Skip to main content
Blue Team

Practical Training in Defending Enterprise Infrastructures

Experience hands-on simulations of real cyber threats to sharpen your skills as a Blue Team defender. Learn SOC operations, DFIR workflows, and incident response strategies against real-world attacks.

SOC Operations DFIR Incident Response
Blue Team Lagoon
Features

Blue Team Lagoon — Defending the Cyber Realm

Dive deep into the best practices, tools, and strategies used by cyber defenders. Explore the art of securing digital perimeters, maintaining infrastructure integrity, and safeguarding data confidentiality.

Network Security Monitoring

Continuously monitor networks for suspicious activities and potential vulnerabilities, ensuring swift and effective threat response.

SIEM & Log Analysis

Collect, analyze, and correlate security data from multiple sources to facilitate early detection and effective incident response.

Firewall Management

Configure firewalls to filter network traffic, ensuring only authorized access to resources and protecting against known and unknown threats.

Vulnerability & Patch Management

Assess systems for vulnerabilities through automated and manual scanning, followed by timely patching to mitigate security risks.

Identity & Access Management

Securely manage user identities and privileges, ensuring only authorized users access critical and sensitive resources.

Security Training & Awareness

Educational programs on cybersecurity best practices, focusing on preventing internal threats and promoting a culture of security.

Practice Labs

Practice Labs — Put Your Defense Skills to the Test

Solve challenges in controlled environments that simulate real-world cybersecurity scenarios. Each lab is configured with different difficulty levels and attack techniques to help you refine your defensive skills.

Keylogger

In the Keylogger Malware Analysis Lab, participants step into the role of a blue teamer, tasked with identifying, analyzing, and neutralizing a keylogger malware threat within a corporate environment. This hands-on lab is designed to simulate a real-world scenario where attackers have deployed a keylogger to secretly capture keystrokes and steal sensitive information. Participants will learn to recognize the signs of keylogger infections, use forensic tools to analyze malicious binaries, and implement effective countermeasures to protect the network from future attacks.

Beginner 1 Machines
Key Learning Outcomes
  • Malware Analysis
  • Local Network Analysis
  • TCP Traffic Inspection
  • Sysinternals Suite
  • Online Investigations
Explore Lab

Attacker

In the Attacker Malware Analysis Lab, participants adopt the role of a blue teamer, focusing on an offline investigation to identify, analyze, and neutralize malware threats. This hands-on lab is designed to simulate a real-world scenario where attackers have deployed malicious executables to compromise a system. Participants will utilize tools such as VirusTotal and other forensic utilities to gather detailed information about the malicious files. Through this lab, they will learn to recognize the signs of malware infections, perform thorough static analysis of executables, and implement effective countermeasures to safeguard the network from future attacks.

Intermediate 1 Machines
Key Learning Outcomes
  • Malware Analysis
  • Local Analysis
  • Binary Analysis
  • Virus Total and Executable Hashes
  • Offline Investigations
Explore Lab

Wazuh SIEM

Wazuh is an open-source security information and event management (SIEM) solution that provides comprehensive security monitoring and management capabilities. It integrates various security tools and techniques to help organizations detect threats, monitor infrastructure, and ensure compliance with security policies. In this lab you will learn how to use a SIEM to identify various malicious actions that have happened on endpoint.

Beginner 1 Machines
Key Learning Outcomes
  • Understanding SIEM Fundamentals
  • Online Investigations
  • SOC alerts
  • Threat Detection and Incident Response
  • Log management
Explore Lab

Snort IDS

In the Snort Blue Team Lab, participants assume the role of a blue team defender tasked with securing a corporate network using Snort, a popular open-source Intrusion Detection System (IDS). This immersive, hands-on lab simulates real-world network security challenges where attackers are attempting to breach the network through various techniques, including port scans, malicious payloads, and suspicious network traffic. Participants will learn to configure and deploy Snort rules, analyze network traffic for indicators of compromise (IoCs), and implement effective detection strategies to identify and respond to potential threats. By the end of the lab, participants will have a solid understanding of how to use Snort to protect an organization from network-based attacks and improve overall security posture. <br><br> To use this lab you will need to be connected to the Professional Labs VPN!

Beginner 1 Machines
Key Learning Outcomes
  • Malware Analysis
  • Local Network Analysis
  • TCP Traffic Inspection
  • Local Linux Enviornment
  • Online Investigations
  • Intrusion Prevention Systems
Explore Lab

Using Autopsy

In the Autopsy Digital Forensics Lab, participants take on the role of a digital forensics investigator tasked with analyzing digital evidence to uncover critical information in a simulated investigation. Using Autopsy, a widely-used, open-source digital forensics platform, participants will work with a provided file to investigate various aspects of its contents, metadata, and potential artifacts. This hands-on lab immerses participants in real-world forensic challenges, allowing them to extract and analyze file system data, recover deleted files, and identify evidence of suspicious or malicious activity. Through practical exercises, participants will gain experience in examining file structures, applying investigative techniques, and generating reports to document findings. By the end of the lab, they will be well-prepared to leverage Autopsy for forensic analysis in real-world scenarios and effectively contribute to digital investigations.

Beginner 1 Machines
Key Learning Outcomes
  • File Recovery
  • Digital Forensics
  • Using DFIR Tools
  • Online Investigations
Explore Lab
Blue Team Lagoon Certification
Certification

Blue Team Lagoon Certification

Validate your cybersecurity expertise with a Blue Team Lagoon Certification. This credential recognizes your proficiency in defending against cyber threats, proving your skills in Blue Team tactics, strategies, and tools.

Start your journey towards certification today and prove that you have what it takes to be part of the elite defenders of the cyber world.

View Certification Path
FAQ

Frequently Asked Questions

Blue Teaming involves a group of security professionals focused on defending an organization's information systems against cyber attacks. They monitor, detect, and respond to security incidents, ensuring the protection of the organization's assets using various tools and techniques to identify vulnerabilities, implement security measures, and maintain data integrity.

Blue Team Lagoon is a simulated training environment designed to enhance the skills and capabilities of Blue Team professionals. It provides realistic scenarios that mimic actual cyber threats, allowing participants to practice and refine their defensive strategies.

Yes. You need to be a VIP subscriber to access these labs. However, you only need VIP to access this and all other labs. You can check pricing here.

Your progress remains intact, but access to the lab is restricted. To complete the lab you need to renew your subscription and continue your training activities.

Get Started

Ready to Defend?

Access Blue Team Lagoon labs with your VIP plan and start building real defensive skills today.

Upgrade to VIP