Monitoring, detection and response. Splunk, ELK, Sigma rules, Snort/Suricata, Velociraptor, MISP and Threat Hunting with MITRE ATT&CK. Requires FC-01 and FC-02.
Why Blue Team is the backbone of cybersecurity
The numbers that explain everything
After the course you will be able to
Not theory — hands-on practice in a real SOC stack with live attacks and incidents
Real incidents in the course
We analyze high-profile breaches from the Blue Team perspective — what was missed, how to respond properly
Uber 2022 — SOC missed a social engineering attack
An attacker gained access to Slack, Confluence and AWS through MFA fatigue and social engineering. SOC failed to react to the first alerts. We break down how to properly build detection and response processes.
APT29 — how a Threat Hunter found what SIEM missed
Microsoft's Threat Hunt team discovered APT29 presence through DNS traffic anomalies that didn't trigger any SIEM rule. We demonstrate the hypothesis-driven hunting methodology.
How to become a Tier 3 SOC Analyst in 18 months
The story of an analyst who went from Tier 1 (L1 support) to Tier 3 Threat Hunter at a major European bank. From first SIEM alerts to independent Red Team hunt operations. A real career path.
Course Program
10 modules · 50 lessons · 4 themes: SOC Basics, SIEM & Detection, Endpoint & Threat Intelligence, Response & Optimization
Where this course leads
FC-06 — the starting point for a Blue Team career and entry into enterprise defense
SOC Lead / Manager
Lead a team of SOC analysts, build detection and response processes for the organization.
Threat Hunter
Actively search for threats in infrastructure before they become incidents. Hypothesis-driven hunting and TTP analysis.
Incident Responder / IR Lead
Investigate incidents, coordinate response, write post-mortems and recommendations for strengthening defenses.
Who this course is for
Blue Team beginners
Want to enter the world of defensive security, understand how SOC works from the inside and master corporate monitoring tools from scratch
IT professionals
System administrators and network engineers who want to transition to SOC Analyst or IR specialist with proven skills
After Red Team courses
Completed FC-05 and want to understand the other side — how Blue Team defends against attacks you studied. A unique dual perspective
Become a specialist
in defense
at enterprise level
52 hours of practice with Wazuh, Elastic SIEM, TheHive and Shuffle SOAR. Real incidents in a secure lab environment.