Blue Team
Blue team defends. They detect attacks, respond to incidents, and harden systems. Blue teamers analyze logs, write detection rules, and hunt for threats that automated tools miss.
What Blue Team Does
- Log Analysis - Review Windows Event Logs, Sysmon, Apache logs, firewall logs for suspicious activity
- SIEM Operations - Configure and monitor Security Information and Event Management systems (Elastic Stack, Splunk, Microsoft Sentinel)
- Threat Hunting - Proactively search for threats using hypotheses (e.g., "attacker used living-off-the-land binaries in the last 24 hours")
- Incident Response - Follow structured processes (NIST SP 800-61) to contain, eradicate, and recover from attacks
- Detection Engineering - Write rules and alerts that catch real attacks while minimizing false positives
- Digital Forensics - Analyze disk images, memory dumps, and network captures for evidence
- Malware Analysis - Reverse-engineer malware to understand behavior and build detections
- Hardening - Apply security baselines, patch management, and configuration controls
Methodologies
NIST SP 800-61 (Incident Response)
Four phases: Preparation, Detection and Analysis, Containment/Eradication/Recovery, Post-Incident Activity. The standard IR framework used by most enterprise SOCs.
MITRE ATT&CK for Defenders
Maps attacker techniques to detection opportunities. Each technique tells you what logs to check and what behavior to look for.
Cyber Kill Chain (Defensive View)
Break the chain at any stage. If you detect at "deliver," you prevent "exploit." If you detect at "install," you prevent "persistence."
Diamond Model
Analyzes incidents across four dimensions: adversary, infrastructure, capability, victim. Helps understand who is attacking, how, and why.
Tools
| Tool | Purpose | Use Case |
|---|---|---|
| Elastic Stack (ELK) | SIEM and log analysis | Ingest, search, and visualize security events |
| Splunk | SIEM and log analysis | Enterprise SIEM with SPL query language |
| Sysmon | Windows endpoint monitoring | Log process creation, network connections, file hashes |
| Wireshark | Network traffic analysis | Inspect packets, follow streams, identify C2 traffic |
| Zeek (Bro) | Network security monitoring | Passive traffic analysis and protocol logging |
| Velociraptor | Endpoint visibility and DFIR | Rapid forensic collection across thousands of endpoints |
| YARA | Malware pattern matching | Write rules to classify malware families by strings |
| Sigma | Generic detection rules | Write vendor-neutral detection rules convertible to SIEM queries |
Practice Sites
- Hack The Box - Defensive modules in HTB Academy (SIEM, threat hunting, incident response)
- HTB Blue Team modules - Security Monitoring and SIEM Fundamentals, Windows Event Logs, Hunting with Elastic, Introduction to Threat Hunting
- Blue Team Labs Online (BTLO) - Defensive cybersecurity challenges (forensics, incident response, threat hunting)
- LetsDefend - SOC analyst simulation platform with a virtual SOC environment
- CyberDefenders - Blue team CTF-style challenges focused on detection and forensics
Key Concepts
False Positives vs False Negatives
- False positive - Alert fired but it was not an attack. Wastes analyst time. Too many false positives cause alert fatigue.
- False negative - Attack happened but no alert fired. This is worse. You got breached and did not know.
- Blue team goal: minimize false negatives while keeping false positives manageable.
Detection Engineering
Good detections are specific enough to catch real attacks but general enough to survive minor variations. Write detections for behaviors, not just specific IOCs. A rule that alerts on "Mimikatz.exe" is useless when the attacker renames it. A rule that alerts on "LSASS process access by a non-system process" catches the behavior regardless of tool name.
Threat Hunting
Do not wait for alerts. Form a hypothesis ("attacker may be using PowerShell to download payloads") and actively search for evidence. Use ATT&CK techniques as hunting hypotheses. If you find something, write a detection so next time the alert fires automatically.
Next Steps
- Learn the tools
- Understand fundamentals
- See how red and blue work together in purple team
- Prepare for the CJCA