Qorionix Foundations

Curriculum

Durations include the exercise and are meant honestly rather than optimistically — a lesson estimated at thirty minutes takes about thirty minutes. A lesson that would run past twenty-five minutes has been split into two.

1. Module 1 · 21 min · 3 lessons

   What this is, and what it is not

   Twenty minutes that will save you a month. Most disappointment with a security product is a mismatch between what it does and what somebody assumed, and that mismatch is usually established on day one.

   1. Concept8 min

      The actual claim, and the number behind it

      We claim to cover roughly 60–75% of what a competent analyst would catch on known attack patterns. This lesson unpacks that band: where it comes from, what the missing quarter is, and why a vendor quoting you a higher number is telling you something about themselves.

      After this lesson you can

      • State the coverage claim in your own words, including the part about known attack patterns.
      • Explain why 60–75% is a useful number for a company that currently has approximately zero coverage.
      • Identify at least two things inside the missing 25–40%, and say what you would do about them.
   2. Concept7 min

      The seven things it will not do

      A published list of hard limits, each with the reason. The two that catch people out most often are that nobody here answers a telephone at three in the morning, and that behavioural detection needs one to two weeks of your real traffic before it knows what normal looks like.

      After this lesson you can

      • Name the limits that apply to your organisation specifically, rather than all seven generically.
      • Explain to a colleague why the first fortnight is quieter than the second, and that this is data physics rather than a licence tier.
      • Decide whether you need a human on call, and if so, that you have to buy that from somebody else.
   3. Judgement6 min

      Deciding whether you are the right customer

      Four short scenarios. In two of them the correct answer is that this product is the wrong choice. Knowing that on day one is worth more to you than a successful onboarding you regret in month four.

      After this lesson you can

      • Apply the hard-limits list to a described organisation and reach a buy or do-not-buy conclusion.
      • Recognise the two disqualifying conditions: you cannot install software on your endpoints, or you need a named human on call.
      • Explain why a company running nothing but Microsoft 365 Business Premium is the central case rather than an edge case.

2. Module 2 · 32 min · 4 lessons

   Connect Microsoft 365 and get your first report

   The whole point of the first hour: from an empty account to a document naming your actual administrators and your actual risks. This module is the one that produces something you can show somebody.

   1. Hands-on lab8 min

      Creating your organisation and your own account

      Set up the organisation, create your own administrator account, and — before anything else — put a second factor on it. The account you are about to give read access to your entire tenant is now the most valuable account in your business.

      After this lesson you can

      • Create an organisation and a first administrator account.
      • Enrol a second factor on that account, and explain why doing it now rather than later is not pedantry.
      • Identify which of the roles available you should give to the second person who needs access.

      Exercise

      Set up the organisation and harden the first account

      You need

      • A Qorionix sign-up
      • A phone or a hardware security key

      Steps

      1. Create the organisation. Use your real legal entity name — it appears on exported evidence.
      2. Create your administrator account and sign in.
      3. Enrol a second factor immediately. Prefer a passkey or a hardware key over an authenticator app, and an authenticator app over anything delivered by text message.
      4. Sign out and sign back in, to confirm the second factor actually challenges you rather than silently not applying.
      5. Note down who else will need access, and which role each of them needs.

      How you know it worked

      Signing in from a private browser window prompts for the second factor. If it does not, the factor is enrolled but not enforced, and you have found the single most common self-inflicted gap in the product.
   2. Walkthrough10 min

      The consent screen, permission by permission

      Microsoft is about to show you a list of permissions and ask you to agree to it on behalf of your whole company. This lesson goes through them one at a time: what each one is for, what it would let us do if we were malicious, and which ones are read-only.

      After this lesson you can

      • Read a Microsoft application consent screen and identify which permissions are read-only and which allow change.
      • Explain, for the three broadest permissions requested, what capability of the product would stop working without it.
      • Grant consent, or decide not to, on the basis of the list rather than on trust.

      Exercise

      Grant consent and watch what happens next

      You need

      • A Microsoft 365 global administrator, which may not be you
      • Ten minutes with nobody interrupting, because the consent screen times out

      Steps

      1. Open the connection flow and read the permission list before clicking anything.
      2. For each permission you are unsure about, find it in the knowledge-base article rather than guessing from its name — Microsoft's permission names are misleading in both directions.
      3. Grant consent as global administrator.
      4. Watch the first discovery run start. Do not close the tab; note the time.

      How you know it worked

      Discovery starts within a minute of consent and the connection shows as active. If it sits idle, consent was granted to the wrong tenant — the most common cause is being signed into a personal Microsoft account in the same browser.

   3. Walkthrough8 min

      The first hour, in order

      What runs, when, and in what order — so that a gap of twenty minutes with nothing visible happening does not read as a failure. Discovery targets thirty minutes unattended and the platform measures itself against a one-hour claim rather than assuming it.

      After this lesson you can

      • Describe the sequence from consent to a completed posture report.
      • Distinguish a run that is still working from a run that has stalled, without opening a ticket to find out.
      • Explain why the alert side of the product is quiet during the first fortnight while the posture side is not.
   4. Concept6 min

      What your Microsoft licence lets us see

      Sign-in log analysis and Conditional Access evaluation need Entra ID P1. Without it, the affected checks are reported as skipped — never as passed. This lesson is short and it is the one auditors ask about.

      After this lesson you can

      • Find which checks are skipped in your own tenant and state the reason for each.
      • Explain the difference between a skipped check and a passed check, and why reporting the first as the second would be the worst possible defect in this product.
      • Decide whether the licence upgrade is worth it for your organisation, using the count of skipped checks as the input.

3. Module 3 · 30 min · 4 lessons

   Reading your posture report

   You now have a document listing real problems in your real tenant. This module is about turning that into a short list of things to do this week, without breaking your business in the process.

   1. Concept8 min

      The anatomy of a finding

      Every finding has a stable identifier, a severity, why it matters, what an attacker does with it, the fix, and the obligations it maps to. The identifier is the part to learn: it is how you refer to a finding in a ticket, in an email to us, and in an audit response a year from now.

      After this lesson you can

      • Read a finding and restate it to a non-technical colleague in two sentences.
      • Use a check identifier to search the knowledge base and to reference a finding in correspondence.
      • Explain what the mapped obligations on a finding do and do not mean.
   2. Concept7 min

      Severity is not priority

      Severity says how bad the condition is. Blast radius says how much of your business a fix would disturb. The order you work in is decided by both, and getting this backwards is how a security improvement becomes an outage on a Friday afternoon.

      After this lesson you can

      • Order a set of five findings by what you should actually do first, and justify the order using both severity and blast radius.
      • Identify the finding in your own report with the highest severity and the highest blast radius, and explain why it is not first.
      • Recognise the pattern where a high-severity finding has a zero-cost fix and should be done immediately regardless of position.
   3. Hands-on lab10 min

      Working the done, approve and decide queue

      Changes are grouped by who has to authorise them. Some were already made — a closed allowlist of nine, all of them logging and telemetry rather than anything that can lock a person out. Some are prepared and waiting for one tap. Some are business decisions the platform will not make for you.

      After this lesson you can

      • State which nine changes the platform makes without asking, and why every multi-factor and Conditional Access change is deliberately absent from that list.
      • Approve a prepared change and locate its record afterwards.
      • Take one item from the decide column and work out who in your business has to be consulted before you can action it.

      Exercise

      Clear the approve column, and triage the decide column

      You need

      • A completed posture report
      • Twenty minutes

      Steps

      1. Read the done column first. For each item, satisfy yourself that it changed only logging, retention, telemetry or detection state.
      2. Work through the approve column. For each item, read the stated blast radius before approving, not after.
      3. Approve at least one item and find its audit record. Note the actor: a change you approved records you, not the platform.
      4. For the decide column, write one line per item naming the person in your business who has to be asked. Do not action any of them yet.
      5. Find the legacy authentication item if you have one. It will name the specific device or account that will break.

      How you know it worked

      The approve column is empty or every remaining item has a written reason for not approving it. The decide column has a name against each item.
   4. Hands-on lab5 min

      Undoing a change

      Practise the undo before you need it. Reversibility is recorded at the moment of action by the code taking it, which means the undo path exists before the change does — but knowing where the control is at four o'clock on a Friday is a different skill from knowing that it exists.

      After this lesson you can

      • Reverse a change you made, and confirm the reversal in the audit trail.
      • Explain why an action class with no known reversal is never taken unattended.
      • Locate the undo control from a notification rather than by navigating to it.

      Exercise

      Reverse something on purpose

      You need

      • At least one approved change from the previous exercise

      Steps

      1. Pick the lowest-consequence change you approved.
      2. Find its record and use the undo control.
      3. Confirm in the audit trail that there are now two entries — the change and the reversal — with you as the actor on both.
      4. Re-apply the change if you wanted it.

      How you know it worked

      Two audit entries, correct actor on each, and the tenant back in the state you intended. If the reversal produced only one entry, that is worth reporting to us.

4. Module 4 · 34 min · 5 lessons

   When something happens

   The posture queue is about conditions. The alert queue is about events. This module is about the second one, and about the single decision this credential really certifies: does this need somebody tonight?

   1. Concept5 min

      Two queues, two different jobs

      A finding is a condition that is true until you change it. An alert is something that happened. They have different urgencies and different response patterns, and treating one like the other is the most common operating mistake in the first month.

      After this lesson you can

      • Given a described situation, say whether it belongs in the posture queue or the alert queue.
      • Explain why a critical finding can wait a week and a medium alert sometimes cannot.
   2. Hands-on lab8 min

      Putting the sensor on one machine

      The endpoint half of the platform needs software on your machines. Install it on one — yours — and confirm it is reporting something useful rather than merely checking in.

      After this lesson you can

      • Install the sensor on a Windows or Linux machine and confirm it appears.
      • Confirm that what arrives includes process detail, not just a heartbeat.
      • State what you would need to do to roll this out to thirty machines, and that it will not update itself afterwards.

      Exercise

      One machine, and check the telemetry is real

      You need

      • A Windows or Linux machine you administer
      • Local administrator or root on it

      Steps

      1. Download the installer for your platform: MSI for Windows, deb or rpm for Linux.
      2. Install it and wait for the host to appear in the console.
      3. Open a command prompt or terminal on that machine and run something harmless and distinctive — copy a file, list a directory.
      4. Find that activity in the console. You are looking for the command line and the parent process, not just a line saying the host is online.

      How you know it worked

      You can see the command you ran, with its parent process. A host that is present but reporting only check-ins is the failure mode to recognise: it means the sensor is running and the telemetry is not useful, which looks identical on a dashboard.
   3. Concept8 min

      Reading a Sentinel-Q decision

      Every alert gets an investigation, and the investigation produces a record: a classification, a confidence figure, the evidence it cited, whether that evidence verified, and — if it escalated to you — the reason it stopped. This lesson teaches you to read that record top to bottom.

      After this lesson you can

      • Name the fields of a decision record and say what each one is for.
      • Given a decision, state whether the platform acted, proposed or escalated, and identify the reason.
      • Explain why a confident answer can still be refused, and why that is the behaviour you want.
   4. Judgement8 min

      Tonight, or Monday?

      Six real-shaped alerts, at various times of day, with various confidences and dispositions. For each: does this need you now, does it need you in the morning, or does it need nothing? This is the decision the Operator credential exists to certify.

      After this lesson you can

      • Given an alert and its decision record, decide between act now, act tomorrow and no action, and justify it.
      • Recognise the two signals that always mean now: a privileged account and a successful authentication you cannot account for.
      • Recognise that a low-confidence escalation is the platform working correctly, and say what it means about the evidence.
   5. Concept5 min

      Getting help, and what to have ready

      How to reach us, what to include so the first reply is useful rather than a request for more information, and the identifiers that make a support conversation short — the check identifier, the decision identifier, the host name, the time with a time zone.

      After this lesson you can

      • Assemble the four pieces of information that make a support request answerable on the first reply.
      • Know which route to use: knowledge base, ticket, or email.