RANGE CONTROL / PUBLIC ACCESS
Learn how networks work in plain language, then apply that foundation in a MacBook-first defensive practice range. Follow the packet, inspect authored evidence, make a safe decision, and explain it clearly.
SZ-001RANGE MAP / TRUST BOUNDARIES
Shift Zero never opens a shell. It stages the evidence, verifies submitted findings, and keeps the learner record on the MacBook.
OPERATION BOARD / ACTIVE CURRICULUM
The inventory moves from familiar support signals into incident timelines, endpoint telemetry, automation, and intelligence enrichment.
| Case | Operation | Lane | Level | Evidence | Shift | Output |
|---|---|---|---|---|---|---|
SZ-001 | Pressure at the SSH DoorTriage a burst of Linux authentication failures without mistaking normal administrator access for the incident. | SOC Analysis | foundation | 1 file | 25 min | authentication triage note |
SZ-002 | The Service Nobody DocumentedIdentify an undocumented web service and explain why its current configuration deserves attention. | Network Defense | foundation | 3 files | 25 min | service exposure assessment |
SZ-003 | Make the Log SpeakFinish a small Python parser that turns an application log into a reliable incident summary. | Security Automation | field | 2 files | 35 min | Python automation writeup |
SZ-004 | The Invoice That Changed DirectionTriage a suspicious invoice message using routing and authentication headers instead of appearance. | SOC Analysis | foundation | 1 file | 20 min | phishing triage report |
SZ-005 | The Portal That MovedResolve a disagreement between healthy DNS and one workstation's effective name resolution. | Network Defense | field | 4 files | 30 min | DNS incident note |
SZ-006 | Someone Found the Backups FolderSeparate routine health checks from forced browsing that reached an exposed backup file. | SOC Analysis | field | 1 file | 30 min | web incident timeline |
SZ-007 | The Cron Job Anyone Could RewriteTriage a Linux permission finding and separate a real escalation path from normal SUID inventory. | Network Defense | field | 2 files | 25 min | Linux hardening ticket |
SZ-008 | Eight Failures, One Loud SourceUse Python's CSV tools to summarize failed logins without losing successful events or double-counting rows. | Security Automation | field | 2 files | 35 min | identity triage script report |
SZ-009 | The Three-Layer Case FileFollow a safe chain of local clues through Base64, configuration text, and a ZIP archive. | Network Defense | field | 3 files | 30 min | local CTF walkthrough |
SZ-010 | From VPN Login to Case ExportCorrelate authentication and web activity into one defensible incident timeline. | SOC Analysis | analyst | 2 files | 45 min | SOC incident timeline |
SZ-011 | PowerShell After the Ticket ClosedTriage a PowerShell script-block event and connect it to the account and remote training host involved. | SOC Analysis | analyst | 2 files | 40 min | endpoint triage report |
SZ-012 | One Observable, Three SourcesCorroborate fictional observables across local telemetry and an offline enrichment export. | Threat Intelligence | analyst | 3 files | 45 min | IOC enrichment memo |
INVESTIGATION LOOP / STANDARD SHIFT
A shift has a clear exit. Finish the case, preserve the reasoning, schedule the recall, and close the console.
Start with a ticket, alert, or intelligence question written like work you would receive on shift.
Download authored logs, headers, scripts, and exports. Investigate them in your own terminal.
Commit to an answer. The private evaluator returns field-level pass or retry results without exposing the key.
Export a Markdown case record with the evidence, findings, containment decision, and any commands you recorded.
Bring cleared concepts back on a spaced schedule so the technique survives beyond one lab.
CASE OUTPUT / PORTABLE PROOF
The artifact captures the brief, evidence reviewed, learner findings, containment, assistance used, and any commands the learner recorded. It is readable Markdown, not a platform badge.
SZ-004.mdSTATUS: CLEARED# The Invoice That Changed Direction
$ grep -i "authentication-results" message-headers.txt
spf=fail dmarc=fail
# analyst note
The visible sender and authenticated identity do not align.ENGINEERING RECORD / PORTFOLIO NOTES
This MacBook edition is a ground-up rebuild by Eddie Perry. The design decisions are visible on purpose: local learning state, private answer checks, authored safe evidence, and no hidden command runner.
Shift Zero demonstrates investigation workflow, security-minded product decisions, and deliberate practice. It does not claim production incident experience, issue certificates, or hide simulated work behind inflated metrics.
CONSOLE READY / NEXT SHIFT