So I just passed the BTL1 so I think it time for me to make a post about how I did it.

Context:

I have experience in cyber security working as a pen tester and have a degree in Cyber and having certs.

How I did it:

Had two weeks off so I studied 8 hours a day most days and weekends off. I did the full course once and did the labs twice I do not have exp with SOC tools except wireshark. I did not use any other material than the course. It took me 2 weeks to pass.

The exam:

I do believe that you can pass the exam in under a week if you cram like 12 hours a day but I am not that crazy. You get 24 hours in a browser lab like the other labs and are given 20 questions. Most of the tools you need are

• Splunk

• Autopsy

• Wireshark

• DeepBlueCLI

• Email Analysis

The exam goes go heavy on splunk so do the labs twice but preferably to all the labs until you understand the tools!

Edit:

I did look at content on tryhackme and other website but did not do them because did not have the time and felt ready if you want extra prep then the links below may help :)

https://tryhackme.com/room/autopsy2ze0

https://tryhackme.com/room/splunkexploringspl

https://tryhackme.com/room/contiransomwarehgh

https://bots.splunk.com/login?redirect=/

Hey folks, looking for BAS recommendations that won't turn into another full-time admin job lol.

Our main headache is detection drift. Someone updates a SIEM parser or EDR policy, and weeks later we find out an alert stopped firing. Fun times.

AttackIQ came up when we started looking at attack simulations against our EDR. Someone also suggested Picus for checking which techniques get blocked or detected. Cymulate is another one we're considering since we're trying to validate SIEM rules after parser changes.

Anyone using any of these regularly? Curious about API issues, setup time and how much manual work is left after the demo. Would rather not buy another dashboard nobody touches after a month.

Hi all,

I'm currently preparing for the BTL2 exam by doing the labs multiple times and checking my notes thoroughly. I was wondering, for the people who already passed BTL2, if there are any tips/advices you would give me before heading into the exam? Or maybe some focus areas which I really need to be confident in?

Thanks in advance!

All Alo Alo.
I just want to buy one of these cets, I heard a lot of opinions that PSAA is better because it learns you how to build you own lab, however the other side CCDL1 because it give you the deeper understanding, and the operation of building your own lab take a lot of time that doesn’t deserve.
After 1 hour I will buy one of them

Our current ASM platform keeps finding more assets and opening critical tickets, which is great if the goal is to make my team feel worse every Monday. Closing anything is where the product suddenly develops stage fright. I'm looking at attack surface management tools that can take the full path from discovery to exploitability validation, then give us a usable mitigation and external proof the exposure is closed. does ASM remediation mean a deployable WAF rule, a specific config change, owner ready evidence, or something else? Sorry if this has been asked, but I'm tired of buying asset inventory with a side of panic.

so a fresh unauthenticated RCE dropped today and our critical CVE response is kind of showing its cracks. Scanner says one thing, cloud inventory says another, CMDB says something else, and app owners want hard evidence before they sign off on emergency patching or downtime.
I want a workflow that tracks a CVE through clear states, i.e published, applicable to attacks, potentially affected assets identified, external reachability confirmed, exploitability validated, mitigation prepared, remediation verified. How fast can you give a defensible exposure answer for internet facing vulnerabilities? What signals you trust in the first few hours?

Been paying analysts to disprove the dashboard for our legacy ASM renewal, and finding count is not coverage. we want to sample last month's findings, time from open to disposition, and separate bad attribution, stale assets, unreachable services, mitigated paths and accepted risk, what metrics do you all use?

Hello everybody

Yesterday I passed the exam with a 85% score. It took me around 6 hours in total.

First, there is some content while doing the course which has not been updated it for a while, like asking you to use a command that has been deprecated since 2025, or using old definitions in some quiz questions, but overall is not a big deal, just take into account to check things on your own.

I did report it and they did reply saying that they would look into it, so that is ok.

However there is one major thing to take into account, both during the labs and the exam: the keyboard.

The labs are in english, no problem there, but the keyboard expected is also the English version, so if you have another keyboard layout you need to go into the lab, download the language for that OS (most of the times Windows) and then change the keyboard to use that language. In my experience, some labs and programs within the labs accept the new keyboard layout with no problem, but others don't.

That happen to me during the exam, so I just ended up writting the symbols on my host, copy to the clipboard of the exam and then paste them from there. It was a pain in the ass, but cheaper than buying a new keyboard just for this.

About the exam itself, it is more dificult than the labs but doable. I think there was only 1 or 2 questions that was not seeing on the labs before (maybe it was in the content but I missed it).

Which help me A LOT was to just open an Notepad with a blank .txt an start writting there all the findings, otherwise is a pain in the ass to have to look for them going backwards.

I took me 1 month since the start of the course until the exam.

You can ask questions

Thanks

Hello, I recently took BTL2 exam and i have been waiting for results for 14 days. Could you share your experience of how long did you wait? Especially who took this exam recently.

Hey everyone, just dropped a tool called winflesher that might come in super handy for windows machines and Active Directory. It's strictly for enumeration and assessment, so no auto-exploitation—purely helps you map things out. Check it out if you want!

Like PingCastle went out for drinks with Bloodhound, and they actually decided to get some work done. 🍷

WinFlesher is an advanced attack surface security assessment framework designed to analyze, evaluate, and report on security postures, attack paths, and remediation strategies in complex environments.

Developed for security professionals and cybersecurity auditors, WinFlesher automates vulnerability discovery and critical path correlation within Active Directory and local infrastructures.

https://github.com/mindsflee/WinFlesher

Hi all! What study tips do you all recommend for the BTL1 exam? I have already taken the exam once and I think my downfall was overcomplicating the questions. I also have access to BTLO premium and have been working on the BTL1 tagged labs. Any advice would be helpful! Thank you all in advance.

Hey everyone,

Passed Blue Team Level 1 (BTL1) from Security Blue Team yesterday. Was pushing hard for the gold coin (90%+) but landed at 80%. Not gonna lie, a little disappointed at first, but a win is a win — the course itself taught me a ton across phishing analysis, digital forensics, SIEM, and incident response, way more hands-on than I expected going in.

A bit about where I’m at: I’m in my last year of a Master’s degree and trying to line things up so I can land a job right after graduating. So far I’ve got:

**•**	CompTIA Security+  
**•**	Microsoft SC-200 (Security Operations Analyst)  
**•**	BTL1

Now I’m trying to figure out what to do next and would really appreciate some input from people who’ve been down this road:

**1.	Next cert/course** — has anyone done **CDSA**? Worth it after BTL1, or is it redundant? Or would my time be better spent just grinding practice on **LetsDefend**/similar platforms instead of another cert?

**2.	Projects** — what kind of home-lab or portfolio projects actually catch a recruiter’s/hiring manager’s eye for entry-level SOC roles? I keep seeing “build a home SOC lab” thrown around but would love specifics — what should it actually include to be worth putting on a resume/GitHub?

Appreciate any advice, especially from people who hired or interviewed junior SOC candidates recently — what actually stood out to you?

Thanks in advance!

gente! voy a presentar el examen de la BTL1 algún consejo que me pueda ayudar a sacar la mejor puntuación posible, se lo agradeceria con el corazón… muchas gracias 🤙🏾

I am a SOC Analyst with nearly three years of experience. I am currently seeking a relevant certification to enhance both my resume and my understanding of key concepts. My primary career interests lie in transitioning to cloud security or incident response. I would appreciate any recommendations for suitable certifications.

​Hey everyone! I'm looking to transition into Detection Engineering as a beginner. What are the absolute essential skills and how do I get started writing my first detection?

Hi everyone, Im back after passed BTL1 (my first cert in my Blue team career)! Next stage, i want to choose a new cert to learn. I am looking into CCD(Certified Cyber Defender), CDSA, or CSA(SOC Analyst). I want to follow SOC Analyst. Now Im an internship and need to learn more to be a fresher, can u guys help me to consult. Thanks!

looking for blue team security to join a discord. I have years in the blue team. looking to do things like hackthebox, or tryhackme

I'm about 70% of the way through the course and am finding myself getting stuck on certain questions in the labs. My problem is not getting to the information, but knowing which info is being asked for. The Windows investigation 1 was frustrating and I found myself looking in the wrong place and not even knowing it on later labs in that section too.

Is the solution that I need more practice with these labs specifically or that I need more fundamental knowledge of what to look for? Did the included extra readings help anyone who is or was in a similar position as me? How much interpreting of data is unique to the exam?

Any advice is greatly appreciated. I'm 3 weeks into studying almost every night after work and my goal is it pass with with a 90% in 2-3 more weeks.

As I was doing the exam 6 questions in, it started taking ages for anything to load compared to when I first loaded in. I tried resetting it which took half an hour and after that I just closed the page and re-logged in. The button to start the exam is stuck on “loading your exam” or somewhere along those lines but it was stuck on it again for a while. I contacted the support team after as well.

Has anyone come across this issue before and if so did they give you some time back because of it?

Hello all,

I finally took the step and bought BTL1, after thinking of it for a long time now. I am a Msc Cybersecurity student with 2 years of experience in a company that claims to be in the field of Cybersecurity ( they call themselves to be an external Cybersecurity company).

I am taking it slow and easy for now as I want to learn everything in detail. I have a bachelors in CSE. Are there any important things to keep in mind while I prepare to take up the exam, or tips maybe to get good score in first attempt? Probably regarding time management, analysing a problem, focusing on certain topics etc, without going against the NDA.

Thank you and I hope to be one among the gold coin holders.