A Hands-On Companion for the Blue Team Level 1 Certification
Welcome to this practical study guide designed to equip you with the hands-on skills needed for the Security Blue Team - Blue Team Level 1 (BTL1) certification. Drawing from real-world experience and a deep understanding of the BTL1 domains, this repository compiles essential notes, cheatsheets, workflows, and resources.
BTL1 tests practical application, not just theoretical knowledge. This guide mirrors that philosophy, focusing intently on what actions to take, how to perform them, and which tools to leverage effectively in realistic security scenarios.
This resource is tailored for:
- 👨🎓 Aspiring BTL1 Candidates: Individuals actively preparing for the certification exam.
- 💻 Junior Cyber Professionals: SOC Analysts (Tier 1/2), Junior Incident Responders, SysAdmins, or IT professionals aiming to transition into or solidify their skills in defensive security roles.
- 🛡️ Cyber Defense Enthusiasts: Anyone passionate about learning practical Blue Team operations through a structured, hands-on approach.
Assumed Knowledge: A foundational grasp of networking (TCP/IP, DNS, HTTP), operating systems (Windows & Linux command-line basics), and core cybersecurity concepts will be beneficial.
- 🛠️ Hands-On Focus: Directly aligned with the practical, scenario-based nature of the BTL1 exam.
- 📄 Detailed Cheatsheets: Quick-reference guides for crucial commands and tool functionalities.
- 💡 Structured Workflows: Step-by-step methodologies for common analysis tasks (Phishing, IoC Investigation, etc.).
- 🧩 Modular Organization: Content arranged by official BTL1 domains for focused learning.
- 🔗 Curated Resources: Vetted links to essential tools, official documentation, and effective practice platforms.
🧰 Main Tools Covered
This guide explores the practical application of key tools encountered in the BTL1 certification environment and common in security analysis roles:
- SIEM:
Splunk(using SPL),Elastic Stack(ELK Stack fundamentals) - Network Traffic Analysis:
Wireshark,Tshark - Memory Forensics:
Volatility 2/Volatility 3 - Disk Forensics:
Autopsy,The Sleuth Kit (TSK),FTK Imager - Endpoint Data Collection:
KAPE(Kroll Artifact Parser and Extractor) - File/Malware Analysis:
VirusTotal,Hybrid Analysis,Any.Run,ExifTool - File Carving:
Scalpel,Foremost - Log Analysis (CLI): Native commands (Linux/Windows),
Sysinternals Suite - Threat Intelligence Platforms:
URLhaus,AbuseIPDB,OTX
The guide is logically organized into modules reflecting the core BTL1 domains. Consult the
README.mdwithin each module folder for specific contents.
| Module | Brief Description | Status |
|---|---|---|
00_Introduction_BTL1 |
BTL1 fundamentals, critical thinking, and exam strategy. | Completed |
01_Phishing_Analysis |
Dissecting emails, analyzing headers, URLs, and attachments. | Completed |
02_Threat_Intelligence |
Applying CTI, IoCs, TTPs, and the MITRE ATT&CK Framework. |
Completed |
03_Digital_Forensics |
Acquiring and analyzing evidence from disk and memory (Win/Lin). |
Completed |
04_SIEM_Analysis |
Searching, correlating, and analyzing logs in Splunk. |
Completed |
05_Network_Analysis |
Interpreting PCAPs, identifying protocols, and spotting anomalies. |
Completed |
06_Incident_Response |
Lifecycle, live response techniques, containment concepts. | Completed |
assets/ |
Supporting images, diagrams, etc. | N/A |
CONTRIBUTING.md |
Guidelines for contributing. | Available |
CODE_OF_CONDUCT.md |
Community standards. | Available |
LICENSE |
MIT License details. | Available |
► Click to Navigate Study Modules
- 🚀 Introduction & Strategy (
./00_Introduction_BTL1/) - 🎣 Phishing Analysis (
./01_Phishing_Analysis/) - 💡 Threat Intelligence (
./02_Threat_Intelligence/) - 🕵️ Digital Forensics (
./03_Digital_Forensics/) - 📊 SIEM Analysis (
./04_SIEM_Analysis/) - 🌐 Network Analysis (
./05_Network_Analysis/) - 🔥 Incident Response (
./06_Incident_Response/)
- 🎯 Target Your Study: Use the Table of Contents or
Repository Structureto navigate to specific BTL1 domains or tools. - 🧠 Understand Concepts: Read the "Key Concepts" sections first to grasp the fundamentals.
- 🛠️ Learn the Tools: Review cheatsheets and practice with the essential tools (
Volatility,Splunk,Wireshark,Autopsy, etc.). - ⚙️ Apply Workflows: Use the suggested workflows as a baseline for your analysis process in practice labs.
- 🧪 Practice Relentlessly: The key to BTL1 success is hands-on practice. Use resources like BTLO, CyberDefenders, TryHackMe, and BOTS datasets. This guide serves as your reference during practice.
- ✍️ Adapt & Contribute: This is a living guide. Fork it, add your insights, or suggest improvements via Issues or Pull Requests. See
CONTRIBUTING.md.
While originating from personal study notes (including experience leading to a BTL1 Gold Coin), this guide aims to be a valuable community resource. Contributions are welcome! Please refer to the
CONTRIBUTING.mdfile for guidelines and open an Issue for suggestions or bug reports.
The information herein is based on personal experience, study of BTL1 domain concepts, and publicly available resources. Cybersecurity is dynamic; always cross-reference with the official BTL1 syllabus and tool documentation. Use this information responsibly.
Crucially: The Security Blue Team Non-Disclosure Agreement (NDA) is strictly respected. This repository does not contain specific exam content, direct solutions, or any proprietary information protected by the NDA. It focuses on consolidating knowledge and techniques applicable to the BTL1 domains in general.
Distributed under the MIT License. See the LICENSE file for more details.
Nervi0zz