Skip to content
← BlueLine-CTF

In development · Not yet available

BlueLine CTF Lite

Learn the analyst's tools before you need them.

Eleven short, guided challenges that teach the basics of defending a network, and the on-ramp to the full BlueLine-CTF. Built for one sitting of two to three hours.

Ask About LiteSee What You'll Learn

What you'll learn

Eleven challenges in four groups. Each one teaches its tool as you go, so nobody needs to have used a SIEM before.

SIEM basics

Get comfortable in the tool analysts live in.

  • Open Kibana, pick a data view, set the time range and run a filter
  • Filter failed sign-ins to find a brute-force attempt and where it came from
  • Spot the process that doesn't belong in endpoint logs

Network and email triage

Decide what's suspicious and what's normal.

  • Read a firewall log and tell blocked traffic from allowed
  • Triage a phishing email by its sender, its link and the address it was sent from

Vulnerabilities and incidents

Handle what you find the way a team would.

  • Match a scanned service version to a known vulnerability in an offline reference
  • Rate an incident's severity using a given matrix
  • Hash evidence and find the break in a chain-of-custody form

Hardening a server

Fix a practice server of your own.

  • Disable a service that isn't needed
  • Correct a file's permissions
  • Fix a weak password policy

How it works

  1. 01

    Your own workstation

    Each student gets an analyst workstation in the browser, with their own SIEM and a small practice server to harden. Nothing to install.

  2. 02

    Your own data

    The logs, emails and evidence are generated for each student. Answers are checked against that student's data, so they differ from a classmate's.

  3. 03

    One sitting

    The challenges are scaffolded and sized for a single session of two to three hours.

For classes still on Network+ or Security+ material, such as CTE classes, CyberPatriot teams and community college Security+ students. Scenarios are set in an invented company, with no real brands and nothing graphic, so they suit school settings.

Ready for the full BlueLine-CTF?

Lite is the on-ramp. A class that clears it is ready for BlueLine, our CySA+ defensive range with a larger, less guided challenge set.

See BlueLine-CTF →

Running a class or club?

BlueLine Lite is still in development. Tell us about your group and we'll tell you where it stands and what an event would involve.

Ask About Lite