{"permissions":{},"commerce":{"user_subscriptions":null,"subscription_plans":[{"id":234,"image":"https://cdn.filestackcontent.com/YSrnUha1Sna9l92OqDHi","school":5379,"page_body":"

The AND Skills Vault includes a collection of standalone lessons from AND course authors and contributors that will help you improve your forensic and analysis skills. New lessons are added monthly. An active subscription also retains access to any full length courses you've purchased and ensures you will receive course updates for as long as your subscription is active. Start or stop your subscription any time. For full details and an FAQ, see Networkdefense.co.\r\n

","giftable_cycles":"","name":"AND Skills Vault Monthly Subscription","amount":20.0,"plan":{"id":365,"amount":20.0,"interval":5,"trial_period_days":0,"trial_type":5},"resources_count":0,"url":"https://www.networkdefense.io/subscribe/","currency_display":"$20","currency_display_per_month":"$20","currency_display_giftable_cycles":{}},{"id":233,"image":"https://cdn.filestackcontent.com/YSrnUha1Sna9l92OqDHi","school":5379,"page_body":"

","giftable_cycles":"","name":"AND Skills Vault Yearly Subscription","amount":220.0,"plan":{"id":364,"amount":220.0,"interval":10,"trial_period_days":0,"trial_type":5},"resources_count":0,"url":"https://www.networkdefense.io/subscribe/","currency_display":"$220","currency_display_per_month":"$18.33","currency_display_giftable_cycles":{}}],"global_tracking_code":"","conversion_tracking_code":"\r\n<script src="//platform.twitter.com/oct.js" type="text/javascript"></script>\r\n<script type="text/javascript">twttr.conversion.trackPid('nxgvm', { tw_sale_amount: 0, tw_order_quantity: 0 });</script>\r\n<noscript>\r\n<img height="1" width="1" style="display:none;" alt="" src="https://analytics.twitter.com/i/adsct?txn_id=nxgvm&p_id=Twitter&tw_sale_amount=0&tw_order_quantity=0" />\r\n<img height="1" width="1" style="display:none;" alt="" src="//t.co/i/adsct?txn_id=nxgvm&p_id=Twitter&tw_sale_amount=0&tw_order_quantity=0" />\r\n</noscript>\r\n\r\n\r\n\r\n\r\n\r\n\r\n<script>\r\n gtag('event', 'conversion', {\r\n 'send_to': 'AW-779065575/jLMdCKTdhI8BEOexvvMC',\r\n 'transaction_id': ''\r\n });\r\n</script>","payment_requires_zip_code":false,"currency_code":"usd"},"media":{"image":"https://pathwright.imgix.net/https%3A%2F%2Fcdn.filestackcontent.com%2Fapi%2Ffile%2FHPn6zYkRHSqgbWxVJ237%3Fsignature%3D888b9ea3eb997a4d59215bfbe2983c636df3c7da0ff8c6f85811ff74c8982e34%26policy%3DeyJjYWxsIjogWyJyZWFkIiwgInN0YXQiLCAiY29udmVydCJdLCAiZXhwaXJ5IjogNDYyMDM3NzAzMX0%253D?fit=crop&ixlib=python-1.1.0&w=500&s=67714604a0a4dd036627a0b24d864157","thumb":"https://pathwright.imgix.net/https%3A%2F%2Fcdn.filestackcontent.com%2Fapi%2Ffile%2FHPn6zYkRHSqgbWxVJ237%3Fsignature%3D888b9ea3eb997a4d59215bfbe2983c636df3c7da0ff8c6f85811ff74c8982e34%26policy%3DeyJjYWxsIjogWyJyZWFkIiwgInN0YXQiLCAiY29udmVydCJdLCAiZXhwaXJ5IjogNDYyMDM3NzAzMX0%253D?fit=crop&h=250&ixlib=python-1.1.0&w=250&s=dd186d13312ece08824791a21b8f85ac","logo":"https://pathwright.imgix.net/https%3A%2F%2Fcdn.filestackcontent.com%2Fapi%2Ffile%2FVKNMnAbVRN2MnGP7T3el%3Fsignature%3D888b9ea3eb997a4d59215bfbe2983c636df3c7da0ff8c6f85811ff74c8982e34%26policy%3DeyJjYWxsIjogWyJyZWFkIiwgInN0YXQiLCAiY29udmVydCJdLCAiZXhwaXJ5IjogNDYyMDM3NzAzMX0%253D?fit=max&h=200&ixlib=python-1.1.0&w=600&s=7c723bb7aae5568e9780e3f7f30305ca","url":"//d1do9mm1n6degf.cloudfront.net/","theme":{"id":283,"name":"Applied Network Defense - 7600","description":"","primary_color":"0d71fb","background_image":"https://pathwright.imgix.net/https%3A%2F%2Fcdn.filestackcontent.com%2Fapi%2Ffile%2FB8TQJqo9RoOCyIQVKYNa%3Fsignature%3D888b9ea3eb997a4d59215bfbe2983c636df3c7da0ff8c6f85811ff74c8982e34%26policy%3DeyJjYWxsIjogWyJyZWFkIiwgInN0YXQiLCAiY29udmVydCJdLCAiZXhwaXJ5IjogNDYyMDM3NzAzMX0%253D?fit=max&ixlib=python-1.1.0&w=1400&s=cb76712ea91191b11d11e186e7c71b3d","heading_font":"","typekit_id":"","custom_css":"","processed_custom_css":"","theme_css_url":null,"typekit_scripts":null,"background_image_blurred_cdn":"https://pathwright.imgix.net/https%3A%2F%2Fcdn.filestackcontent.com%2Fapi%2Ffile%2FB8TQJqo9RoOCyIQVKYNa%3Fsignature%3D888b9ea3eb997a4d59215bfbe2983c636df3c7da0ff8c6f85811ff74c8982e34%26policy%3DeyJjYWxsIjogWyJyZWFkIiwgInN0YXQiLCAiY29udmVydCJdLCAiZXhwaXJ5IjogNDYyMDM3NzAzMX0%253D?balph=40&blend=666666&blur=500&bm=screen&fit=max&fm=jpg&h=250&high=-80&ixlib=python-1.1.0&q=100&w=250&s=cc0e89cbfefc213e7a79ec84bdb9f077","background_overlay":"0,0,0,0","background_type":1,"background_image_raw":"https://cdn.filestackcontent.com/B8TQJqo9RoOCyIQVKYNa","theme_type":50},"pages":[{"id":308,"name":"Courses","order":0,"url":"/p/course-list/","show_in_nav":true,"using_blocks":false,"page_type":10,"template_type":"open","is_live":true}]},"school":{"id":5379,"name":"Applied Network Defense","platform_version":2.2,"url":"https://www.networkdefense.io/","is_ssl_disabled":false,"is_curriculum_licensor":false,"is_curriculum_subscriber":false,"is_activated":true,"is_activated_via_override":false,"resource_licensing_enabled":false,"trial_has_expired":false,"trial_days_remaining":null,"is_curriculum_enabled":true,"has_public_resources":true,"billing_model_display":"PW2","billing_model":10,"website":"","has_certificate":true,"subdomain":"networkdefense","ietf_language_tag":"en-US","short_description":"Affordable, effective, online information security training. Made by analysts, for analysts.","has_consent_description":false},"support":{"has_faqs":false,"support_email":"chris@chrissanders.org","support_phone":"","support_link":"","support_policy":"

Course support is provided by e-mail. Most questions will be answered within 24 hours.

","support_faqs":null},"security":{"terms_of_service":"https://www.networkdefense.io/pages/terms-of-use.html","privacy_policy":"https://www.networkdefense.io/pages/privacy-policy.html","csrf_token":"aoz4ocUHP8C4qMFZkR23jdpYGfSU27q5RDezxSMvmJBErKicdPQMInotBkIVvC4B","terms_agreement_prompt_override":""},"social":{"twitter_username":"","facebook_username":"","google_plus_username":"","pinterest_username":""},"integrations":{"facebook":null,"filepicker":{"read_policy":"eyJjYWxsIjogWyJyZWFkIiwgInN0YXQiLCAiY29udmVydCJdLCAiZXhwaXJ5IjogNDYyMDM3NzAzMX0=","read_signature":"888b9ea3eb997a4d59215bfbe2983c636df3c7da0ff8c6f85811ff74c8982e34"},"algolia":false,"intercom":{"user_hash":null,"app_id":null,"school_app_id":null,"school_staff_app_id":null,"pathwright_app_id":"5txzvi2k","school_profile":null},"stripe":{"publishable_key":"pk_live_519FnuiJS0AkKge1QE3m8gmgfw8ZrTaMQm65TH1hqecGkb8CtFjnUtdNniNz6X1rIp4p7MIv5T3J3phpIzYcVTlch007NgYwdpy"},"firebase":null,"google_analytics":{"account_id":"G-999PV44WV0","domain_name":"pathwright.com"},"sso":{"pathwright_login_enabled":true,"providers":[],"current_provider":null}},"customizations":{"head_markup":["","\r\n\r\n\r\n\r\n"],"script_markup":["\n\n\n"],"global_tracking_code":""},"pathwright_account":{"is_on_legacy_plan":false,"is_activated":true,"payment_key":"pk_live_1EFaBZz7SRVXYhX7V70P4dhCC2tOEVWu0f6r3WNUvnxmc3lGpxhOlp3CIPzgfFjihpeAG08yyda1lpRhIINEScEPn00qXGNBhT6","subscription":{"id":909,"school":5379,"plan":{"id":72,"name":"Complete + SSO Monthly Plan","image":null,"description":"Complete ($499/month) + SSO ($299/month)","amount":798.0,"fee_per_additional_learner":0.0,"features":{"10-staff-members":true,"offer-multiple-subscription-plans":true,"course-certificates":true,"1-staff-member":true,"start-at-1000-active-learners":true,"friendly-email-support":true,"starts-with-5-staff-members":true,"sell-subscriptions":true,"free-course-design-courses":true,"use-your-own-domain-name":true,"member-created-group-courses":true,"priority-email-support-live-demos":true,"create-unlimited-courses":true,"add-more-members-and-staff":true,"sell-courses-with-commerce":true,"1-cohort-per-course":true,"essential-app-integrations":true,"guided-course-design-courses":true,"priority-email-support":true,"3-cohorts-per-course":true,"Unlimited-cohorts-per-course":true,"1-mentor-group":true,"5-mentor-groups":true,"20-mentor-groups":true,"sign-in-with-apple-or-google":true},"plan_order":3,"plan_color":"","visibility":15,"learners_included":1000,"should_contact_for_pricing":false,"intervals_by_month":[{"interval_id":5,"months":1,"amount_per_cycle":798.0,"amount_per_month":798.0,"discount_percent":0.0,"discounted_amount_per_month":798.0,"discounted_amount_per_cycle":798.0,"discount_per_month":0,"discount_per_cycle":0},{"interval_id":7,"months":6,"amount_per_cycle":4788.0,"amount_per_month":798.0,"discount_percent":0.05,"discounted_amount_per_month":758.0,"discounted_amount_per_cycle":4548.0,"discount_per_month":40,"discount_per_cycle":240},{"interval_id":10,"months":12,"amount_per_cycle":9576.0,"amount_per_month":798.0,"discount_percent":0.1,"discounted_amount_per_month":718.0,"discounted_amount_per_cycle":8616.0,"discount_per_month":80,"discount_per_cycle":960},{"interval_id":20,"months":1,"amount_per_cycle":798.0,"amount_per_month":798.0,"discount_percent":0.0,"discounted_amount_per_month":798.0,"discounted_amount_per_cycle":798.0,"discount_per_month":0,"discount_per_cycle":0}],"scholarships_available":false},"subscription":{"id":34550,"card_last_4":"0324","subscription_plan":{"id":287,"amount":798.0,"interval":5,"trial_period_days":0,"trial_type":null},"is_delinquent":false,"cycle_start_dtime":"2025-08-11T16:03:37-04:00","cycle_end_dtime":"2025-09-11T16:03:37-04:00","canceled_dtime":null,"provider_school_stripe_key":null,"trial_type":null,"trial_end_dtime":null,"paused_until_dtime":null,"is_canceled_at_cycle_end":false,"cancellation_reason":null},"interval":5}},"user":null,"session":{"user":null,"school_membership":null,"csrf_token":"cJnTLf9G1HcjxckenFRESusqfmMAUYgxTY2oUV1uyibTyaXrgDFnhErVarCBntU3","is_authenticated":false},"DEBUG":false,"resource":{"id":219603,"name":"Command Line Essentials for Security Analysts","description":"

The command line is one of the most powerful tools in a security analyst’s toolbox – but learning it can be frustrating.
There are countless tools, cryptic flags, and blog posts that assume you already know what you’re doing. One tutorial shows you a five-line pipeline you don’t understand. Another gives you every grep switch under the sun, but no idea when or why to use them.
Most resources aren’t built for security analysts. They’re built for sysadmins, coders, or Linux kernel developers. That leaves you wondering: Which commands do I actually need to know? What are the most common use cases in security work? How do I practice and retain this stuff without memorizing man pages?
\r\n

Wouldn’t it be great if there were a course dedicated to teaching security analysts the essential command skills needed for security operations and investigations?\r\n

Introducing...\r\n

\r\n

Command Line Essentials for Security Analysts teaches you the core command-line skills you need to operate with precision, speed, and confidence in an investigative context. Whether you’re working in a Linux terminal or a Windows command shell, this course gives you a practical foundation rooted in real-world analysis skills.\r\n

This isn’t just a “here’s what grep does” kind of course. It’s designed specifically for security analysts, with a focus on making the command line an extension of your brain. You’ll learn to use it to find answers, spot anomalies, and accelerate your investigations.\r\n

What You’ll Learn

You’ll build comfort with a wide range of command-line tools and techniques by applying them to common investigative tasks. Topics include:\r\n

Searching\r\n

Find values or expressions in one file or across thousands
Search for multiple values at once, or filter out noise entirely
Locate files of different types and execute actions against them

Data Properties\r\n

Count characters, lines, or unique values in a file
Identify MIME types, hash files for integrity checks, and understand file sizes at a glance

Manipulating Data\r\n

Replace values with sed and awk
Add line numbers, split files, translate characters, and more

Output & Monitoring\r\n

Read files in reverse, sort output, and monitor real-time changes
Append, replace, or redirect output to suit your workflow

Parsing for Analysis\r\n

Extract values from delimited text
Work with JSON and XML data at the field level

Transferring & Plumbing Data\r\n

Use tools like netcat to send/receive data across systems
Interact with APIs, make HTTP requests, and proxy data between endpoints

Utility Functions\r\n\t\r\n

Loop through files, suppress errors, and chain commands together
Use man pages effectively, leverage xargs, and compress data when needed

We developed the course content based on skills inventories from working analysts in SOC and digital forensic roles and designed the learning objectives to include must-have information for aspiring and practicing analysts. You’ll quickly become comfortable interacting with investigative data on the command line in a way where it will be most useful for you. We’ll be with you the entire way to provide feedback on your work and push you forward.
If you want to become comfortable knowing which command line tools to use and how to get the most out of them… Command Line Essentials for Security Analysts is the course you’re looking for.

\r\n

Command Line Essentials for Security Analysts Includes:

Over 10 hours of demonstration videos. These videos will teach you relevant command line utilities; not just how to use them, but when and why you would want to use them.
Hands-on labs to help you develop and test your skills. You’ll complete lab exercises by leveraging the skills you learn in the demonstration videos to complete command line-centric tasks. I’ll be with you along the way to provide guidance and feedback on your work.
Participation in our student charitable profit-sharing program. A few times a year, we designate a portion of our proceeds for charitable causes. AND students get to take part in nominating charities that are important to them to receive these donations.

Frequently Asked Questions

Is this course live?\r\n\t
This is NOT a live course. It’s an online video course you can take at your own pace. You’ll interact with the instructor asynchronous through the course exercises.
\r\n

\r\n

How long do I have access to the course material?\r\n\t
You have access to the course for six months following your purchase date. If you need more time, you can extend your access for a small monthly fee.\r\n

\r\n

Are there any prerequisites or lab requirements for this course?\r\n\t
This course is designed for all security practitioner skill levels and assumes no prior command line experience. We will demonstrate command line techniques using Ubuntu Linux, Windows Command Prompt, and Windows PowerShell. You should have access to the command line interface on each relevant platform you want to follow along with.
\r\n

\r\n

How much time does it take to do this course?
Given the number of lab exercises, completing the course takes people varying times. You can plan for around 10 hours of lecture and demonstration lessons and 3-5 hours for lab exercises on your own. We recommend spreading your time in the course out over at least a few weeks to benefit from the effects of spaced learning.

\r\n

How many CPEs/CMUs is this course worth?
Organizations calculate continuing education credits in different ways, but they are often based on the length of the training. This course averages 15 hours of video+lab work.\r\n

Do you offer discounts for groups from the same organization?\r\n
Yes. To inquire about discounts or group invoices, please contact us at info@appliednetworkdefense.com.\r\n

","short_description":"Learn the core command-line skills every security analyst needs to investigate faster and smarter. This hands-on course teaches how to search, parse, manipulate, and move data using real-world techniques grounded in investigation workflows.","categories":[{"id":952,"name":"Information Technology","slug":"information-technology","description":null,"order":0,"resources_count":null},{"id":2727,"name":"Computer Security","slug":"computer-security","description":"","order":0,"resources_count":null}],"image":null,"cover_image":"https://cdn.filestackcontent.com/ShmHFVNCSYaw90TLxbnR","thumb":"https://pathwright.imgix.net/https%3A%2F%2Fcdn.filestackcontent.com%2Fapi%2Ffile%2FShmHFVNCSYaw90TLxbnR%3Fsignature%3D888b9ea3eb997a4d59215bfbe2983c636df3c7da0ff8c6f85811ff74c8982e34%26policy%3DeyJjYWxsIjogWyJyZWFkIiwgInN0YXQiLCAiY29udmVydCJdLCAiZXhwaXJ5IjogNDYyMDM3NzAzMX0%253D?dpr=1&fit=crop&h=232&ixlib=python-1.1.0&w=310&s=10c98f1f84a5da1eb0c2b29dd2a12602","thumb_2x":"https://pathwright.imgix.net/https%3A%2F%2Fcdn.filestackcontent.com%2Fapi%2Ffile%2FShmHFVNCSYaw90TLxbnR%3Fsignature%3D888b9ea3eb997a4d59215bfbe2983c636df3c7da0ff8c6f85811ff74c8982e34%26policy%3DeyJjYWxsIjogWyJyZWFkIiwgInN0YXQiLCAiY29udmVydCJdLCAiZXhwaXJ5IjogNDYyMDM3NzAzMX0%253D?dpr=2&fit=crop&h=232&ixlib=python-1.1.0&w=310&s=453391e4323aa61499eb8cd8fb6b4e68","icon":"https://pathwright.imgix.net/https%3A%2F%2Fcdn.filestackcontent.com%2Fapi%2Ffile%2FShmHFVNCSYaw90TLxbnR%3Fsignature%3D888b9ea3eb997a4d59215bfbe2983c636df3c7da0ff8c6f85811ff74c8982e34%26policy%3DeyJjYWxsIjogWyJyZWFkIiwgInN0YXQiLCAiY29udmVydCJdLCAiZXhwaXJ5IjogNDYyMDM3NzAzMX0%253D?fit=crop&h=35&ixlib=python-1.1.0&w=35&s=ff92c4e2c6b3d2125f14047863dbe1bc","background_image":"https://pathwright.imgix.net/https%3A%2F%2Fcdn.filestackcontent.com%2Fapi%2Ffile%2FvXhk6E6OQzOJCj9OMoG6%3Fsignature%3D888b9ea3eb997a4d59215bfbe2983c636df3c7da0ff8c6f85811ff74c8982e34%26policy%3DeyJjYWxsIjogWyJyZWFkIiwgInN0YXQiLCAiY29udmVydCJdLCAiZXhwaXJ5IjogNDYyMDM3NzAzMX0%253D?fit=max&ixlib=python-1.1.0&w=1400&s=68d06c565a37abce9aa7fdef71fa279a","background_overlay":null,"background_image_blurred_cdn":"https://pathwright.imgix.net/https%3A%2F%2Fcdn.filestackcontent.com%2Fapi%2Ffile%2FvXhk6E6OQzOJCj9OMoG6%3Fsignature%3D888b9ea3eb997a4d59215bfbe2983c636df3c7da0ff8c6f85811ff74c8982e34%26policy%3DeyJjYWxsIjogWyJyZWFkIiwgInN0YXQiLCAiY29udmVydCJdLCAiZXhwaXJ5IjogNDYyMDM3NzAzMX0%253D?balph=40&blend=666666&blur=500&bm=screen&fit=max&fm=jpg&h=250&high=-80&ixlib=python-1.1.0&q=100&w=250&s=3ae60e4c452df4638ca7e8ec14d03e05","background_type":1,"authors":[{"id":8003,"display_name":"Tom Harrison","first_name":"Tom","last_name":"Harrison","bio":"

Tom Harrison is a security operations manager, analyst, threat hunter, pen tester, researcher, and CTF enthusiast. By day, he runs a SOC team and teaches cyber security. By night, he plays CTFs, hack things, and eats a professional volume of tacos.

","image":"https://pathwright.imgix.net/https%3A%2F%2Fcdn.filestackcontent.com%2Fapi%2Ffile%2FEYxQQeVT4WoAG9PvCsYg%3Fsignature%3D888b9ea3eb997a4d59215bfbe2983c636df3c7da0ff8c6f85811ff74c8982e34%26policy%3DeyJjYWxsIjogWyJyZWFkIiwgInN0YXQiLCAiY29udmVydCJdLCAiZXhwaXJ5IjogNDYyMDM3NzAzMX0%253D?fit=crop&h=115&ixlib=python-1.1.0&w=115&s=6c904dc78ae93ab27850be54e6860c31","resources_count":null,"salutation":"","title":"","slug":"tom-harrison","order":0,"avatar":"https://cdn.filestackcontent.com/EYxQQeVT4WoAG9PvCsYg"}],"created":"2024-02-14T09:30:43.043831-05:00","url":"https://www.networkdefense.io/library/command-line-essentials-for-security-analysts-219603/","offering_counts":{},"resource_type":10,"resource_type_display":"Course","slug":"command-line-essentials-for-security-analysts-219603","trailer_embed_code":"","list_order":null,"total_registration_count":null,"sum_registration_count":4,"lowest_public_offering_price":147.0,"highest_public_offering_price":147.0,"curriculum_offering":null,"num_offerings":1,"visibility_level_override":15,"licensing_enabled":false,"license_offerings":[],"licensed_from_resource":null,"certificate_generator_class":"","lowest_price_currency_display":"$147","highest_price_currency_display":"$147","discussion_enabled":true,"licensed_from_school":null,"highest_visibility_level":15,"certificate_json":{}},"offering":{"id":722322,"name":"Command Line Essentials for Security Analysts","access_starts":"2025-08-20T01:00:00-04:00","access_ends":null,"enrollment_starts":null,"enrollment_ends":null,"description":"

This course is available for pre-sales now. It launches on August 20th at 10 AM ET and will be immediately available for access at that time.

","visibility":15,"price":147.0,"seats":null,"seats_filled":1,"seats_available":-1,"currency_display":"$147","include_in_subscription_plans":[],"include_with_products":[],"is_subscription_only":false,"resource_id":219603,"path_id":10383795,"permissions":{"can_participate":false,"can_access":false,"can_edit":false,"can_edit_resource":false,"can_facilitate":false,"can_view_analytics":false,"can_invite_editor":false,"can_invite_teacher":false,"can_invite_moderator":false,"can_invite_student":false,"can_invite_observer":false},"due_dates_enabled":false,"is_group_offering":false,"step_counts":{},"is_curriculum":false,"url":"/library/command-line-essentials-for-security-analysts-219603/722322/","invite_urls":{},"access":{"is_full":false,"has_registration_ended":false,"has_registration_started":true,"has_access_started":false,"has_access_ended":false},"analytics_visibility":5,"resource_license":null,"discussion_enabled":true,"parent_offering_id":null,"created_by_id":74872,"status":1,"analytics_disabled":false}}

Loading Command Line Essentials for Security Analysts...