Opening your dashboard…

3 live courses · labs in the browser

Train like you're already on shift

Real SOC tools. Real labs. Real desk work. Wazuh, Suricata, MISP, Velociraptor, YARA, Sigma — not slides, not CTF toys.

103 SOC labs, 22 hunting labs, 16 detection labs. One shared Wazuh environment plus dedicated tools when the exercise needs them.

Courses

141

Hands-on labs

SOC modules

15+

Real tools

SOC Academy

18 modules

111 lessons · 103 labs

Threat Hunting

6 modules

27 lessons · 22 labs

Detection Engineering

8 modules

24 lessons · 16 labs

Three programs. One desk.

Start with the SOC Academy. Add hunting and detection engineering when you're ready. Full outlines live on each course page — not duplicated here.

Core path

CyberBlueSOC Academy

The core analyst path. 18 modules, 103 labs, from first shift through incident response.

Advanced

Threat Hunting

Hypothesis-driven hunts on fresh attack data. 6 modules, 22 labs.

Build detections

Detection Engineering

Write, test, and ship detections as code. 8 modules, 16 labs.

Tools you'll actually use

The same stack a SOC runs — in the browser. No local install required for academy labs. The open-source CyberBlueSOC repo remains available if you want the full self-hosted platform.

WazuhSuricataEveBoxMISPATT&CKVelociraptorYARASigmaTheHiveCortexShuffleCyberChefCalderaVolatilityWireshark

One campaign across the SOC path

One attack. Every tool.

A realistic APT campaign (Operation APT Breach) runs through the SOC Academy. Early modules teach you to read the data first. The campaign is named once you have the skills to investigate it.

Phishing delivery

Email gateway

M2–M3

Macro execution

Wazuh Sysmon

C2 callback

Suricata

Credential theft

Velociraptor

Lateral movement

Wazuh SIEM

M12

Persistence

Sigma

M13

DNS exfiltration

Threat hunting

M17

Cloud pivot

CloudTrail

185.220.101.42

Attacker IP — tracked once the campaign is in play

WS-HR-01

Patient zero — phishing to cloud pivot

12 agents · 4 subnets

Full enterprise network in the browser

Module 18 capstone

The full incident

The SOC Academy ends with one incident across every tool from the path. This is a course capstone — not a live certification exam.

Detection

Review the queue. Identify real alerts among noise. Triage and prioritize.

Wazuh, EveBox

Investigation

Pivot: who, which host, which process, which IP. Build the timeline.

Wazuh, Velociraptor

Threat intel

Look up every IOC. Campaign, family, what else to hunt.

MISP, ATT&CK Navigator

Hunt

Write a YARA rule and a Sigma rule. Scan for more victims.

YARA, Sigma, Velociraptor, Wazuh

Respond

Open the case. Document. Recommend containment. Write the report.

TheHive, Cortex

Automate

Build one Shuffle playbook that would have caught this faster next time.

Shuffle

Planned — not available to take yet

CyberBlueSOC Certified Analyst

CBSCA

A practical exam is on the roadmap: knowledge questions plus a timed investigation. Until it ships, finish the SOC Academy capstone — that is the skill proof we offer today.

Training is live. Checkout is next.

Price comparison
	CyberBlue Academy	SANS SEC504 (typical)
Price	From $19/month (intended)	~$8,500 per course
Labs	141 across 3 courses	~20–44 per course
Tools	Real SOC stack in the browser	Simulated range

Free

Start Module 1 on the shared Wazuh lab.

SOC Academy Module 1
Shared Wazuh labs in that module
Progress tracking while signed in

Analyst

$19/month

Intended full-content tier when checkout is live.

All 3 courses
141 labs (shared + dedicated)
Quizzes and hint independence
Portfolio and badges

Start learning

Intended default

Pro

$49/month

Intended plan for teams and employer reimbursement.

Everything in Analyst
CBSCA exam when it ships
Priority support
Career extras as they launch

Start learning

Universities and teams: contact us via Support.