Pivoting: host, user, IP, hash is part of L2 · Investigation & Correlation, which unlocks once you complete every lesson in L1 · Alert Triage.

This keeps the curriculum sequenced: each phase builds on skills exercised in the one before it.