03Completed

Integrated Blue Team Operations Lab

One synthetic incident travels across five defensive roles, turning isolated security topics into an operational handoff.

THE QUESTION

What changes when students follow one incident from telemetry and detection all the way to safe automation?

WHAT WE BUILT

01Five linked, hands-on days

02Scenario BT-2026-0615

03OpenSearch, Sigma, Python and local fixtures

04NIST SP 800-61r3 and MITRE ATT&CK

0516/16 final acceptance checks passed

SYSTEM FLOW

01SOC

02DETECTION ENGINEERING

03THREAT HUNTING / CTI

04DFIR / IR

05SOAR AUTOMATION

Completed. The final English course package is approved for delivery.