Resecurity® Certified Blue Team Operations Professional (RCBTOP)
Build the day-to-day skills of an effective blue team.
About this course
Build the day-to-day skills of an effective blue team. Across four and a half days you will follow the defensive cycle of detect, triage, investigate, hunt, respond and improve, working with logs, SIEM correlation, endpoint telemetry, detection logic and threat intelligence.
Controlled labs and incident response exercises let you practise on realistic enterprise attacks, then turn what you find into better detections and stronger defences. The course prepares you for the RCBTOP credential.
What you'll learn
- Explain how a blue team detects, triages, hunts, responds and improves.
- Analyse logs, alerts and security telemetry from network and endpoint sources.
- Triage and prioritise alerts with a consistent, documented method.
- Correlate events across data sources using SIEM concepts.
- Write and tune detection logic that reduces noise and closes gaps.
- Plan and run hypothesis-driven threat hunts informed by threat intelligence.
- Support containment and response during a live incident.
- Recommend defensive improvements based on attacker behaviour and attack paths.
Curriculum
- The defensive cycle
- Blue team roles and hand-offs
- Visibility and the data you need
- Working with the SOC and incident response
- Windows event logs
- Linux and network logs
- Cloud and identity logs
- Normalising data for analysis
- Triage workflow and severity
- Separating true and false positives
- Enrichment during triage
- Escalation and documentation
- SIEM architecture concepts
- Correlation rules
- Building investigation timelines
- Dashboards that help analysts
- Process and command-line telemetry
- Persistence indicators
- EDR alerts and investigation
- Endpoint isolation decisions
- From attacker behaviour to detection
- Mapping coverage to MITRE ATT&CK
- Testing and tuning detections
- Finding and closing detection gaps
- Hypothesis-driven hunting
- Using CTI to focus hunts
- Hunting for lateral movement
- Turning hunts into detections
- Containment options
- Evidence handover to responders
- Recovery checks
- Lessons learned
- Defensive security scenarios
- Incident response exercise
- Writing improvement recommendations
- Assessment preparation
Who it's for
SOC, security monitoring, detection, threat-hunting, endpoint and incident response analysts who defend enterprise environments.
Before you start
- Grounding in cybersecurity, networking, Windows and Linux, and basic logs and alerts.
- Newcomers can prepare with the RCCPF foundations course.
Prepares for
Related courses
More in Cyber Threat Intelligence & Investigations →Resecurity® Cybersecurity Professional Foundations (RCCPF)
Cyber Threat Intelligence & Investigations
View course →Resecurity® Certified Cyber Threat Intelligence Analyst (RCCTIA)
Cyber Threat Intelligence & Investigations
View course →Resecurity® Certified Digital Forensics & Incident Response Professional (RCDFI)
Cyber Threat Intelligence & Investigations
View course →Resecurity® Certified Financial Cyber Intelligence Analyst (RCFCIA)
Cyber Threat Intelligence & Investigations
View course →Resecurity® Certified Penetration Testing & Red Team Professional (RCPT)
Cyber Threat Intelligence & Investigations
View course →Resecurity® Certified Malware Analysis & Reverse Engineering Professional (RCMAR)
Cyber Threat Intelligence & Investigations
View course →Let's plan your next step together.
Tell us the course or certification you have in mind and we'll send the outline, upcoming dates, fees and private-team options.