Blue Team Course — SOC Analyst Training
The defensive side: log collection, correlation rules, incident investigation and reporting. More than half of the course is lab assignments that simulate a real SOC shift.
The Log Academy Blue Team course is a six-month hands-on program that prepares you for work as a SOC analyst. You learn to collect logs, correlate events in a SIEM, write Sigma detection rules, investigate incidents and write the report. Classes run offline in Baku and live online, and 70% of class time is practical work.
How do the Blue Team classes work?
Groups have 8–12 students, so the instructor sees everyone's work. 70% of class time is hands-on: every topic closes with a lab task. More than half of the course simulates a real SOC shift — an alert comes in, you triage it, hunt for traces in the logs and justify your decision. Theory is kept to what you need to understand the task.
Each student gets a dedicated virtual machine in a vSphere-based lab. The environment stays open after class and is available 24/7 for the whole course, so you can repeat a task at home, rewrite a rule, rerun an attack and check the result. Offline groups in Baku and live online groups share the same lab and instructor support; only the room is different.
What does a SOC analyst do, and how does the course prepare you?
A SOC analyst watches what happens across an organisation's network and systems: triaging SIEM alerts, filtering out false positives, escalating real threats and reconstructing how an incident unfolded. It is the daily work of the defensive side of cybersecurity. In the course, Wireshark, Sysmon, ELK, Wazuh, Sigma and MITRE ATT&CK are used at each step of exactly that workflow.
Students most often get stuck on the jump from collecting logs to correlating them. Building a dashboard is easy; the hard part is seeing that two ordinary events from different sources together mean an attack — for example, failed logins followed by a new user being created. That is why we give this topic dedicated time. The course ends with a full investigation of a simulated incident and a defence report that anchors your portfolio.
Who is this SOC analyst course for, and what happens after it?
The program is built for IT support specialists and network and system administrators, but newcomers to IT are welcome too. The first modules focus on reading network traffic and understanding system logs, and no coding is required. In a free consultation of about 20 minutes we check your background and agree on the right starting point for you.
Students who complete the program and the final project receive the academy certificate. We also give guidance on preparing for international certification exams. The career module covers CV and LinkedIn review, technical interview practice and vacancy referrals. The goal is to walk into your first cybersecurity interview with real lab experience and an investigation report you can actually show.
What you'll gain
- →Collect and analyze logs on a real SOC shift
- →Build a SIEM on ELK/Wazuh and create dashboards and reports
- →Write detection rules with Sigma and MITRE ATT&CK
- →Investigate an incident and complete containment and the report
Tools
Modules
Frequently asked questions
Is the Blue Team course suitable for beginners?
Yes. The level runs from beginner to intermediate, and the program starts with the fundamentals: network protocols and Linux and Windows telemetry. No coding is required. If you are comfortable with a computer, you can start. If your background is very thin, we may suggest taking the Linux Administrator program first.
What do I need to know before I start?
There are no formal prerequisites. It helps to have a rough idea of what an IP address, DNS and a port are, and not to be afraid of the command line on Windows or Linux. Experience in IT support, networking or administration will get you through the first modules faster. We spot gaps during the consultation and provide foundation prep so the group starts level.
Is there a difference between offline and online classes?
The content, the lab and the instructor support are the same. Offline classes take place in Baku, Azerbaijan, at Ülvi Bünyadzadə 2; online groups join live and ask questions in real time. In both formats your virtual lab is open 24/7. Companies can also arrange corporate training tailored to their team.
What is the lab like?
The lab runs on vSphere, and every student gets their own virtual machine. There you deploy a SIEM, collect telemetry with Sysmon, write Sigma rules and investigate simulated attacks. The environment stays open for the whole course, so you can repeat tasks after class at your own pace.
What do I get at the end?
Students who finish the program and the final project receive a Log Academy certificate. If you plan to sit international exams such as CompTIA Security+ or BTL1, we point out which topics to strengthen, but we do not guarantee exam results. The most valuable outcome is a finished incident investigation report for your portfolio.
How do I get started?
Fill in the form on the site, or call or message us on WhatsApp at +994 50 700 60 70. In a free consultation of about 20 minutes we pin down your level and goal. The first lesson is free, so you see the format and the lab for yourself before deciding. The academy is open every day from 11:00 to 22:00.