Skip to content
← Line Zero

BlueLine-CTF · In development

CompTIA CySA+ (CS0-004)

Work like a SOC analyst, on data that is yours alone

A capture-the-flag for the defender side of cybersecurity, aligned to CompTIA CySA+ (CS0-004). It's the analyst counterpart to Redline. Instead of hacking into machines, students triage logs, analyze vulnerability scans, respond to incidents and write up what they find.

Ask About BlueLineSee the Domains

Nobody can copy a classmate's answers

Every student gets their own environment and their own data. Answers are typed in and checked against that student's data, so a neighbor's answer is wrong for you. There are no hidden flags to hunt for. Students build the habits real analysts have: read the evidence, form a conclusion, and show the work.

  1. 01

    Your own environment

    Each student gets an isolated analyst workstation in the browser, with a SIEM (Kibana), Wireshark and CyberChef.

  2. 02

    Investigate real data

    Logs, packet captures, scan results and incident evidence, generated for that student alone.

  3. 03

    Submit and climb

    Type in answers, and some written ones are marked by the teacher. A live scoreboard shows progress. Hints cost points.

25 challenges, all 4 CySA+ domains

Together they cover all 15 CS0-004 exam objectives. Difficulty runs from 1 (beginner) to 4 (expert).

Security Operations

11 challenges

  • Impossible travel. One account signs in from two continents minutes apart.
  • DNS exfiltration. Reassemble a stolen file from encoded DNS queries.
  • Tune the noisy rule. Find the real attacks hidden in 400 false alerts.
  • Catch it live. Capture beaconing malware on a live lab network.

Vulnerability Management

5 challenges

  • Supply chain. Find which service ships the vulnerable library.

Incident Response

5 challenges

  • Fix the broken triage script. Debug a Python script that misses 6 of 7 infected hosts.

Reporting and Communication

4 challenges

  • Check the AI's work. Catch the hallucinated indicator in an AI-written incident summary.

What teachers get

  • An instructor guide
  • A dashboard to follow the class and mark written answers
  • The ability to disable challenges that don't fit your course

BlueLine runs for a class, over a single session or across several weeks.

Event bookings need at least a week's notice. We price by the deployment day, not per seat, so tell us your dates and class size and we'll confirm the price.

Built for analysts-in-training

  • Learners with a Security+ foundation
  • Students in, or just past, CySA+ coursework
  • Teachers who want analyst practice that can't be copied

Who it isn't for

BlueLine is not for absolute beginners. If your students haven't covered Security+ material yet, it will be too much too soon.

Interested in BlueLine?

It's in development, so the best way in is to tell us about your class. We'll reply with where it stands and a price for your dates.

Or email info@linezerocyber.com

Ask About BlueLine