SOC OP-002: Impossible Travel Alert is now available for Premium members 🔍 Investigate 25 Wazuh events 🧠 Build the timeline and test competing explanations 📝 Submit a worksheet and professional incident report ⏱️ Estimated time: 45–60 minutes 🔒 Access is individual. Premium members who need access should DM me: OP-002 access request Already approved? Start in the Premium Classroom. Follow the evidence—not the narrative. 🛡️

We’ve updated our membership benefits to make it clearer what is included with each North Star Cyber Launchpad tier. 📚 Standard — Free Free members continue to receive access to: - CySA+ certification-preparation resources - PenTest+ certification-preparation resources - Domain-organized Anki flashcards - Original practice assessments - Video lessons as they are released - Community study support Our certification-preparation material will remain available for free. 🎓 🛡️ Premium — $25/month Premium is for learners ready to move beyond studying concepts and begin applying them through structured investigations. Premium includes: - Everything available in Standard - Access to the North Star cyber range - Access to the live SOC training environment - Evidence-based investigation operations - Editable worksheets and incident-report templates - Private submission and revision workflow - Instructor feedback on submitted work - Access to new operations as they are released The cyber range and live SOC training environment are not included with the free membership. You must upgrade to Premium before requesting access. North Star’s goal remains simple: Learn the concepts for free. Upgrade when you’re ready to investigate evidence, produce professional work, and receive structured feedback. 🚀

I’ve added new flashcard decks for: 🛡️ CompTIA CySA+ ⚔️ CompTIA PenTest+ Each deck is organized by exam domain, making it easier to focus on one subject area at a time and identify where you need additional study. 📚🎯 The flashcards are designed for spaced repetition—reviewing information at increasing intervals to strengthen long-term retention and recall. 🧠🔁 🎥 I’ll be recording the accompanying video lessons soon. For now, you can start working through the flashcards and building a consistent study routine. ✅ Choose your certification ✅ Select a domain ✅ Study a manageable number of cards each day ✅ Continue reviewing difficult concepts Head to the Classroom and start studying! 🚀⭐️ (Disclaimer) North Star Security is an independent training provider and is not affiliated with or endorsed by CompTIA.

If you all get a chance to do the project do it. I know life gets busy. But I took about a week on this first project and it was a really great challenge.

Operation 01: SOC Case 001 — Password Spray to Persistence is ready in the Classroom. Access is individual and is not granted automatically by this announcement. How to get access If you are new to North Star—or you have not received an individual invitation and assigned Case 001 link—send me a private Skool DM that says: Operation 01 access request Do not include a password, TOTP code, recovery code, token, cookie, or other authentication material. Do not use or request another learner’s invitation or link. Wait for me to confirm that your individual access is ready before entering the investigation. If you already have a working individual invitation and assigned Case 001 link, you may begin with Start Here: Scope & Downloads. In this guided, fully synthetic investigation, you will: • review authentication and endpoint evidence; • reconstruct a chronological timeline; • distinguish confirmed facts from supported assessments and unknowns; • recommend defensible response actions; • produce an investigation worksheet and incident report. Estimated time: 60–90 minutes. Before you begin 1. Confirm that you have received your individual invitation and assigned Case 001 link. 2. Open Start Here: Scope & Downloads. 3. Download the Quick Start Guide and Investigation Worksheet. 4. Read the authorized scope and privacy boundaries. 5. Use only your individual North Star invitation and assigned Case 001 link. 6. Complete central password-plus-TOTP authentication. Wazuh should open through federated SSO without requesting a second password. If Wazuh presents a local username/password form, stop and send me a private Skool DM. Your evidence view should contain exactly 15 synthetic events from 2026-07-26 00:00:00 to 00:12:00 UTC. Stop and request private support if the count, time window, learner identity, cohort visibility, or available permissions differ. Submission Submit exactly two editable DOCX files in one private Skool DM thread to me: 1. Completed OP-001 Investigation Worksheet