Learning paths
Every module can be entered on its own, but a path gives you an order and a reason for it. Each path keeps the course's core habit: decide what evidence a result needs before you trust it. Time estimates on each module page are the author's estimates; measured learner times will replace them after piloting.
Practical foundations: new to programming or machine learning
- Take the readiness check; use Python Foundation and the Python-to-ML bridge where it suggests.
- Work through Modules 1 to 4: rules versus models, files and functions, cleaning, exploring.
- Continue to Module 5 (your first trained model and baseline) and Module 6 (classification and thresholds).
- Finish Module 6 with the stability exercise.
At every module, answer the "Check yourself" questions on the concepts page before practice, and use the study workflow for what to keep.
IT operations analyst: applying ML to operational data
- Modules 2, 3 and 4: tickets, network events and service workload.
- Module 6, then the historical phishing case and the RT-IoT intrusion triage transfer.
- Module 12: monitoring, then the JSON API extension.
- Module 10's retrieval extension and Module 14: grounding answers and bounding tools.
Evaluation-focused practitioner: you already build models
- Skim the readiness check, then Module 5 for the evaluation protocol the course uses.
- In Module 6, run the stability, tuning and encoding extensions (the encoding one is in Module 3).
- The complete capstone, the advanced investigations and the research comparison guide.
- Modules 8 to 11 for neural, language-model and fine-tuning evaluation.
The recurring IT case thread
IT examples recur through the course alongside other datasets. Each has limits, and stating them is part of using it well.
| Where | IT case | Data | What it can and cannot show |
|---|---|---|---|
| Module 1 | Storage review rule | Original fixture | A written rule, not a learned model |
| Module 2 | Help-desk tickets and events | Original fixture | Counting, missing values and file contracts; no real workload |
| Module 3 | Network event quality | Original fixture | Validation, duplicates and reconciliation |
| Module 4 | Service workload and latency | Original fixture | Rates with denominators; descriptive only |
| Module 5 | Ticket forecasting (design transfer) | Real bike-sharing counts | The forecasting protocol; not real ticket data |
| Phishing case and capstone | Website phishing triage | Real historical UCI attributes | A historical benchmark, not a live detector |
| Module 3 extension | Encoding the phishing attributes | Real historical UCI attributes | Representation choices on validation data |
| RT-IoT transfer | Completed-flow intrusion triage | Real captured flows | No device, session or time identifiers, so no claim about new devices or drift |
| Module 10 extension | Runbook retrieval | Original fictional runbooks | The retrieval and abstention method; a small corpus |
| Module 12 | Model service, monitoring and API | Real wine records as stand-in inputs | Contracts and monitoring mechanics; not IT telemetry |
| Module 14 | Bounded tool workflow | Authored requests over real data | Permission boundaries; not real user intent |