle — all 7 courses

WFM-101 Windows for Security Operators

RTH-201 Red Team Operations (Kill Chain)

PyFM-101 Python for Security Automation

PTOM-401 Building & Running a Purple Team Program

PTFM-301 Purple Team Attack & Detect

LFM-101 Linux for Security Operators

BTH-201 Blue Team Detection & Response (DCOA)