Course CTF Blue Team: AI-Powered Defensive Security
Theme:

CTF Blue Team: AI-Powered Defensive Security

Master defensive security techniques using AI as your force multiplier

10 Lessons ~1 hour each AI-Assisted 10 CTF Challenges
📄 Download Full Course PDF
Module 1 Detection & Monitoring
01 AI-Powered Log Monitoring & Alerting
slides ↓ theory ↓ lab_guide ↓ homework ↓ answer ↓
02 Network Intrusion Detection with AI
slides ↓ theory ↓ lab_guide ↓ homework ↓ answer ↓
03 Malware Detection & Classification
slides ↓ theory ↓ lab_guide ↓ homework ↓ answer ↓
Module 2 Hardening & Configuration
04 AI-Assisted Security Hardening
slides ↓ theory ↓ lab_guide ↓ homework ↓ answer ↓
05 Firewall & Access Control Policies
slides ↓ theory ↓ lab_guide ↓ homework ↓ answer ↓
06 Secrets Management & Cryptographic Hygiene
slides ↓ theory ↓ lab_guide ↓ homework ↓ answer ↓
07 Vulnerability Assessment & Patch Management
slides ↓ theory ↓ lab_guide ↓ homework ↓ answer ↓
Module 3 Incident Response & Forensics
08 AI-Driven Incident Response
slides ↓ theory ↓ lab_guide ↓ homework ↓ answer ↓
09 Digital Forensics & Evidence Analysis
slides ↓ theory ↓ lab_guide ↓ homework ↓ answer ↓
10 Blue Team Capstone: Full Defense Scenario
slides ↓ theory ↓ lab_guide ↓ homework ↓ answer ↓
Lab Env Lab Environment (Docker + noVNC)

A self-contained, network-isolated XFCE desktop that runs in Docker and is accessible from your host browser via noVNC. Ships with every lab tool (python3, pwntools, scapy, yara, radare2, volatility3, sigma-cli, jq, openssl, ...) and every lesson's HTML guide + resources/ baked in.

The container has no outbound network — the only reachable endpoint is http://127.0.0.1:6080/vnc.html on your loopback. Clipboard copy/paste is enabled so you can keep Claude running on your host and move text in and out of the sandbox.

Quick start: docker compose build && docker compose up -d — see the README inside the archive for full instructions.