BTL2 Study Notes are are built for analysts already operating inside SOC environments who need to move from passive log review into active threat detection, investigation, and response.
The core value of these notes is execution, not theory.
This is a practical breakdown of how real-world blue teams detect attacks, correlate logs, and respond under pressure mirroring the 72-hour investigation-driven exam model.
The entire BTL2 framework is built around one idea:
Logs are useless unless you know what to look for and when.
Everything in these notes pushes toward that skill:
-
Knowing which artifact matters
-
Knowing which query reveals it
-
Knowing how to connect events across systems
Most blue team resources produce passive analysts.
BTL2 Study Notes produce investigators.
They close the gap between knowing what SIEM does and actually catching an attacker inside noisy, real-world data.
What the BTL2 Notes Actually Teach
At its core, this material compresses multiple advanced domains into one operational workflow:
-
Threat Hunting (SIEM-heavy)
-
Identifying attacker behavior through logs, not alerts
-
Querying endpoint + network data at scale
-
Thinking like an attacker (post-exploitation paths, persistence, lateral movement)
-
-
Advanced SIEM & Detection Engineering
-
Building queries in tools like Splunk (SPL)
-
Creating alerts, dashboards, and correlation logic
-
Detecting ransomware, privilege escalation, data exfiltration
-
Real examples: detecting suspicious file activity, DNS exfiltration, abnormal process chains
-
-
Incident Response & Investigation Workflow
-
Alert triage → log correlation → root cause
-
Mapping attacker activity across endpoints, network, and cloud
-
Converting raw logs into actionable evidence
-
-
Digital Forensics & Network Analysis
-
PCAP analysis using Wireshark
-
Detecting scans, reverse shells, ARP poisoning, credential leaks
-
Reconstructing attacker timelines from fragmented data
-
-
Malware Analysis
-
Static + dynamic techniques
-
Obfuscation handling and C2 behavior tracking
-
-
Vulnerability Management
-
CVE, CVSS, CPE mapping
-
Tools: Nmap, Nessus, Nikto, OpenVAS
-
Full lifecycle: detection → exploitation → remediation
-
What Makes These BTL2 Study Notes Different
Most cybersecurity content explains tools.
These notes force you to use them together under pressure.
-
You are not learning SIEM → you are building detections
-
You are not reading logs → you are reconstructing attacks
-
You are not memorizing concepts → you are solving investigations
The emphasis is on:
-
Cross-log correlation (endpoint + firewall + cloud)
-
Real attacker behavior patterns
-
Detection over theory
-
Output in the form of structured incident reports
Who These BTL2 Study Notes Are For
-
SOC Analysts moving beyond Tier 1
-
Blue Teamers preparing for BTL2 certification
-
DFIR practitioners who want real investigation workflows
-
Security engineers building detection pipelines
-
Anyone stuck in “tool knowledge” without real operational skill
Start Below
Don't leave your certification to chance. Equip yourself with the most detailed, exam-focused reference material available.
0 comments