BLUETEAM SOC ACADEMY

Security Operations Command Center

Train like an analyst. Investigate evidence. Reconstruct attacks. Make defensible SOC decisions.

SOC
MODE

EVIDENCE HUNT DETECT RESPOND

INVESTIGATION CASES50Available in the queue

OPEN50Waiting for analyst action

IN PROGRESS0Currently being investigated

CLOSED0Completed investigations

YOUR CURRENT MISSION

Investigate. Don't Guess.

Work the queue like a Tier 1 analyst. Validate the alert, collect evidence, correlate related activity, reconstruct the attack and document a defensible verdict.

ALERT→EVIDENCE→HUNT→DECIDE→PROVE

SOC SKILL STACK

What You Are Building

01InvestigationEvidence-first analysis

02Threat HuntingFind what the alert missed

03Detection EngineeringTurn evidence into detections

04Incident ResponseContainment and escalation

START HERE

Recommended Investigation

BOTS-001 · EC2 Instance Metadata Access

Investigate the metadata request, identify the initiating process and determine whether the activity is authorised.

TRAINING ENVIRONMENT

Know Your Data

BlueTeam uses historical BOTS v2 investigation evidence plus clearly labelled synthetic training scenarios. This is a simulated environment — no live customer tenant or production telemetry is connected.

Historical EvidenceSynthetic ScenariosSafe Training

QUICK ACCESS

Choose Your Next Drill

SOC RULE

Never Close on One Clue

One alert is a starting point — not the conclusion. Correlate identity, endpoint, network, email and timeline evidence before making the final decision.

ALERT→CONTEXT→CORRELATION→VERDICT

⚡ SOC Investigation Queue

50 investigation scenarios · Real-world cases, attack-chain pivots and realistic false positives

SOC workflow: Alert → Evidence → Hunt → Correlate → Reconstruct → MITRE → Detect → Respond → Prove.

Alert ID	Alert name	Category	Severity	User / host	Status

SOC Learning Path

Original beginner-to-advanced SOC curriculum covering cybersecurity foundations, enterprise security, SIEM, detection engineering, threat hunting, incident response and capstone investigations.

24 MODULES · BEGINNER → ADVANCED

Become a SOC Analyst — from Zero to Advanced

Learn the concept → practise in the lab → investigate evidence → write the finding → improve the detection.

This curriculum is written in original wording for BlueTeam SOC Academy. It uses the uploaded handbook's subject areas as a study reference, but does not reproduce its author name, branding, or long-form text.

📘LearnUnderstand the concept

🧪PracticeUse a safe lab

🔎InvestigateCorrelate evidence

📝ReportExplain the finding

🚀AdvanceHunt & engineer

What you will master

Cybersecurity, networking, Windows/Linux and IAM foundations
Cryptography, security technologies, cloud and vulnerability management
SOC operations, telemetry, SIEM and KQL investigation
Incident response, digital forensics, detection engineering and MITRE ATT&CK
Threat hunting, Microsoft-centric investigations, endpoint, email, network and cloud playbooks
Capstone cases, reporting, professional practice and career-ready investigation skills

How each module works

1. Concept: learn the technical foundation.

2. SOC perspective: understand what an analyst looks for.

3. Practical: perform a safe hands-on exercise.

4. Knowledge check: prove understanding before moving on.

Progression

Beginner · 1–5Foundations and core technical knowledge.

Intermediate · 6–16Enterprise controls, SOC operations, telemetry and SIEM.

Advanced · 17–24Detection engineering, hunting, response and capstone work.

Important

All labs should be performed only on systems and accounts you own or are authorized to test. The platform's simulated data is training data unless a page explicitly states otherwise.

24-Module SOC Roadmap

Module 1 · Cybersecurity Foundations

Build the security vocabulary and mental models needed before SOC work.

Beginner

Module 2 · Networking Fundamentals for SOC Analysts

Understand network traffic so you can read IPs, ports, protocols and communication paths.

Beginner

Module 3 · Operating Systems & Windows/Linux Basics

Learn the OS evidence an analyst sees during endpoint investigations.

Beginner

Module 4 · Identity & Access Management

Understand identities, authentication, authorization and modern enterprise access controls.

Beginner

Module 5 · Cryptography & Trust

Understand encryption, hashing, certificates and TLS without confusing their purposes.

Beginner

Module 6 · Enterprise Security Technologies

Understand what each major security control sees and how SOC analysts correlate them.

Beginner–Intermediate

Module 7 · Cloud Security Fundamentals

Move from on-prem concepts to cloud identity, networking, storage and shared responsibility.

Beginner–Intermediate

Module 8 · Vulnerability Management

Learn how security weaknesses are discovered, prioritized and remediated.

Intermediate

Module 9 · Security Operations Center

Understand how a professional SOC operates from alert creation through closure.

Intermediate

Module 10 · Incident Response & Digital Forensics

Learn structured response and evidence preservation from identification to recovery.

Intermediate

Module 11 · Governance, Risk & Compliance

Understand the business side of security operations and why analysts document controls and risk.

Intermediate

Module 12 · Security Frameworks, Standards & Regulations

Use frameworks as organizing structures rather than memorizing names.

Intermediate

Module 13 · Cybersecurity Career & Analyst Development

Turn technical learning into a measurable SOC career roadmap.

Beginner–Intermediate

Module 14 · Hands-on Enterprise Security Lab

Build a safe lab that connects endpoint, identity, network and SIEM telemetry.

Intermediate

Module 15 · SOC Telemetry & Analyst Data Literacy

Learn where security evidence comes from and how to judge its quality.

Intermediate

Module 16 · SIEM, KQL & Alert Investigation

Query security data and turn results into an investigation.

Intermediate

Module 17 · Detection Engineering & MITRE ATT&CK

Move from consuming alerts to designing defensible detections.

Advanced

Module 18 · Threat Hunting & Threat Intelligence

Develop hypotheses, search broadly and use intelligence without losing analytical discipline.

Advanced

Module 19 · Identity Attacks & Microsoft-Centric Investigations

Investigate account compromise across Entra ID, directory, mailbox and cloud activity.

Advanced

Module 20 · Endpoint Investigation, Malware Triage & Ransomware

Investigate execution chains and understand containment priorities.

Advanced

Module 21 · Network, Email & Cloud Investigation Playbooks

Combine domain-specific evidence into repeatable investigation workflows.

Advanced

Module 22 · SOC Capstone: Alert to Executive-Quality Incident Report

Demonstrate end-to-end analyst capability on a realistic multi-source case.

Advanced

Module 23 · Advanced SOC Analyst Professional Practice

Develop the habits that make investigations reliable, scalable and defensible.

Advanced

Module 24 · Global SOC Case Studies & Capstone Investigations

Apply the full methodology to varied attack scenarios and produce defensible conclusions.

Advanced

Lesson Workspace

Select a module above to begin.

0Lessons completed

0Quizzes passed

0%Course completion

CrowdStrike EDR Lab

Dedicated endpoint detection, investigation, incident response and threat hunting workspace. Built as a hands-on training environment.

EDR • IR • THREAT HUNTING

BLUE TEAM PRACTICAL WORKSPACE

CrowdStrike Falcon — From Detection to Response

Learn the endpoint investigation lifecycle: understand endpoint telemetry, review detections, investigate processes and network connections, manage policies and indicators, contain hosts, use authorised Real Time Response actions, and build threat-hunting hypotheses.

🖥️EndpointSensor + telemetry

🚨DetectionSignal / alert

🔎InvestigationProcess + host + user

🧭HuntHypothesis + search

🛡️ResponseContain + remediate

01 · Endpoint Security Foundation

Understand what an endpoint is, why it must be protected, and how endpoint telemetry supports security investigations.

EndpointComputer, laptop, server and other managed devices.

TelemetryProcess, file, connection, system and user activity.

EDRDetection, investigation and response around endpoint behaviour.

Interview focus: endpoint security, EDR vs traditional antivirus, fileless malware, ransomware and common malware terminology.

02 · How EDR Works

EDR collects endpoint context and applies analytics to identify potentially suspicious behaviour. Analysts then validate the evidence rather than accepting an automated verdict blindly.

Process / File / Network / System / User telemetry

↓

Sensor collection & analytics

↓

Detection / investigation context

↓

Analyst decision & response

03 · EDR vs Antivirus vs SIEM

Traditional Antivirus

Primarily focuses on malware prevention and detection using signatures and other detection methods.

EDR

Adds continuous endpoint visibility, behavioural detection, investigation context and response actions.

SIEM

Centralises and analyses logs across many sources to support correlation and investigation.

Practical rule

SIEM helps answer “what happened across the environment?” while EDR helps answer “what happened on this endpoint?”

04 · Cyber Kill Chain & MITRE ATT&CK

Use attack frameworks to structure an investigation and communicate where an observed behaviour fits in an attack.

ReconTargeting

WeaponizePayload

DeliverInitial access

ExploitExecution

InstallPersistence

C2 / ImpactObjective

MITRE ATT&CK is used as a behavioural mapping framework. Map only what the evidence supports; do not force a technique onto an alert.

05 · Falcon Platform Administration

Understand Falcon architecture and sensor deployment.
Install / uninstall sensors through authorised procedures.
Monitor sensor health.
Manage hosts, host groups and users.
Understand detection and prevention policy structure.

Create a practice host group

Review sensor health

Review user/host management

Document a policy change

06 · Endpoint Security Controls

Practice the defensive configuration areas covered in the source training: endpoint detections, prevention policies, USB controls, exclusions and indicator management.

PoliciesDetection and prevention configuration.

USB controlUnderstand device monitoring and policy exceptions.

ExclusionsUse narrowly and document the business/security reason.

IOC managementTrack and act on approved indicators.

Indicator graphExplore relationships between indicators and observed activity.

On-demand scanUse scanning as an additional validation step.

07 · Detection Investigation

Work a detection from alert context to evidence-backed disposition.

1Read detection

2Identify host

3Review process

4Check file/hash

5Review network

6Decide + document

Evidence to capture: detection time, hostname, user, process path, command line, parent process, hash, network connections, related detections and any authorised response already performed.

08 · Falcon Search & Timeline Analysis

Search by event, host and hash.
Review hash executions.
Search IP addresses and bulk domains.
Build scheduled searches where appropriate.
Pivot through host, process and user timelines.

Event search

Host search

Hash / IOC

Timeline

Correlation

09 · OSINT & Malware Analysis

Use approved external enrichment tools to add context to indicators. Treat third-party verdicts as evidence, not as the complete investigation.

Static analysisFile metadata, hashes and reputation context.

Dynamic analysisObserve sandbox behaviour in an approved environment.

Script analysisSafely decode or inspect suspicious PowerShell content.

Training rule: never upload confidential company data or live secrets to public analysis services.

10 · Incident Response Using EDR

Connect EDR evidence to the incident-response lifecycle: detection, analysis, containment, eradication, recovery and lessons learned.

DetectIdentify

AnalyseScope

ContainLimit impact

EradicateRemove cause

RecoverRestore

LearnImprove

11 · Host Network Containment

Understand network containment as a response action used to restrict a potentially compromised host while maintaining the required management connectivity.

Confirm affected host

Record reason and timestamp

Contain under authorised procedure

Observe host behaviour

Collect required evidence

Lift containment only when approved

Exercise: in a lab, simulate containment and document the expected host behaviour and recovery decision.

12 · Real Time Response (RTR)

Study the capabilities available for authorised remote response on Windows, macOS and Linux hosts.

ProcessList and investigate running processes; stop a process only when authorised.

NetworkReview active network connections.

FilesNavigate, collect or manage files under procedure.

Host controlRestart or shut down when approved.

ScriptsRun approved scripts/executables.

DiagnosticsCollect logs and system information; Windows may support deeper diagnostics.

Lab exercise: connect to a dedicated test host, use help, inspect processes/network/files, calculate a file hash and document every action.

13 · Threat Hunting

Threat hunting is proactive searching for suspicious activity that automated detections may not have surfaced.

Hypothesis

↓

Define scope + telemetry

↓

Search + pivot

↓

Validate + expand

↓

Document findings + detection gap

14 · Threat Hunting Methods & Pyramid of Pain

StructuredHunt from known patterns or intelligence.

UnstructuredExplore unusual behaviours and anomalies.

SituationalHunt around a specific incident or threat.

Use the Pyramid of Pain to understand that some indicators are easier for attackers to change than others. Prioritise behavioural and higher-value evidence where appropriate.

15 · Threat Intelligence

Understand threat actors and indicators.
Use intelligence to enrich detections and hunts.
Research malware families and campaign context.
Turn useful intelligence into monitoring or detection ideas.
Document source, confidence and relevance.

16 · Malware Case Study: Emotet → TrickBot → Ryuk

Study the multi-stage relationship presented in the training material as an example of how malware can enable follow-on activity.

📧Initial deliveryPhishing / malicious content

🦠EmotetInitial malware stage

🧩TrickBotCredential / access activity

🔐ExpansionPersistence / lateral activity

💥RyukRansomware impact

Use this as a case-study model for building an evidence chain. The exercise should focus on identifying telemetry that supports each stage rather than memorising malware names.

17 · XDR Fundamentals

Understand why security operations evolved from isolated endpoint, network and identity controls toward broader cross-domain detection and response.

XDR

Correlates telemetry across security domains to improve detection, investigation and coordinated response.

SIEM

Centralises logs and provides broad search, analytics and correlation; response may require additional tools.

Key XDR topics

Telemetry and log sources
Detection monitoring
Event investigation and queries
Custom detection logic
Response actions and notifications

18 · XDR Operations & Automation

Data ingestion and source health.
Detection and response configuration.
Event investigation and query workflows.
Scheduled searches and custom detections.
Notification delivery.
Workflow automation and playbook concepts.

Automation should make a repeatable workflow faster, not remove analyst validation from high-impact actions.

19 · Interview & Practical Readiness

Explain EDR vs antivirus

Explain EDR vs SIEM

Walk through a detection investigation

Explain containment vs eradication

Explain RTR use cases

Describe a threat-hunting workflow

Explain MITRE ATT&CK usage

Explain a malware attack chain

20 · Capstone: Complete EDR Investigation

Work one simulated endpoint incident from start to finish.

Read the detection and identify the affected host.
Build a process and user timeline.
Inspect command line, file and hash evidence.
Review network connections and related indicators.
Enrich indicators using approved sources.
Map supported behaviours to ATT&CK.
Determine scope and confidence.
Recommend containment and remediation.
Write the incident timeline and root-cause hypothesis.
Produce the final analyst handover.

Security Operations Command Center

Investigate. Don't Guess.

What You Are Building

Recommended Investigation

Know Your Data

Choose Your Next Drill

Never Close on One Clue

⚡ SOC Investigation Queue

Investigation

Alert evidence

🔎 BOTS v2 Logs / Event Data

Analyst task

Investigation checklist

KQL Practice

Simulated query output

Query explanation

KQL Use-Case Library

SOC Learning Path

Become a SOC Analyst — from Zero to Advanced

What you will master

How each module works

Progression

Important

Module 1 · Cybersecurity Foundations

Module 2 · Networking Fundamentals for SOC Analysts

Module 3 · Operating Systems & Windows/Linux Basics

Module 4 · Identity & Access Management

Module 5 · Cryptography & Trust

Module 6 · Enterprise Security Technologies

Module 7 · Cloud Security Fundamentals

Module 8 · Vulnerability Management

Module 9 · Security Operations Center

Module 10 · Incident Response & Digital Forensics

Module 11 · Governance, Risk & Compliance

Module 12 · Security Frameworks, Standards & Regulations

Module 13 · Cybersecurity Career & Analyst Development

Module 14 · Hands-on Enterprise Security Lab

Module 15 · SOC Telemetry & Analyst Data Literacy

Module 16 · SIEM, KQL & Alert Investigation

Module 17 · Detection Engineering & MITRE ATT&CK

Module 18 · Threat Hunting & Threat Intelligence

Module 19 · Identity Attacks & Microsoft-Centric Investigations

Module 20 · Endpoint Investigation, Malware Triage & Ransomware

Module 21 · Network, Email & Cloud Investigation Playbooks

Module 22 · SOC Capstone: Alert to Executive-Quality Incident Report

Module 23 · Advanced SOC Analyst Professional Practice

Module 24 · Global SOC Case Studies & Capstone Investigations

CrowdStrike EDR Lab

CrowdStrike Falcon — From Detection to Response

01 · Endpoint Security Foundation

02 · How EDR Works

03 · EDR vs Antivirus vs SIEM

04 · Cyber Kill Chain & MITRE ATT&CK

05 · Falcon Platform Administration

06 · Endpoint Security Controls

07 · Detection Investigation

08 · Falcon Search & Timeline Analysis

09 · OSINT & Malware Analysis

10 · Incident Response Using EDR

11 · Host Network Containment

12 · Real Time Response (RTR)

13 · Threat Hunting

14 · Threat Hunting Methods & Pyramid of Pain

15 · Threat Intelligence

16 · Malware Case Study: Emotet → TrickBot → Ryuk

17 · XDR Fundamentals

Key XDR topics

18 · XDR Operations & Automation

19 · Interview & Practical Readiness

20 · Capstone: Complete EDR Investigation

Final Objective

AI SOC Manager

Career progression & resume

Your analyst progression

Generate your resume draft

Resume preview

Progress & score

Reset training progress

Global Attack & Defense Case Studies

Think Like the Attacker. Defend Like the SOC.