Blue vs. Red with AI Bootcamp:
From Attacker Playbooks
to Defender Detections
Student onboarding, setup instructions, and pre-work for the 4-Day DEF CON Training Las Vegas bootcamp.
August 8–11, 2026
Instructors: Carlo Anez Mazurco
Welcome
Welcome to the 4-Day Blue vs. Red with AI Bootcamp. This course is designed to help students connect attacker behavior to defender detections through hands-on labs, realistic scenarios, and responsible AI-assisted analysis.
Before class begins, use this page to prepare your laptop, review the required tools, create your OpenCyberLab account, and understand the workflow we will use during the bootcamp.
Instructor Note:
“We are excited to train with you in Las Vegas. Come ready to investigate, collaborate, ask questions, and build practical skills that connect red team activity to blue team detection and response.”
Who This Page Is For
This onboarding page is for registered students attending:
Blue vs. Red Bootcamp with AI: From Attacker Playbooks to Defender Detections- DEF CON Training Las Vegas 2026
- August 8–11, 2026
If you are attending the 5-Day Cyber AI Analyst Workflow Bootcamp, please use the separate onboarding page for that program. This page is only for the 4-Day DEF CON Training Las Vegas bootcamp.
Course Overview
Four days of intensive, hands-on training connecting attacker behavior to defensive operations.
Day 1
Foundations: How Attacks Become Signals
Students will review core cybersecurity concepts, enterprise telemetry, attack-to-evidence mapping, and AI-in-the-loop analyst workflows.
Day 2
Red Team Basics: Build Empathy for the Adversary
Students will explore initial access patterns, execution, persistence, artifact analysis, and how attacker behavior creates evidence.
Day 3
Blue Team Operations: Hunt, Detect, and Respond
Students will work through log review, detection engineering, investigation workflows, triage, timeline building, and analyst reasoning.
Day 4
Capstone: From Attack Story to Defender Action
Students will connect red team activity to blue team detections, analyze evidence, map activity to MITRE ATT&CK and MITRE ATLAS where appropriate, and present findings.
Student Pre-Work Checklist
Before class, students should complete the following:
- Bring a laptop capable of running virtual machines or containers.
- Install all required software listed below.
- Confirm they have administrator rights on their laptop.
- Confirm they can connect to Wi-Fi and access browser-based lab resources.
- Review basic Linux command-line navigation.
- Review basic networking concepts such as IP addresses, ports, DNS, HTTP, and authentication.
- Review basic SOC concepts such as alerts, logs, indicators, detections, incidents, and evidence.
- Create or confirm access to any required lab accounts if provided by the instructors.
- Register for an OpenCyberLab account and complete the recommended pre-work labs.
- Download any required course files before arriving if links are provided.
- Bring a charger, headphones, notebook, and any adapters needed for their laptop.
- Join the Discord community for updates and instructor support.
Required Software
Final tool requirements may be adjusted before class. Students should check this page again before traveling.
| Tool | Purpose | Required Before Class | Notes |
|---|---|---|---|
| Web browser | Access labs and documentation. | Yes | Chrome, Edge, Firefox, or Brave are acceptable. |
| Docker Desktop or compatible container runtime | Run containerized labs where needed. | Yes, if instructed | Confirm Docker can start successfully before class. |
| VirtualBox, VMware, UTM, or equivalent | Run VM-based labs if needed. | Recommended | Use the virtualization platform that works best for your OS. |
| VS Code | Review scripts, logs, configs, and notes. | Recommended | Useful for reading JSON, YAML, scripts, and markdown. |
| Python 3 | Run helper scripts and analysis notebooks. | Recommended | Python 3.10 or newer is preferred. |
| Git | Clone or download course materials. | Recommended | Students should know how to clone or download a repository. |
| Wireshark | PCAP and network analysis. | Recommended | Useful for network investigation labs. |
| 7-Zip, unzip, or archive utility | Extract lab files. | Yes | Students should be able to extract ZIP and TAR files. |
| Optional local AI tools: Ollama or LM Studio | Experiment with local LLM workflows. | Optional | Only install if comfortable. Public AI tools may also be discussed. |
| OpenCyberLab account | Complete recommended pre-work labs before class. | Recommended | Register at beta.opencyberlab.com/login. |
Laptop Requirements
Recommended laptop:
16 GB RAM minimum, 32 GB preferred.- 80 GB free disk space preferred.
- Modern CPU with virtualization support.
- Windows, macOS, or Linux supported, but students must be comfortable installing tools.
- Administrative permissions required.
- Ability to install Docker, virtualization tools, and security analysis utilities.
- Stable browser access for documentation and lab portals.
- Ability to unzip files and work with logs, scripts, and artifacts.
Warning for Corporate Laptops
Corporate-managed laptops may block required tools, scripts, virtual machines, or containers. Students are strongly encouraged to use a personal or training laptop where they have full administrative control.
Responsible AI Use
AI will be used as an analyst-assistance tool, not as a replacement for reasoning. Students may use AI to summarize logs, explain syntax, generate hypotheses, draft reports, and compare evidence. However, students are expected to validate all AI outputs against the actual evidence.
Key Rules:
- Do not paste sensitive personal, corporate, customer, or real-world operational data into public AI tools.
- Use provided lab data only.
- Treat AI output as a hypothesis, not proof.
- Always cite the evidence that supports a conclusion.
- Use AI to accelerate learning, not to bypass investigation.
- When using external AI tools, anonymize or tokenize sensitive values when appropriate.
- Never rely on AI-generated MITRE mappings, detection logic, or conclusions without validation.
- Keep your final analyst reasoning grounded in logs, artifacts, timelines, and observable evidence.
Bootcamp Investigation Workflow
The goal is to help students move from raw evidence to defensible analysis. Every conclusion should answer: What happened? What evidence supports it? What should a defender do next?
Observe the alert or scenario.
Identify the relevant telemetry.
Build a timeline.
Extract indicators and evidence.
Map behavior to attacker tactics.
Develop detection or response logic.
Use AI to assist with summarization and hypothesis generation.
Validate conclusions manually.
Produce a concise analyst report.
SkillBit CTF Platform Account
Required for bootcamp CTF challenges & capstone
In addition to OpenCyberLab, students are required to create an account on the SkillBit CTF Platform (formerly MetaCTF) before class begins. This platform will host the interactive hands-on challenges and capstone exercises during the bootcamp.
Platform URL: mctf.io/ignitecyber
• Please sign up with the same email you registered with for the bootcamp.
• Verify your login and complete your profile setup prior to August 8.
Recommended OpenCyberLab Pre-Work
Before class, students should create an OpenCyberLab account and complete the recommended pre-work labs below. These labs are designed to help students arrive with basic comfort using Linux, network analysis, logs, and beginner security workflows.
Recommended Core Pre-Work Labs:
1. Introduction to Linux
Purpose: Build comfort with basic Linux commands, navigating directories, reading files, and using the terminal.
Why it matters: Students will work with logs, scripts, containers, files, and command-line tools during the bootcamp.
2. Packet Analysis with Wireshark
Purpose: Practice opening PCAP files, reviewing network traffic, identifying conversations, and analyzing protocols such as DNS, HTTP, and TCP.
Why it matters: Network evidence is a key part of understanding attacker behavior and defender visibility.
3. Port Scanning & Enumeration
Purpose: Understand how scanning and enumeration work from an attacker perspective.
Why it matters: Students will learn how reconnaissance activity becomes detectable evidence in logs and network telemetry.
4. Log Analysis & Enrichment
Purpose: Practice reviewing logs, identifying important fields, enriching events, and connecting related evidence.
Why it matters: This is one of the most important analyst skills for SOC, threat hunting, incident response, and detection engineering.
Optional Stretch Pre-Work Labs:
5. Hash Cracking
Review hash concepts, password security, and credential evidence.
6. Prompt Injection
Understand basic AI security risks and responsible AI workflows.
7. Breaking the Caesar Cipher
Lightweight warm-up lab for pattern recognition and basic crypto.
Pre-work expectations:
- Complete the core labs if possible.
- Optional labs are helpful but not required.
- Take notes on commands, tools, or concepts that are new to you.
- Bring questions to class.
- Do not worry if you cannot finish everything before arriving. The bootcamp will include guided instruction and support.
What to Review Before Class
Recommended review topics:
- Mission 00: Notebook & Evidence Foundations (Jupyter & Python)
- SOC Alert Triage 101 (Distinguishing signal from noise)
- Windows Event Log Basics & Sysmon Process Trees
- Zeek Logs 101 & Network Telemetry Pivoting
- Detection Engineering: From Behavior to Tested Rule
- MITRE ATT&CK & MITRE ATLAS Mapping
- Cyber kill chain concepts & initial access patterns
- Basic PowerShell and Bash command line navigation
- DNS, HTTP, authentication, and endpoint logs
- PCAP basics and Wireshark inspection
- Differences between indicators, observables, evidence, and intelligence
- Responsible AI and prompt safety for cybersecurity workflows
- Basic incident timeline building and analyst reasoning
Classroom Expectations
This is a hands-on class. Students should expect to:
- Work through realistic attack and defense scenarios.
- Review logs, alerts, network data, and artifacts.
- Think like both an attacker and defender.
- Collaborate with classmates.
- Ask questions.
- Document findings.
- Explain how evidence supports conclusions.
- Use AI responsibly as a learning and analysis assistant.
- Participate in discussions and lab debriefs.
- Leave with repeatable investigation workflows they can apply after class.
Need help before class?
Contact:
Carlo Anez Mazurco
IgniteCyber Academy / Cause-Finder
Email:
[email protected]Community / Discord:
Join Discord ServerCourse page:
DEF CON Training RegistrationFrequently Asked Questions
Is this the same onboarding page as the 5-Day bootcamp?
Do I need to be an advanced red teamer?
Do I need prior AI experience?
Can I use ChatGPT, Claude, Gemini, or another AI tool?
Should I bring a personal laptop?
Will there be hands-on labs?
What should I do if a tool does not install?
Will the course include both red team and blue team content?
Will AI be used in the class?
Do I need to complete the OpenCyberLab pre-work and CTF registration before class?
Where do I register for the CTF platform?
Where do I register for OpenCyberLab?
Where can I ask questions before class?
Download the Student Setup Checklist
Use this checklist to confirm your laptop, tools, accounts, and pre-work are ready before arriving at DEF CON Training Las Vegas. Students should complete as much setup as possible before class to reduce delays during lab time.
Confirm laptop admin access.- Confirm enough disk space.
- Install browser, Git, Python 3, VS Code, Wireshark, and archive utility.
- Install Docker or virtualization tools if instructed.
- Create or access your OpenCyberLab account.
- Register on SkillBit CTF platform (mctf.io/ignitecyber).
- Complete Mission 00 and core OpenCyberLab pre-work labs.
- Explore guided investigation path labs.
- Join the Discord community.
- Bookmark the course page.
- Save instructor support email.
- Review pre-work topics.
- Bring charger and adapters.
- Re-check this page before traveling.
Get Ready to Train, Detect, and Defend
We are excited to work with you in Las Vegas. Complete your setup checklist, register for OpenCyberLab, review the pre-work, and come ready to investigate, collaborate, and build practical blue-team skills.