Blue Team Level 1 (BTL1) Journey — Review & Tips

My Journey with the Security Blue Team Level 1 (BTL1) Certification: A Review & Tips

Back In Aug 2023, I successfully passed the Blue Team Level 1 (BTL1) exam from Security Blue Team (SBT), with perfect scoring 100%. This certification is designed to provide practical skills for working as a SOC analyst, and I’d like to share my experience with both the training and the exam, in hopes that it helps those preparing for or considering taking it.

What is BTL1?

The BTL1 certification is one of the few comprehensive blue team trainings available that focuses on hands-on, real-world techniques. It covers the following domains:

• Phishing Analysis
• Threat Intelligence
• Digital Forensics
• SIEM (Splunk)
• Incident Response

Each domain is packed with techniques and tools that will be invaluable in any DFIR (Digital Forensics and Incident Response) or Threat Hunting role. Here’s a breakdown of what you can expect from each domain, along with some tips and resources I found helpful during my studies.

Phishing Analysis 🎣

In the phishing analysis section, you learn how to analyze phishing emails — both manually and with tools like Phishtool. You’ll extract artifacts such as malicious URLs, attachments, and other indicators of compromise (IOCs).

One of the most valuable lessons here is how to write professional reports based on your findings. This skill will be crucial in your role as an analyst, as clear communication of your analysis is key.

Threat Intelligence 🧠

This domain focuses on the theoretical side of threat hunting, particularly the study of Tactics, Techniques, and Procedures (TTPs) used by attackers. You’ll explore the MITRE ATT&CK framework, which helps analysts understand how attackers operate. The course provides great examples of malware still relevant today, giving you a clear understanding of the threats you’ll encounter in the field.

In addition to theory, you’ll also get hands-on experience setting up MISP (Malware Information Sharing Platform) in your lab environment — a great tool for tracking and sharing threat intelligence.

External Resources: MITRE ATT&CK

Digital Forensics 🕵️

Digital forensics is a cornerstone of incident response. In this domain, you’ll learn how to uncover evidence of an attacker’s activity on both Windows and Linux systems. The course introduces you to tools like Volatility and Autopsy, and guides you through hands-on labs where you’ll use them to track attackers’ movements.

External Resources TryHackMe Practice:

• Investigating Windows ( Series)
• Window Forensics
• Autopsy

SIEM (Splunk)🔎

The SIEM section is often the trickiest part of the exam, and for many students, Splunk can be overwhelming. This section teaches you how to set up Splunk in your lab and run basic queries to uncover malicious activities.

My personal favorite part of this section was the chance to participate in Boss of the SOC (BoTS) version 1 — a blue team Capture the Flag (CTF) challenge. It’s an incredibly fun way to put your skills to the test, and I’m still playing it even after passing my BTL1!

External Resources TryHackMe: Splunk: Exploring SPL

Incident Response 🚧

The Incident Response domain teaches you how to manage and respond to security incidents using the NIST Incident Response Process. My favorite part of this section was learning about the MITRE ATT&CK framework, which is an essential tool for understanding the tactics used by attackers.

You’ll also set up and work with pfsense and Snort in your lab, which helps round out your knowledge of network defense tools.

My Exam Experience 🎓

Now, about the exam itself — it’s one of the most fun and challenging exams I’ve taken. While I’m unable to share specific details due to a non-disclosure agreement, I can assure you that it’s a highly practical test that mirrors real-world scenarios. The exam mirrors real-world DFIR scenarios, testing your ability to investigate an attacker’s actions within an environment. It’s a long and detailed process, so don’t underestimate it.

The exam is long and mentally taxing, so I highly recommend taking regular breaks and pacing yourself. Be prepared to document everything — take plenty of screenshots and notes. This will not only help you during the exam but also valuable for you to develop strong report-writing skills, as these will be critical in your future SOC work.

Study Tips and Exam Preparation

The BTL1 exam is fully hands-on, so it’s essential to practice and become familiar with the tools. I spent time learning each tools on external resources as well to deepen my understanding, although the course material is more than sufficient to help you pass.

Here’s how I prepared:

• Study for 1–2 hours a day (The Power of Consistency: A Key to Success)
• Took about 60 calendar days to complete preparation
• Used Proper Notes App (select any app based on your favorite one) for organizing open-book exam notes
• Created personal playbooks for tasks like email analysis, SIEM query and CLI commands

I also recommend spending time on **Blue Team Labs Online to practice further — simply search by tag BLT1** in BTLO platform. It helped build my confidence before the exam.

Before and During Exam Day

Make sure to rest before the exam. Take at least 2–3 days off from studying to recharge. On the exam day, having support (like a friend or family member to help with food, drink and other needs) can make a big difference.

I completed the exam in 13 hours without breaks, but remember, the 24-hour window allows you to pace yourself. You can take breaks or even sleep between tasks.

Why mention this? It’s an open-book exam with a full 24 hours to complete it (there’s no report-writing required), giving you the freedom to structure your time however you like — it’s up to you!. Take breaks, get some rest, review at your own pace, or even go for a walk if you need a breather. Make the schedule work for you!

During my 13-hour attempt, I handled a real-world incident with provided environment. I conducted a forensic investigation, access infected systems, gathered artifacts, and answered the exam questions. Throughout the process, I often revisited my answers as I uncovered more evidence. After 10 hours of non-stop work, I decided to take a nap, but nope! — my mind kept dwelling on the investigation and unanswered questions😑. So, I went back, spent 3 more hours tackling the final two questions. It was a real brain teaser since I had narrowed it down to two possible choices for each question. I kept debating and digging for proof my final decision. Once I felt confident, I submitted right away without reviewing again 🙈(5 am no more overthinking!). What a thrill! In the end, I saw that glorious green screen — yes!! I did it👏 , passed with a perfect 100% and achieved the golden coin! 🎉— Finally, I could sleep peacefully! 🛌 💤

Golden Coin Achieved! 🎉

Addition Exam Tips 💡

• Maintain a timeline of your investigation steps and findings.
• Pay attention to the scenario details, as they guide your investigation.
• Use the internet to your advantage — search for useful queries or solutions as you would in a real IR environment.
• Connect an extra monitor for the exam to boost productivity.
• Stay calm, focus, and avoid rushing. Careful analysis is key to passing the exam.

General Tips for Success 💬

Here are a few tips that helped me succeed:

• Take notes: During the course, jot down important points, especially regarding tools and techniques.
• Practice, practice, practice: Use the BTLO platform to familiarize yourself with the tools and scenarios you’ll encounter.
• Don’t rush: Speed won’t earn you extra points. Take your time, read the scenarios carefully, and double-check your work.
• Google is your friend: Don’t hesitate to look things up during the exam. The goal is to solve the challenge, not to memorize everything.

Is BTL1 Worth It?

At £399, the BTL1 course is reasonably priced, especially considering the amount of material it covers. Compared to other blue team certifications, this one offers an extensive, hands-on experience that prepares you well for a role in a SOC.

If you’re looking to gain practical blue team skills and are serious about advancing in cybersecurity, I highly recommend this certification. Not only will it teach you valuable skills, but it will also help you enjoy the learning process. So, dive in, have fun, and go get that golden coin! 🏅

Blue Team Labs Online (BTLO)

The best way to pass the BTL1 exam is through consistent practice. Blue Team Labs Online (BTLO) — is an excellent platform for honing your skills.

I highly recommend investing in the Pro version, as it allows you to complete more investigations using the same tools you’ll encounter during the exam. BTLO also remains a valuable resource even after you achieve certification.

By combining a solid training course with real-world tools and a practical exam, BTL1 sets you up for success in the blue team field.

In conclusion, if you decide to pursue the BTL1 certification, I hope you enjoy the experience as much as I did. It’s a challenging but rewarding journey — have fun with it, and good luck!

***Notices: This is my first blog post, inspired and insights by the expertise. I’m excited to share knowledge, experiences, and practical tips gathered through real-world challenges. As I embark on this journey, please feel free to correct me, offer suggestions, or share your own insights — I’d love to learn and grow together. Thank you for reading!

Read and inspire from our expertise

[embed]0xBera | How to prepare for the BTL-1 exam This article explains how to approach the BTL-1 certification exam in an effective and intelligent way.berardinellidaniele.com

[embed]A Review On Security Blue Team BTL1 About a month ago, I passed my Blue Team Level 1 (BTL1) exam from Security Blue Team (SBT). I would like to share a…bohansec.medium.com

[embed]Mastering BTL1: Journey, Tips, and Insights for Cyber Defenders Discover the BTL1 certification journey, learn valuable tips, and gain insights into the cybersecurity training course…infosecwriteups.com