Learning paths

Every module can be entered on its own, but a path gives you an order and a reason for it. Each path keeps the course's core habit: decide what evidence a result needs before you trust it. Time estimates on each module page are the author's estimates; measured learner times will replace them after piloting.

Practical foundations: new to programming or machine learning

  1. Take the readiness check; use Python Foundation and the Python-to-ML bridge where it suggests.
  2. Work through Modules 1 to 4: rules versus models, files and functions, cleaning, exploring.
  3. Continue to Module 5 (your first trained model and baseline) and Module 6 (classification and thresholds).
  4. Finish Module 6 with the stability exercise.

At every module, answer the "Check yourself" questions on the concepts page before practice, and use the study workflow for what to keep.

IT operations analyst: applying ML to operational data

  1. Modules 2, 3 and 4: tickets, network events and service workload.
  2. Module 6, then the historical phishing case and the RT-IoT intrusion triage transfer.
  3. Module 12: monitoring, then the JSON API extension.
  4. Module 10's retrieval extension and Module 14: grounding answers and bounding tools.

Evaluation-focused practitioner: you already build models

  1. Skim the readiness check, then Module 5 for the evaluation protocol the course uses.
  2. In Module 6, run the stability, tuning and encoding extensions (the encoding one is in Module 3).
  3. The complete capstone, the advanced investigations and the research comparison guide.
  4. Modules 8 to 11 for neural, language-model and fine-tuning evaluation.

The recurring IT case thread

IT examples recur through the course alongside other datasets. Each has limits, and stating them is part of using it well.

The recurring IT case thread โ€” table 1
Where IT case Data What it can and cannot show
Module 1 Storage review rule Original fixture A written rule, not a learned model
Module 2 Help-desk tickets and events Original fixture Counting, missing values and file contracts; no real workload
Module 3 Network event quality Original fixture Validation, duplicates and reconciliation
Module 4 Service workload and latency Original fixture Rates with denominators; descriptive only
Module 5 Ticket forecasting (design transfer) Real bike-sharing counts The forecasting protocol; not real ticket data
Phishing case and capstone Website phishing triage Real historical UCI attributes A historical benchmark, not a live detector
Module 3 extension Encoding the phishing attributes Real historical UCI attributes Representation choices on validation data
RT-IoT transfer Completed-flow intrusion triage Real captured flows No device, session or time identifiers, so no claim about new devices or drift
Module 10 extension Runbook retrieval Original fictional runbooks The retrieval and abstention method; a small corpus
Module 12 Model service, monitoring and API Real wine records as stand-in inputs Contracts and monitoring mechanics; not IT telemetry
Module 14 Bounded tool workflow Authored requests over real data Permission boundaries; not real user intent