Blue team certifications?

UnixGuy

Does anyone have any experience with https://securityblue.team/ ?

I've been asked about Blue Team level 1 certifications and heard people speak highly of them, I just want to know if anyone here done them?

I love the syllabus and the fact that they're lab based, seem to be a cheaper alternative to SANS

JDMurray

I looked into these certs several years ago and they seemed to be a vehicle for selling training. I've not seen anything said much about them.

UnixGuy

JDMurray said:

I looked into these certs several years ago and they seemed to be a vehicle for selling training. I've not seen anything said much about them.

I've heard good things about them through youtube, keen to know more. The content seem really good

chrisone

Their certs seem to be gaining traction and popularity. I have seen some job requirements "suggest" this cert as a recommendation to fufill some skill level. As mentioned it is also gaining traction amongst the twitter security realm. 

Still not a dirt cheap pathway, but a hell of a lot cheaper than SANS. 

Good luck and wish you the best on your journey. 

SteveLavoie

A few years ago, the trend was focused on offensive security, as this market mature, there is now a focus on defensive/Blue Team security.  They are looking as one of the solid contender. 

chrisone

Yup even the company "offensive security" is providing blue team focused courses/certs. 

Cloud Security: CLD-101
Security Operations for Beginners: SOC-100
Security Operations and Defensive Analysis: SOC-200

UnixGuy

Good points. I like eLearnsecurity and I think they have solid certs, they have a DFIR cert, was wondering if there is a good blue teaming / SOC certs that are handson and not as expensive as SANS

aleksej

chrisone said:

Yup even the company "offensive security" is providing blue team focused courses/certs. 

Cloud Security: CLD-101
Security Operations for Beginners: SOC-100
Security Operations and Defensive Analysis: SOC-200

nope, just started SOC-200. it's quite expensive, but offers some basic xxx-100 courses in one package. started with one of those (xxx-100). and you know what? browser often serves pages with no content. started from "basic linux" so its probably considered by them some brief self-check for SOC-200 level attendees ....still If they sold me this I would gladly self-check if/where I lack the konowledge! imho, there is no one that don't lack the basic knowledge in some fields. hope later it will get better, when going  explicite for SOC-200 part.

even registration took me almost 2 weeks, because my preference was not to provide them with my ID photo (seriously?! ID photo?! whole time I was wondering if it  is not the first lesson from security awareness part or sth )

To keep it short .....Seems like a first steeps for OffensiveSec on blue side. and those seems to be hard for them. not worth the money for now. If I would have to chose once more I would go for CompTIA line of security certs instead. I have CompTIA CySA and I can strongly recommend the knowledge it offers (still certification questions are rather checking your command of English if you are not a native)

UnixGuy

Update....

I've been hearing more and more positive experience from people who've done: https://securityblue.team/why-btl1/

Blue team level1.

It's practical so it sounds more useful than CySA+ multiple choice approach?

Keen to hear if anyone here have used them

Or do you know of a good SOC analyst training for beginners other than CySA+ and eLearnSecurity?

scasc

I have a contact who has used them (SANS instructor and holds multiple SANS certs) and highly recommends them. 

UnixGuy

scasc said:

I have a contact who has used them (SANS instructor and holds multiple SANS certs) and highly recommends them. 

that's very re-assuring! We really needed an affordable blue team training that's practical.

JDMurray

What a Blue team does is highly dependent on the org it serves. How general or specific do you need this exam to be?

UnixGuy

JDMurray said:

What a Blue team does is highly dependent on the org it serves. How general or specific do you need this exam to be?

yeah true, to be honest I don't care about the exam as much, just the training. I'm looking for a structured training for beginners to get them started as SOC analysts/incident responders/ threat management/etc , regardless of the org structure...something cheaper than GCIH/GCFA and hands on