Home / Certifications / Blue Team Analyst

Hacky Certified Blue Team Analyst

www.hackysecurity.ae/start

HCBT · Level 2

SIEM searches and log normalization

IOC triage and enrichment

MITRE ATT&CK mapping and Sigma

Endpoint process and persistence analysis

Network IDS and alert investigation

Identity and authentication anomaly analysis

IOC triage and enrichment

Self-paced · video, notes and labs

Introduction

Watch, triage and respond to alerts from a SOC seat. Three levels, each self-paced, each with its own exam and certificate.

Buy now

Author: Gaurav Sharma
Level: Level 2 · Practitioner
Study time: 24 hours
Certification: Hacky Certified Blue Team Analyst

#1Hands-on labsPractise every technique in hosted labs. No expiry or extensions.

#2Free examinationsTake as many attempts as you need. There is no charge for failing.

#3Lifetime accessCourse updates are free, so your knowledge stays current.

Curriculum

6 modules · 12 hours of guided learning · self-paced, with hands-on labs

Job-oriented, scenario-led progression in hacky certified blue team analyst. Exercises are conducted only in authorized training environments. The level builds on previous levels while adding distinct techniques, deeper evidence requirements and more complex capstones.

Prerequisites: Basic IT literacy and willingness to use Linux/Windows command lines.

Tool stack: Wazuh, Elastic, Splunk, Sysmon, Zeek, Suricata, Sigma, Velociraptor

3h guided instruction + 7h guided/independent practical labs + 2h reading, review and assessment. These are total learning hours, not 12 hours of live lectures.

Module 01SOC workflows, triage and case management2 h

Coverage. Identify core concepts, demonstrate the workflow, and record reliable evidence.

Practical. Complete a guided lab with baseline and expected evidence.

Evidence. annotated observations, reproducible steps, risk/impact notes and a concise technical recommendation.

Module 02TCP/IP, DNS, HTTP and network telemetry2 h

Coverage. Identify core concepts, demonstrate the workflow, and record reliable evidence.

Practical. Complete a guided lab with baseline and expected evidence.

Evidence. annotated observations, reproducible steps, risk/impact notes and a concise technical recommendation.

Module 03Windows/Linux logs and event IDs2 h

Coverage. Identify core concepts, demonstrate the workflow, and record reliable evidence.

Practical. Complete a guided lab with baseline and expected evidence.

Evidence. annotated observations, reproducible steps, risk/impact notes and a concise technical recommendation.

Module 04SIEM searches and log normalization2 h

Coverage. Identify core concepts, demonstrate the workflow, and record reliable evidence.

Practical. Complete a guided lab with baseline and expected evidence.

Evidence. annotated observations, reproducible steps, risk/impact notes and a concise technical recommendation.

Module 05IOC triage and enrichment2 h

Coverage. Identify core concepts, demonstrate the workflow, and record reliable evidence.

Practical. Complete a guided lab with baseline and expected evidence.

Evidence. annotated observations, reproducible steps, risk/impact notes and a concise technical recommendation.

Module 06MITRE ATT&CK mapping and Sigma2 h

Coverage. Identify core concepts, demonstrate the workflow, and record reliable evidence.

Practical. Complete a guided lab with baseline and expected evidence.

Evidence. annotated observations, reproducible steps, risk/impact notes and a concise technical recommendation.

Level capstone and assessment

Guided scenario: demonstrate correct methodology, collect evidence and submit a short structured report.

20% knowledge checks, 60% hands-on practical, 20% evidence-based reporting Recommended pass: 70% overall with mandatory completion of safety and evidence checkpoints.

Final exam

A 2-hour online exam with a 70% pass mark. Recommended pass: 70% overall with mandatory completion of safety and evidence checkpoints. Attempts are free until you pass. The exam opens 7 days after purchase.

Curriculum

9 modules · 24 hours of guided learning · self-paced, with hands-on labs

Prerequisites: Completion of Level 1 or demonstrably equivalent practical skills.

Tool stack: Wazuh, Elastic, Splunk, Sysmon, Zeek, Suricata, Sigma, Velociraptor

6h guided instruction + 13h guided/independent practical labs + 5h reading, review and assessment. These are total learning hours, not 24 hours of live lectures.

Module 01SIEM searches and log normalization3 h

Coverage. Investigate a realistic scenario, compare alternative approaches, tune decisions and document remediation.

Practical. Complete a case-based lab using multiple evidence sources and a verification checklist.

Evidence. annotated observations, reproducible steps, risk/impact notes and a concise technical recommendation.

Module 02IOC triage and enrichment3 h

Coverage. Investigate a realistic scenario, compare alternative approaches, tune decisions and document remediation.

Practical. Complete a case-based lab using multiple evidence sources and a verification checklist.

Evidence. annotated observations, reproducible steps, risk/impact notes and a concise technical recommendation.

Module 03MITRE ATT&CK mapping and Sigma3 h

Coverage. Investigate a realistic scenario, compare alternative approaches, tune decisions and document remediation.

Practical. Complete a case-based lab using multiple evidence sources and a verification checklist.

Evidence. annotated observations, reproducible steps, risk/impact notes and a concise technical recommendation.

Module 04Endpoint process and persistence analysis3 h

Coverage. Investigate a realistic scenario, compare alternative approaches, tune decisions and document remediation.

Practical. Complete a case-based lab using multiple evidence sources and a verification checklist.

Evidence. annotated observations, reproducible steps, risk/impact notes and a concise technical recommendation.

Module 05Network IDS and alert investigation3 h

Coverage. Investigate a realistic scenario, compare alternative approaches, tune decisions and document remediation.

Practical. Complete a case-based lab using multiple evidence sources and a verification checklist.

Evidence. annotated observations, reproducible steps, risk/impact notes and a concise technical recommendation.

Module 06Identity and authentication anomaly analysis3 h

Coverage. Investigate a realistic scenario, compare alternative approaches, tune decisions and document remediation.

Practical. Complete a case-based lab using multiple evidence sources and a verification checklist.

Evidence. annotated observations, reproducible steps, risk/impact notes and a concise technical recommendation.

Module 07Malware behavior and sandbox reports2 h

Coverage. Investigate a realistic scenario, compare alternative approaches, tune decisions and document remediation.

Practical. Complete a case-based lab using multiple evidence sources and a verification checklist.

Evidence. annotated observations, reproducible steps, risk/impact notes and a concise technical recommendation.

Module 08Threat intelligence and hunting hypotheses2 h

Coverage. Investigate a realistic scenario, compare alternative approaches, tune decisions and document remediation.

Practical. Complete a case-based lab using multiple evidence sources and a verification checklist.

Evidence. annotated observations, reproducible steps, risk/impact notes and a concise technical recommendation.

Module 09Detection tuning and false-positive reduction2 h

Coverage. Investigate a realistic scenario, compare alternative approaches, tune decisions and document remediation.

Practical. Complete a case-based lab using multiple evidence sources and a verification checklist.

Evidence. annotated observations, reproducible steps, risk/impact notes and a concise technical recommendation.

Level capstone and assessment

Multi-system case: independently correlate artifacts, prioritize findings and propose tested remediation.

20% knowledge checks, 60% hands-on practical, 20% evidence-based reporting Recommended pass: 70% overall with mandatory completion of safety and evidence checkpoints.

Final exam

A 24-hour practical exam in a hosted lab, then 24 hours to submit your report. Recommended pass: 70% overall with mandatory completion of safety and evidence checkpoints. Attempts are free until you pass. The exam opens 7 days after purchase.

Curriculum

9 modules · 36 hours of guided learning · self-paced, with hands-on labs

Prerequisites: Completion of Level 2 or equivalent professional experience; comfortable with independent investigations.

Tool stack: Wazuh, Elastic, Splunk, Sysmon, Zeek, Suricata, Sigma, Velociraptor

9h guided instruction + 20h guided/independent practical labs + 7h reading, review and assessment. These are total learning hours, not 36 hours of live lectures.

Module 01Network IDS and alert investigation4 h

Coverage. Lead an integrated assessment, validate assumptions, automate repeatable checks and produce defensible findings.

Practical. Complete a scenario-driven challenge, defend findings, and validate controls or mitigations.

Evidence. annotated observations, reproducible steps, risk/impact notes and a concise technical recommendation.

Module 02Identity and authentication anomaly analysis4 h

Coverage. Lead an integrated assessment, validate assumptions, automate repeatable checks and produce defensible findings.

Practical. Complete a scenario-driven challenge, defend findings, and validate controls or mitigations.

Evidence. annotated observations, reproducible steps, risk/impact notes and a concise technical recommendation.

Module 03Malware behavior and sandbox reports4 h

Coverage. Lead an integrated assessment, validate assumptions, automate repeatable checks and produce defensible findings.

Practical. Complete a scenario-driven challenge, defend findings, and validate controls or mitigations.

Evidence. annotated observations, reproducible steps, risk/impact notes and a concise technical recommendation.

Module 04Threat intelligence and hunting hypotheses4 h

Coverage. Lead an integrated assessment, validate assumptions, automate repeatable checks and produce defensible findings.

Practical. Complete a scenario-driven challenge, defend findings, and validate controls or mitigations.

Evidence. annotated observations, reproducible steps, risk/impact notes and a concise technical recommendation.

Module 05Detection tuning and false-positive reduction4 h

Coverage. Lead an integrated assessment, validate assumptions, automate repeatable checks and produce defensible findings.

Practical. Complete a scenario-driven challenge, defend findings, and validate controls or mitigations.

Evidence. annotated observations, reproducible steps, risk/impact notes and a concise technical recommendation.

Module 06Cloud and identity monitoring4 h

Coverage. Lead an integrated assessment, validate assumptions, automate repeatable checks and produce defensible findings.

Practical. Complete a scenario-driven challenge, defend findings, and validate controls or mitigations.

Evidence. annotated observations, reproducible steps, risk/impact notes and a concise technical recommendation.

Module 07Multi-source correlation and timeline analysis4 h

Coverage. Lead an integrated assessment, validate assumptions, automate repeatable checks and produce defensible findings.

Practical. Complete a scenario-driven challenge, defend findings, and validate controls or mitigations.

Evidence. annotated observations, reproducible steps, risk/impact notes and a concise technical recommendation.

Module 08Purple-team validation and SOC metrics4 h

Coverage. Lead an integrated assessment, validate assumptions, automate repeatable checks and produce defensible findings.

Practical. Complete a scenario-driven challenge, defend findings, and validate controls or mitigations.

Evidence. annotated observations, reproducible steps, risk/impact notes and a concise technical recommendation.

Module 09Enterprise SOC capstone4 h

Coverage. Lead an integrated assessment, validate assumptions, automate repeatable checks and produce defensible findings.

Practical. Complete a scenario-driven challenge, defend findings, and validate controls or mitigations.

Evidence. annotated observations, reproducible steps, risk/impact notes and a concise technical recommendation.

Level capstone and assessment

Professional engagement: plan, execute and defend a complex scenario with peer review and executive/technical reporting. HACKY SECURITY | CERTIFICATION CURRICULUM | 2026 3

20% knowledge checks, 60% hands-on practical, 20% evidence-based reporting Recommended pass: 70% overall with mandatory completion of safety and evidence checkpoints.

Final exam

A 48-hour scenario exam, assessed on your written report. Recommended pass: 70% overall with mandatory completion of safety and evidence checkpoints. Attempts are free until you pass. The exam opens 7 days after purchase.

What you receive

When you finish the courseCertificate of Course CompletionIssued once you complete every lesson and lab.

When you pass the examHacky Certified Blue Team AnalystShows your level and an ID anyone can verify. It does not expire.

Course author

Gaurav Sharma

Founder & CISO, Hacky Security

Offensive and Defensive Security Expert

Gaurav founded Hacky Security and leads its SOC, curriculum and AI security work. He has trained more than 40,000 professionals and has taught AI security at IIT Madras.

OSCPOSCECISSPOSAI

Frequently asked questions

Do I need to buy any software?

No. All the tools you need are already set up in the course labs.

When does my course open?

48 hours after payment. We email you when it is ready.

Can I start at Level 2?

Yes. If you already have the experience, buy Level 2 or Level 3 directly.

Hacky Certified Blue Team Analyst

Introduction

Curriculum

Final exam

Curriculum

Final exam

Curriculum

Final exam

What you receive

Course author

Gaurav Sharma

Frequently asked questions

More from the blue team track

Hacky Certified Incident Responder

Hacky Certified Forensic Investigator

Hacky Certified OSINT Investigator