# Introduction

## Course Overview

### Introduction

The Blue Team Level 1 (BTL1) certification validates practical skills for defending against modern cyber threats. The course introduces the training platform, outlines certification objectives, and prepares learners for the BTL1 exam.

### Domains

The course is divided into six domains:

* **Security Fundamentals** – Basics of controls, networking, and risk management
* **Phishing Analysis** – Detecting, analyzing, and reporting phishing attacks
* **Threat Intelligence** – Understanding intelligence types, threat actors, and IOCs
* **Digital Forensics** – Collecting and analyzing digital evidence from Windows, Linux, and browsers
* **Security Information and Event Management** – Using SIEM for log analysis and reporting
* **Incident Response** – NIST SP 800-61r2 process: preparation, detection, containment, and post-incident review

### Additional Information

Security Fundamentals can be skimmed by those with prior experience. Full completion is recommended but not required before taking the exam.

## Navigating The Course

### Introduction

Covers how to navigate lessons, labs, forums, and exam preparation areas in the BTL1 platform.

### Key Features

* **Lessons & Quizzes** – Accessed via the Domain List; quizzes require a 70% pass score
* **Bookmarks** – Save lessons for review later from the top-right bookmark icon
* **Labs** – Launch from the Labs tab, complete questions to finish
* **Forum** – Exclusive to BTL1 students for discussions and troubleshooting
* **Exam** – Start when confident; course contains guidance and exam details
* **Store** – Purchase extensions for course time or lab hours
* **Student Support** – SBT Bot for quick help, or tickets for direct support

## Lab Login Credentials

### Access Information

Lab credentials are found in the lab client’s **Details** section.

* **Default username:** BTLO
* **Default password:** None (unless otherwise specified)\
  If credentials differ, check the Details section for the correct login.

## Credits & Special Mentions

### SBT Staff and Advisory Board

Created by **Joshua Beaman**, Founder and Lead Trainer. Supported by the Academic Advisory Board:

* James Weston – Senior Security Analyst
* Shaun Thomas – SOC Manager
* Jake – Tactical Threat Analyst
* Filip Vlasic – Senior Security Analyst
* Derek Scheller Jr – Senior Security Engineer
* Ismael Briones-Vilar – Senior Security Analyst
* Gabrielle Hempel – Senior Security Analyst
* Michael Jenks – Training Program Lead

### Practical Assessment Development

Acknowledgment to contributors for practical exam creation:

* Joao Rodrigues – Web Development
* Bruno Moreira – Web Development
* Joshua Beaman – Exam Scenario and Development
* Trevor Adams – Infrastructure Operations and Lab Integration
* Sabastian Hague – Exam Scenario and Development

## Frequently Asked Questions

### Training

* **Access duration:** 4 months (124 days) from course start
* **Notes:** Allowed for personal use; not to be shared
* **Expired access:** No content or lab availability; personal notes remain
* **Extensions:** 31 days (£100) or 62 days (£150); one allowed unless special approval granted
* **After expiry:** Extension possible but Exam Access continues counting down
* **Labs:** May take 3–10 minutes to load; errors require ticket submission
* **Lab hours:** 100 included, average use \~10 hours; close labs when not in use

### Exam

* **Deadline:** Must pass before Exam Access expires (12 months from start)
* **Failure:** 10-day cooldown before retake; avoid first attempt in final 10 days of access
* **RDP requirement:** Not needed; connections work like training labs
* **Platform:** Works on Mac and Linux
* **During exam:** Follow NDA and submit within time limit
* **Collaboration:** Not allowed; violations lead to revocation and bans
* **Grade concerns:** Request Review option available, typically resolved in 5 business days
* **Feedback:** High-level only for fairness

### Post-Exam

* **Certificate & coin:** Shipping in 3–4 months; track via BTL1 page
* **Public posts:** Allowed at a high level; no exam specifics or course material
* **Badge/title on BTLO:** Request via support ticket
* **Requests for answers:** Report via ticket; sharing is a violation leading to revocation
