The Unofficial BTL2 Study Notes

BTL2 Study Notes are are built for analysts already operating inside SOC environments who need to move from passive log review into active threat detection, investigation, and response.

The core value of these notes is execution, not theory.

This is a practical breakdown of how real-world blue teams detect attacks, correlate logs, and respond under pressure mirroring the 72-hour investigation-driven exam model.

The entire BTL2 framework is built around one idea:

Logs are useless unless you know what to look for and when.

Everything in these notes pushes toward that skill:

Knowing which artifact matters
Knowing which query reveals it
Knowing how to connect events across systems

Most blue team resources produce passive analysts.

BTL2 Study Notes produce investigators.

They close the gap between knowing what SIEM does and actually catching an attacker inside noisy, real-world data.

What the BTL2 Notes Actually Teach

At its core, this material compresses multiple advanced domains into one operational workflow:

Threat Hunting (SIEM-heavy)
- Identifying attacker behavior through logs, not alerts
- Querying endpoint + network data at scale
- Thinking like an attacker (post-exploitation paths, persistence, lateral movement)
Advanced SIEM & Detection Engineering
- Building queries in tools like Splunk (SPL)
- Creating alerts, dashboards, and correlation logic
- Detecting ransomware, privilege escalation, data exfiltration
- Real examples: detecting suspicious file activity, DNS exfiltration, abnormal process chains
Incident Response & Investigation Workflow
- Alert triage → log correlation → root cause
- Mapping attacker activity across endpoints, network, and cloud
- Converting raw logs into actionable evidence
Digital Forensics & Network Analysis
- PCAP analysis using Wireshark
- Detecting scans, reverse shells, ARP poisoning, credential leaks
- Reconstructing attacker timelines from fragmented data
Malware Analysis
- Static + dynamic techniques
- Obfuscation handling and C2 behavior tracking
Vulnerability Management
- CVE, CVSS, CPE mapping
- Tools: Nmap, Nessus, Nikto, OpenVAS
- Full lifecycle: detection → exploitation → remediation