Hey everyone,

I'm a first-year CS student working toward a Blue Team / SOC role. I recently finished TryHackMe's SOC Level 1 path and built a small Wazuh home lab. I'm now trying to move from guided learning into regular, independent investigations.

I've already tried resources such as TryHackMe, CyberDefenders, LetsDefend, and several downloadable Windows Event Log/EVTX datasets. The problem I'm running into is that a lot of the available practice is either heavily time-limited, restricted on free tiers, or consists of very small datasets that aren't enough for a proper investigation.

What I'm specifically looking for is something I can practice with consistently without racing a one-hour timer. I'm especially interested in:

• Windows Event Log / EVTX investigations
• PCAP analysis
• SIEM alert triage
• Phishing investigations
• Downloadable evidence that I can investigate locally at my own pace

I don't necessarily need a fancy platform. A good GitHub repo, realistic EVTX dataset, PCAP collection, or free lab would honestly be just as useful.

For people who were at this stage before: what resources did you actually use for repeated, hands-on SOC practice after finishing the beginner SOC material?

I'm mainly looking for resources that are genuinely usable on a tight budget and don't require paying for every few investigations.

Thanks in advance.

Looking for some real advice on breaking into IT/cyber. I’m currently a senior studying CS (minor in data science) with a background in SWE (internships) and hands on field tech support(current job isn't as technical as I want it to be), but I’ve been entirely self taught when it comes to systems, networking, and security concepts. My end goal is to break into a Tier 1 SOC Analyst role upon graduation and eventually move into Cloud Security / Engineering, but right now I’m trying to figure out how to realistically land a part time Help Desk / IT support role to get solid enterprise ticketing and sysadmin reps on my resume.

Is landing a part time help desk job while finishing school even realistic in this market, and what’s the best way to stand out when applying? Also, since I’m currently studying for \*\*Security+\*\* and skipping A+ to avoid getting stuck in help desk long term, what practical steps, lab work, or self study strategies would you recommend to bridge the gap from CS self learning into a SOC role? Would love any perspective from anyone who balanced part time IT in college or made the self taught jump from software to security!

Here's my resume as well: https://imgur.com/gallery/resume-L53yJia

Hello everyone i just wanna ask some questions before i hit the the blue team course, i had the security+ and soc1 from tryhackme and i will take the course but can i finish it with 4 months only and i will be fine with the exam !? And with the exam it’s 24 hour so i will writing reports?? Or if i make any questions the will give me a right or wrong sign? I’m really curious about the cert. because i have some trouble with the money so let me know please

Hello, I am seeking clarification on whether we should focus on the "Challenges" or "Investigations" tasks, or if we should be studying both within BTLO for the BTL1 exam preparation.

The BTL1 exam covers six sections:

• Security Fundamentals
• Phishing Analysis
• Threat Intelligence
• Digital Forensics
• Security Information and Event Monitoring
• Incident Response

However, I notice that BTLO only seems to cover three of these sections: Incident Response, Digital Forensics, and Threat Intelligence. Should we also be studying the remaining three areas—Security Operations, CTF-like challenges, and Reverse Engineering—when preparing for the exam?

Thank you for your guidance.

Hey Guys!

I’m curious to know which training or certification would be most beneficial for protecting our network. I’m leaning towards Blue Team Level One training, but I’m open to other options Blue Team or Red Team training. What do you think?

What Should i take before btl1?

Hi im completely beginner .. college student and im interested in cybersec > blue team . My question is what should i learn before taking btl1? Any roadmaps recommendations? And should i do ctfs before taking btl1? I need help plz

Hey All,

List of useful subreddits related to the topics of this course. If you come across others, leave them in the comments and ill update the list.

https://www.reddit.com/r/dfir/

https://www.reddit.com/r/DFIRTraining/

https://www.reddit.com/r/computerforensics/

https://www.reddit.com/r/IncidentResponse/

https://www.reddit.com/r/blueteamsec/

https://www.reddit.com/r/phishing/

It has to be done.

​

Much love from Australia

Discussion around the BTL1 training and certification offered by Security Blue Team.