What is LetsDefend?
LetsDefend is a hands-on SOC analyst simulation platform that puts you inside a real security operations center environment. Instead of isolated lab challenges, LetsDefend simulates the full SOC workflow: alerts come into your queue, you investigate them using attached evidence, escalate or close based on your findings, and document your decisions exactly as you would in a real SOC job. It bridges the gap between ‘I studied security’ and ‘I can actually do this job.’
Is This Right for You?
This is for you if...
- You’re targeting a SOC analyst role and want to practice real alert triage and investigation workflows
- You’ve completed TryHackMe’s SOC Level 1 path and want a more realistic, less guided environment
- You want hands-on experience with SIEM alerts, malware analysis, phishing investigation, and log analysis
- You’re studying for CySA+, BTL1, or SC-200 and want practical reinforcement
- You want to build a portfolio of investigation case reports to show employers
This is NOT for you if...
- You’re primarily interested in offensive security — LetsDefend is exclusively defensive
- You’re brand new to security with no networking or OS fundamentals — build those first
Platform Features
| Feature | Details |
|---|---|
|
SOC Alert Simulation |
Real alert queue — investigate incoming security alerts as a SOC analyst would |
|
SIEM Integration |
Practice with simulated SIEM environment including log search and correlation |
|
Malware Analysis |
Hands-on sandbox analysis of malware samples within the platform |
|
Phishing Investigation |
Email header analysis, URL detonation, IOC extraction workflow |
|
Endpoint Security |
EDR alert investigation and endpoint forensics |
|
Threat Intelligence |
IOC lookup, threat actor research, intelligence integration |
|
Case Management |
Full case lifecycle — open, investigate, document, close or escalate |
|
Learning Paths |
Structured role-based paths: SOC Analyst, Malware Analyst, Threat Hunter |
Pricing
| Tier | Price | Includes |
|---|---|---|
|
Free |
$0 |
Limited alerts, learning paths, and challenges — enough to evaluate the platform |
|
Premium |
~$25/month |
Full alert queue, all learning paths, malware analysis, unlimited case management |
|
Teams |
Custom pricing |
Multiple seats, team progress tracking, instructor dashboards |
Learning Paths on LetsDefend
SOC Analyst Path
The core path covering the full SOC Tier 1 and Tier 2 workflow: alert triage, log analysis, phishing investigation, malware analysis basics, and incident escalation. The most direct preparation for an entry-level SOC analyst role.
Malware Analyst Path
Static analysis, dynamic analysis in sandbox environments, IOC extraction, YARA rule basics, and behavioral reporting. Pairs directly with TCM Security’s Practical Malware Analysis course and SecVerse’s Malware Analysis Learning Path.
Threat Hunter Path
Hypothesis-driven hunting using SIEM data, ATT&CK-based query building, and advanced log correlation. For practitioners who have completed the SOC Analyst path and want to move into proactive threat detection.
Certification Prep — What LetsDefend Helps With
| Certification | How LetsDefend Helps | Recommended LetsDefend Content |
|---|---|---|
|
CompTIA CySA+ |
Hands-on threat detection and incident response practice |
SOC Analyst path + SIEM alerts |
|
BTL1 (Blue Team Level 1) |
Direct SOC workflow simulation aligned to BTL1 exam domains |
Full SOC Analyst path + phishing + malware |
|
Microsoft SC-200 |
SIEM alert investigation and endpoint security — translates to Sentinel |
SOC Analyst + endpoint security cases |
|
GCIH (GIAC Incident Handler) |
Incident escalation and response documentation practice |
Full case management workflow |
Recommended Resources
- LetsDefend — account creation and platform access
- MITRE ATT&CK — every LetsDefend investigation should map findings to ATT&CK
- VirusTotal — IOC lookup used constantly during phishing and malware investigations
- AnyRun — interactive sandbox for malware analysis within LetsDefend malware cases
- Splunk Free Training — prepare for LetsDefend’s SIEM-based investigations
── SecVerse Marketplace — Resources ──
Which Platform is Right for You?
LetsDefend is the right choice when you want to practice the full SOC analyst workflow inside a realistic alert queue. Here is how it compares:
| If you want... | Best Choice |
|---|---|
|
You want deeper forensics and ATT&CK-mapped defensive labs |
Blue Team Labs Online — phishing, SIEM, memory forensics, threat hunting |
|
You want guided beginner defensive learning paths |
TryHackMe SOC Level 1 — the starting point before LetsDefend |
|
You want offensive understanding to complement your defense |
Hack The Box — understand attacker methodology |
|
You want full SOC workflow simulation with a real alert queue |
LetsDefend — this is the right choice |
How to Get Started
- Start with the free tier — work the first 10 alerts before upgrading. The free alert queue gives you enough cases to understand the platform’s workflow. Don’t upgrade before experiencing the core alert triage loop.
- Write a case report for every alert you close. Use LetsDefend’s built-in case documentation every time. Describe what you found, what tool you used, what the IOCs were, what the ATT&CK technique was, and your closure decision. This becomes your portfolio.
- Combine LetsDefend with Blue Team Labs Online. LetsDefend excels at SOC workflow simulation. BTLO excels at deeper forensics and threat hunting labs. Together they cover the full defensive skill stack that CySA+ and BTL1 test.
📌 Note: The information on this page — including certification details, exam codes, pricing, and salary ranges — is regularly reviewed and updated to reflect the latest data from official sources. Always verify current details directly with the relevant certification body or platform before making any decisions.
Community & Support
── Blue Team Communities ──
Related Articles
The 6 Learning Paths Every Cybersecurity Beginner Should Know
**In our first guide**, we covered how to start learning cybersecurity without feeling overwhelmed. If you haven’t read it yet, start there.
Now, let’s talk about which path to take once you’re ready. When I decided to get into cybersecurity 20 years ago after I graduated from school of engineering as computer engineer, I had no idea which path to take.
I bought a CEH course first. Then I bought a Security+ book. Then I tried to learn networking. I was all over the place. Don’t be me.
How to Start Learning Cybersecurity Without Feeling Overwhelmed
Let’s be honest with ourselves to avoid the shock and be realistic. Cyber security is huge, branching, and massive field.
When I decided to get and start in this field 20 years ago. I made every mistake imaginable:
Bought expensive courses I never finished.
Tried to learn everything at once – pentesting, malware analysis, cloud security, forensics. All in short time.
Got trapped in “tutorial”- watching videos for hours but never actually doing anything because of not practicing them and being confused.
Got lots and different opinions from people who are in advanced levels.
Here’s the truth I wish someone told me earlier:
