Blue Team Labs Online (BTLO): Beginner's Guide for 2026

What Is Blue Team Labs Online?

Blue Team Labs Online (BTLO) is a defensive security practice platform where you investigate realistic security incidents and earn points by answering questions about them. Its homepage describes it as "a gamified platform for defenders to practice their skills in security investigations and challenges."

BTLO is provided by Centri, the UK company formerly known as Security Blue Team. The old securityblue.team address now redirects to centri.org, so if you see either name in a forum thread, it is the same organization. Centri also sells the Blue Team Level 1 (BTL1) certification, which comes up later in this guide.

Content is split across five areas, listed on the BTLO homepage:

• Incident Response: working out what an attacker did on a system and in what order.
• Digital Forensics: memory dumps, disk artifacts, browser history and file metadata.
• Security Operations: the daily SOC work, such as phishing analysis and alert triage.
• Reverse Engineering: pulling apart malicious scripts and binaries to see what they do.
• Threat Hunting: searching logs for activity no alert has flagged yet.

How BTLO Differs From an Offensive CTF

On a classic capture the flag platform, you attack something until you find a flag. On BTLO, the attack already happened. Each lab gives you a scenario and a list of questions: which IP ran the scan, which file the attacker uploaded, which command they ran first. When you answer all of them, you get points based on the lab's difficulty rating, and those points drive your rank on global and country leaderboards.

That question format is the real value. By the last question, you have rebuilt the attacker's timeline, which is exactly what an incident report looks like at work.

Is Blue Team Labs Online Free? Challenges vs Investigations

Yes. A free BTLO account gives you access to all of the platform's challenges: downloadable files such as phishing emails, packet captures, memory dumps and logs that you analyze on your own machine. What you pay for are investigations, the scenario-based labs that run in a private environment in your browser.

Investigations are dedicated to you, so nobody else can change the machine while you work. That matters more than it sounds: on shared lab platforms, another player deleting a log file can ruin your evening.

In practice, the investigations are where the SOC tooling lives. Community write-ups describe Windows lab machines with the evidence in a folder on the desktop, plus investigations built around ELK, Splunk and Windows event logs. Challenges, by contrast, are just files: you bring your own tools.

Is BTLO Good for Beginners?

Partly. BTLO's own FAQ is direct about it: the platform "is designed for defenders that already have experience with security tools and investigations," and it is not a training platform (Centri says a training subscription is in the works). The Easy challenges are reachable for a motivated beginner, but nothing on BTLO will explain what a TCP handshake or an SPF record is.

Before your first challenge, make sure you can do these four things:

• Read raw email headers: find the real sending server, the Reply-To address and the SPF, DKIM and DMARC results.
• Open a PCAP in Wireshark: apply display filters, use Statistics > Conversations, and follow a TCP or HTTP stream. Our Wireshark tutorial for beginners covers all three.
• Decode common encodings: spot Base64 and hex, and decode them with CyberChef.
• Work in a virtual machine: some challenge files contain live malicious code, so you never open them on your everyday computer.

If two or more of those feel unfamiliar, start with guided material and come back in a few weeks. BTLO is a great second step and a frustrating first one.

How to Solve Your First BTLO Challenge (Spoiler-Free)

A good first pick is Network Analysis - Web Shell, a free challenge rated Easy. The scenario: the SOC received a SIEM alert for "Local to Local Port Scanning," where one internal host started scanning another. You get a PCAP and have to decide whether the activity is malicious, then reconstruct what the attacker did. Here is the method, without the answers.

1. Get the big picture first: open the capture and go to Statistics > Conversations, then the TCP tab. One pair of hosts with hundreds of short conversations stands out immediately. Sort by the destination port column and the scan range becomes obvious.
2. Identify the scan type: filter for connection attempts that never complete. A long run of SYN packets to sequential ports, answered by RST from closed ones, is a SYN scan.
3. Look at what came next: check Statistics > Protocol Hierarchy. If HTTP shows up after the scan, the attacker moved on to the web server. Scanning tools often announce themselves in the User-Agent header, so add it as a column.
4. Find the upload: filter for POST requests. An upload to a PHP page followed by requests to a new, odd-looking PHP file is the classic web shell pattern. The Referer header tells you which page the upload came from.
5. Read the commands: follow the HTTP stream of the requests to the new file. The commands sit in a URL parameter, in the order the attacker typed them.
6. Catch the callback: the last commands usually open a reverse shell. Look for a new TCP connection that starts from the victim and goes back to the attacker on an unusual port.

These are the Wireshark display filters that do most of the work:

tcp.flags.syn == 1 && tcp.flags.ack == 0     # connection attempts only: scans stand out
http.request                                  # every HTTP request, add http.user_agent as a column
http.request.method == "POST"                 # uploads and form submissions
http.request.uri contains ".php"              # requests to PHP pages, including a dropped shell

All four work in current Wireshark 4.x releases, and the Wireshark user guide on display filters explains the syntax if you want to build your own.

In practice, the trick that saves the most time on BTLO is reading every question before you open the evidence. The questions are a map: if question five asks for a web shell's parameter name, you already know a web shell exists and roughly where in the capture to look. Write each answer down with the packet number or filter that proved it, and you have your incident notes for free.

6 Free BTLO Challenges to Start With

These free challenges are rated Easy on BTLO and are well documented by the community, so you can check your reasoning once you finish. Try each one without a write-up first.

• Phishing Analysis: a reported email to pull apart. You identify the recipient, the originating server, the attachment and the link inside it. A text editor, WHOIS lookups and a URL screenshot service are enough.
• Phishing Analysis 2: the same skill one notch up, with some encoded content that CyberChef handles well.
• Network Analysis - Web Shell: the walkthrough above. The best first network challenge on the platform.
• Shiba Insider: a PCAP with a twist. Community write-ups solve it with Wireshark and ExifTool, so it also trains your metadata reflexes.
• PowerShell Analysis - Keylogger: read a malicious PowerShell script and explain what it does. Only a text editor is needed, which makes it a gentle start in reverse engineering.
• Browser Forensics - Cryptominer: dig through browser artifacts to find the cryptominer. Community write-ups use FTK Imager to browse the evidence.

Once those feel comfortable, the Medium-rated Bruteforce challenge is a good next step: a large log file, a lot of noise, and one attacker to find in it.

Tools to Set Up Before You Start

Since free challenges are downloads, your setup matters. A Windows or Linux VM with these covers nearly every Easy challenge: Wireshark, a good text editor, CyberChef (it runs in the browser), ExifTool, FTK Imager on Windows, and Volatility 3 once you get to memory dumps. Take a snapshot of the VM before opening any sample so you can roll back.

Is BTLO Pro Worth It?

BTLO Pro is worth it once the free Easy challenges feel routine and you want practice in a real SOC toolset (SIEM searches, Windows event logs, live lab machines) without building it yourself. Before that point, you are paying for content you are not ready to use.

Our take on how to spend the money:

• Skip Pro for your first month. The free challenges keep you busy for weeks, and they show you which areas you enjoy.
• Buy one month, not a year. £15 for a focused month of investigations tells you more than any review. The annual plan (£144, a 20% saving) only makes sense once you know you will use it every week.
• Pick a theme per month. For example, only ELK-based investigations one month, only memory forensics the next. Random lab hopping builds points, not skills.

BTLO and the BTL1 Certification

BTLO and BTL1 are separate products. Blue Team Level 1 is Centri's junior SOC certification, priced at £399 on its course page. According to Centri, that includes four months of access to the training material, 23 browser labs with 100 hours of lab time, one 24-hour practical incident response exam and one free retake. Centri says 70% of students pass on the first attempt.

Practicing on BTLO is a sensible way to see whether hands-on defensive work suits you before spending £399, but BTLO points do not count toward the certification. If you are weighing BTL1 against other entry-level options, compare the exam format, not just the price: a 24-hour practical exam is a very different test from a multiple-choice one.

Blue Team Labs Online vs CyberDefenders, LetsDefend and TryHackMe

BTLO sits in a small group of defensive platforms. They overlap, but each one fits a different stage.

CyberDefenders is BTLO's closest cousin: question-based investigations on real evidence, with a heavier DFIR focus and longer labs. Our CyberDefenders guide for beginners explains its free labs and the CCDL1 certification.

LetsDefend is less of a CTF and more of a job simulator, where alerts land in a queue and you triage them. Hack The Box now owns it and is moving new content to its own platform, which our LetsDefend guide covers in detail.

HackerDNA fills the gap BTLO leaves open: it teaches before it tests. The SOC Analyst and Blue Team course walks you through SIEM queries in Splunk and Elastic, detection rules, and mapping alerts to MITRE ATT&CK. Because HackerDNA also covers offense, you run attacks like a SYN scan or a web shell upload yourself, which makes their traces in a PCAP much easier to recognize. A realistic path: HackerDNA to learn, BTLO free challenges to test yourself, then BTLO Pro or CyberDefenders for volume.

Legal and Ethical Considerations

• Treat samples as live: BTLO challenges can contain real malicious scripts and documents. Open them only in an isolated VM, never on your everyday computer or a work machine.
• Do not interact with real infrastructure: if a challenge contains a URL or IP, use passive lookups and screenshot services rather than visiting it from your own connection.
• Respect write-up rules: check the platform's rules before publishing a solution, and never share answers to content that still awards points or to certification exams.
• Keep real data private: if you practice on logs from your job, never paste them into public tools or write-ups.

The NIST incident response guide, SP 800-61 Revision 3, is worth skimming once to see how real teams handle evidence and reporting.

Frequently Asked Questions