These lessons teach the reasoning behind a workflow, not only which operation to click. Every lab uses synthetic or documentation-safe data, runs locally in the browser, and links to installable solution recipes.
Encoding, encryption, and hashing
Learn why these transformations solve different problems, then compare reversible and one-way workflows. Start lesson
Decode until you understand
Work through nested representations and learn when to use Magic versus an explicit recipe. Start lab
Compose and debug workflows
Build multi-step recipes, inspect intermediate values, and correct ordering mistakes. Start lesson
Structured data lab
Move among JSON, YAML, CSV, XML, and Jsonata queries. Start lab
Indicators and network data
Extract, normalize, defang, and parse common investigation values without contacting them. Start lab
Binary and file triage
Use signatures, strings, compression, hex, and disassembly to form static-analysis hypotheses. Start lab
Time and identifiers
Normalize timestamps and explain UUIDs, permissions, URIs, and IPv6 addresses. Start lab
Analyst capstone
Triage a synthetic alert by decoding a command, extracting indicators, and documenting a reproducible result. Start capstone
Teaching approach
- Begin with a question and a sample, not an operation name.
- Predict the output type before adding the next operation.
- Inspect intermediate values with breakpoints or step execution.
- Replace exploratory Magic results with an explicit, reviewable recipe.
- Record assumptions about encodings, time zones, keys, delimiters, and trust.