Scripting
Write the Python Security Work Runs On
Built by working security engineers. You get a function to write and a test suite that runs in your browser — no home lab, no setup, nothing to install.
Guided by The Scripter
What it is
Scripting, defined
Almost every security job comes down to a version of the same task: take messy data and turn it into an answer someone can act on. Parse the log nobody else wants to parse. Turn a JSON export into the spreadsheet a stakeholder asked for. Write the detection rule as code. Collapse ten thousand alerts into the forty that matter. This is that skill, practiced against the input that breaks naive code.
The career
A skill you get hired for
Scripting is the multiplier on every other security skill. It's also the part of the interview loop most candidates underprepare for — the coding screen for security roles is rarely algorithm trivia, and almost always data wrangling under time pressure.
Builds toward
Security Automation Engineer
Typical salary
$140K/yr avg
Market demand
500K+ open US roles
Who you'd work alongside
- Detection and response engineers
- SOC analysts automating the work they do twice
- Security engineers building internal tooling
- Anyone preparing for a security engineering coding screen
The DefendTheOrg approach
How you'll learn it
Every lab gives you a function signature and says exactly what it must return. You write the body; a test suite runs it and tells you what happened. Python runs in your browser, so there's nothing to install and no environment to stand up:
Work against a real contract
The return shape, the ordering, what happens on empty input, what happens when a field is missing — all specified up front, the way a real ticket or a real interviewer specifies it. Guessing isn't part of the exercise.
Iterate with real feedback
Run as often as you like. You see the expected value, your value, anything you printed, and the traceback if it raised — the same loop you'd have in a terminal, minus the setup.
Survive the input that breaks things
Submitting also runs hidden tests: the malformed record, the empty list, the value that's zero rather than absent, the timestamp exactly on the boundary. They exist to catch the solution that only works on the happy path.
Stuck? Get walked through it.
Every Easy and Medium lab has a walkthrough from The Scripter — one hint at a time, with a chance to try each step yourself before the answer. You get three a week, and using one never touches your score. It teaches the reasoning, not the solution.
Try it yourself
A taste of the real lab
This is a simplified, no-signup slice of a Scripting lab — make your call and see how it's graded. The real labs go deeper.
Root console login without MFA
Pick the expression that completes the rule.
def detect(events): alerts = [] for e in events: ... # ConsoleLogin + Root checks mfa = e.get("additionalEventData", {}).get("MFAUsed") if ?: alerts.append(...) return alerts
Tests
Push yourself
Where Hard and Expert labs take you
Every skill scales from your first lab to genuinely hard reasoning. Difficulty isn't a bigger wall — it's deeper thinking.
Hard
Hard labs are stateful — sliding windows, sessions, first-match precedence over data that arrives out of order. The obvious algorithm is usually wrong at the boundaries, and the boundaries are the whole point.
Expert
Expert labs stack two of those problems and assume hostile input: chunked payloads with pieces missing, encodings designed to slip past a naive parser, ambiguity you have to resolve deliberately rather than accidentally.
Start scripting training
Hands-on labs built from real engagement data. Learn by doing — guided by The Scripter.