By Davy Rogers. Use these techniques only in environments you own or have explicit permission to test.

What is a Blue Team

The Blue Team is the defensive counterpart to the Red Team in cybersecurity. While Red Teams simulate attacks, Blue Teams defend against them—monitoring networks, detecting threats, responding to incidents, and continuously improving security posture. If Red Teams are the "ethical adversaries," Blue Teams are the "cyber defenders" protecting organizations from real-world threats 24/7/365.

What You'll Learn

  • The role and responsibilities of Blue Teams
  • Security Operations Center (SOC) operations
  • Defensive technologies and tools
  • Incident detection and response
  • Threat hunting fundamentals
  • Career paths in defensive security
  • How Blue Teams work with Red Teams

What is a Blue Team?

Blue Team refers to security professionals responsible for defending an organization's information systems. They focus on:

  • Prevention: Implementing security controls
  • Detection: Identifying security incidents
  • Response: Containing and recovering from attacks
  • Improvement: Learning from incidents to strengthen defenses

Core Responsibilities:

  1. Monitor - Watch for suspicious activity
  2. Detect - Identify security incidents
  3. Analyze - Investigate alerts and anomalies
  4. Respond - Contain and remediate threats
  5. Recover - Restore normal operations
  6. Improve - Enhance security posture

The Security Operations Center (SOC)

The SOC is the nerve center of Blue Team operations—a centralized facility where security analysts monitor and protect the organization's assets.

SOC Tiers:

┌─────────────────────────────────────┐
│   Tier 3: SOC Manager / Architect   │
│   Strategic planning, leadership    │
├─────────────────────────────────────┤
│   Tier 2: Incident Responder        │
│   Deep investigation, remediation   │
├─────────────────────────────────────┤
│   Tier 1: Security Analyst          │
│   Alert triage, initial analysis    │
└─────────────────────────────────────┘

Tier 1: Security Analyst

  • Entry-level position
  • Monitor SIEM dashboards
  • Triage alerts (true positive vs. false positive)
  • Escalate serious incidents to Tier 2
  • Follow playbooks and runbooks

Daily Tasks:

09:00 - Check overnight alerts (150 new alerts)
09:30 - Investigate failed login attempts from Russia
10:00 - Document false positive (authorized port scan)
11:00 - Escalate ransomware indicators to Tier 2
12:00 - Update ticket documentation

Tier 2: Incident Responder

  • Experienced analyst
  • Deep-dive investigations
  • Malware analysis
  • Forensics and root cause analysis
  • Coordinate response efforts

Skills:

  • Log analysis
  • Network forensics
  • Malware triage
  • Scripting (Python, PowerShell)
  • Communication with stakeholders

Tier 3: SOC Manager / Threat Hunter

  • Leadership and strategy
  • Proactive threat hunting
  • Process improvement
  • Mentoring junior analysts
  • Stakeholder reporting

SOC Models:

In-House SOC

  • Dedicated team within organization
  • Expensive but full control
  • Common in large enterprises

Managed SOC (MSOC)

  • Outsourced to third-party provider
  • Cost-effective for smaller organizations
  • 24/7 coverage without staffing burden

Hybrid SOC

  • Combination of in-house and outsourced
  • In-house during business hours, outsourced after-hours

Virtual SOC

  • Distributed team (remote workers)
  • Leverages technology for collaboration
  • Increasingly common post-2020

Blue Team Technologies

1. SIEM (Security Information and Event Management)

The central brain of the SOC—aggregates logs and detects threats.

Popular SIEM Platforms:

  • Splunk 🥇 - Industry leader, powerful, expensive
  • Elastic Stack (ELK) - Open-source (Elasticsearch, Logstash, Kibana)
  • IBM QRadar - Enterprise solution
  • Microsoft Sentinel - Cloud-native (Azure)
  • ArcSight - Micro Focus enterprise SIEM

What SIEM Does:

Logs from everywhere → SIEM → Correlation → Alerts
                                    ↓
                           Dashboard & Reports

Example SIEM Query (Splunk):

index=windows EventCode=4625
| stats count by src_ip
| where count > 10
| table src_ip count

Translation: Find IPs with more than 10 failed logins

2. EDR (Endpoint Detection and Response)

Monitor and respond to threats on individual devices.

Leading EDR Solutions:

  • CrowdStrike Falcon
  • Microsoft Defender for Endpoint
  • SentinelOne
  • Carbon Black
  • Cortex XDR (Palo Alto)

EDR Capabilities:

  • Real-time monitoring
  • Behavioral analysis
  • Threat detection and blocking
  • Forensics and investigation
  • Remote remediation
# Example: Investigate suspicious process
# EDR console shows:
Process: powershell.exe
Parent: excel.exe (suspicious!)
Command Line: -enc <base64 encoded command>
Network: Connected to 192.0.2.100:443
Action: BLOCKED and ISOLATED host

3. IDS/IPS (Intrusion Detection/Prevention System)

IDS - Detects and alerts on suspicious network traffic IPS - Detects AND blocks suspicious traffic

Popular Solutions:

  • Snort (open-source)
  • Suricata (open-source, multi-threaded)
  • Palo Alto Networks
  • Cisco Firepower
  • Fortinet FortiGate

Example Snort Rule:

alert tcp any any -> $HOME_NET 80 (msg:"SQL Injection Attempt"; 
  content:"union"; content:"select"; nocase; sid:1000001;)

Detects "union select" in HTTP traffic (SQL injection)

4. SOAR (Security Orchestration, Automation, and Response)

Automate repetitive tasks and orchestrate incident response.

SOAR Platforms:

  • Palo Alto Cortex XSOAR
  • Splunk Phantom
  • IBM Resilient
  • Swimlane
  • TheHive (open-source)

Example Automation:

1. SIEM detects phishing email
2. SOAR automatically:
   - Quarantines email
   - Blocks sender domain in email gateway
   - Creates ticket in ServiceNow
   - Notifies security team
   - Generates incident report

5. Threat Intelligence Platform (TIP)

Aggregate and analyze threat intelligence from multiple sources.

Platforms:

  • MISP (open-source)
  • ThreatConnect
  • Anomali
  • ThreatQuotient

Intelligence Sources:

  • IOCs (Indicators of Compromise)
  • Threat actor profiles
  • Malware signatures
  • Vulnerability feeds
  • Dark web monitoring

6. Network Security Monitoring (NSM)

Zeek (formerly Bro):

# Network traffic analysis
# Logs connections, DNS, HTTP, SSL, etc.
zeek -r capture.pcap

# Example output: http.log, dns.log, conn.log

Wireshark:

# Packet capture and analysis
# Display filter examples:
ip.addr == 10.0.0.5
http.request.method == "POST"
tcp.flags.syn == 1 && tcp.flags.ack == 0

Security Onion:

  • Full NSM platform
  • Combines Zeek, Suricata, Elasticsearch, Kibana
  • Ready-to-use distribution

The Incident Response Process

1. Preparation

  • Develop IR plan
  • Train team
  • Deploy tools (SIEM, EDR)
  • Establish communication channels

2. Identification (Detection)

  • Monitor alerts
  • Analyze anomalies
  • Determine if incident is real
  • Classify severity

Example Alert:

ALERT: Multiple failed RDP logins
Source: 203.0.113.50
Target: DC01 (Domain Controller)
Count: 250 attempts in 5 minutes
Severity: HIGH

3. Containment

Short-term:

  • Isolate infected system
  • Block malicious IP/domain
  • Disable compromised account
# Block IP at firewall
iptables -A INPUT -s 203.0.113.50 -j DROP

# Disable user account
net user jsmith /active:no

# Isolate host (EDR command)
falcon-cli contain-host HOSTNAME

Long-term:

  • Patch vulnerabilities
  • Improve detection rules
  • Segment network

4. Eradication

  • Remove malware
  • Delete backdoors
  • Close vulnerabilities
  • Reset compromised credentials
# Example: Remove scheduled task persistence
Get-ScheduledTask | Where-Object {$_.TaskName -like "*WindowsUpdate*"}
Unregister-ScheduledTask -TaskName "FakeWindowsUpdate"

# Scan for malware
Start-MpScan -ScanType FullScan

5. Recovery

  • Restore systems from clean backups
  • Rebuild infected systems
  • Verify systems are clean
  • Return to normal operations
# Restore from backup
rsync -av --delete /backups/2024-10-07/ /var/www/html/

# Monitor for reinfection
tail -f /var/log/syslog

6. Lessons Learned (Post-Incident Review)

  • What happened?
  • What went well?
  • What could improve?
  • Update playbooks
  • Implement preventive measures

Post-Incident Report Template:

## Executive Summary
Ransomware incident contained within 2 hours. No data loss.

## Timeline
- 14:23 - Initial phishing email received
- 14:35 - User clicked malicious link
- 14:40 - First encryption detected
- 14:42 - SOC analyst identified alert
- 14:45 - System isolated
- 16:30 - Recovery complete

## Root Cause
Lack of email filtering for macro-enabled documents

## Recommendations
1. Implement advanced email filtering
2. Disable macros by default
3. Additional phishing awareness training

Threat Hunting

Proactive search for threats that evade automated detection.

The Hypothesis-Driven Approach:

  1. Develop hypothesis: "Attackers may be using LOLBins for lateral movement"
  2. Collect data: PowerShell logs, process creation events
  3. Analyze: Search for suspicious certutil, bitsadmin usage
  4. Document: Record findings, update detection rules

Example Hunt:

Hypothesis: Attackers using PowerShell for persistence

# Splunk query
index=windows EventCode=4688
| search CommandLine="*-enc*" OR CommandLine="*-encodedcommand*"
| stats count by ComputerName, User, CommandLine
| where count > 1

Finding: Detected base64-encoded PowerShell running from Excel

Action:

  • Investigate further
  • Create detection rule
  • Update EDR policies

Threat Hunting Tools:

  • Velociraptor - Endpoint visibility and collection
  • GRR Rapid Response - Remote live forensics
  • OSQuery - SQL-powered endpoint monitoring
  • Sysmon - Windows system monitor (logs process creation, network connections)
# OSQuery example: Find suspicious processes
osqueryi
> SELECT pid, name, path, cmdline FROM processes 
  WHERE name LIKE '%powershell%' AND cmdline LIKE '%enc%';

Blue Team Methodologies and Frameworks

1. NIST Cybersecurity Framework 2.0

NIST CSF 2.0 adds governance explicitly, so defenders should think about security outcomes as management and risk decisions as well as technical controls.

Six core functions:

  1. Govern - Risk strategy, policy, oversight, and accountability
  2. Identify - Asset management, risk assessment
  3. Protect - Access control, security awareness
  4. Detect - Continuous monitoring, detection processes
  5. Respond - Incident response, communications
  6. Recover - Recovery planning, improvements

2. MITRE ATT&CK for Defenders

Use ATT&CK to:

  • Map detections to adversary techniques
  • Identify gaps in coverage
  • Prioritize security investments

Example Defensive Mapping:

Technique: T1003.001 (LSASS Memory Dumping)
Detections:
- Sysmon Event ID 10 (ProcessAccess to lsass.exe)
- EDR behavioral detection
- LSASS process protection enabled
Coverage: FULL ✅

3. Pyramid of Pain

Levels of IOCs by difficulty for attackers to change:

        ╱╲  TTPs (Tactics, Techniques, Procedures)
       ╱  ╲    ↑ MOST DIFFICULT for attacker
      ╱────╲  Tools
     ╱──────╲ Network/Host Artifacts  
    ╱────────╲ Domain Names
   ╱──────────╲ IP Addresses
  ╱────────────╲ Hash Values
 ╱──────────────╲ ↓ EASIEST for attacker to change

Focus on TTPs: Hardest for attackers to change behavior

Log Analysis Fundamentals

Key Log Sources:

Windows:

  • Security logs (Event ID 4624 = login, 4625 = failed login)
  • System logs
  • PowerShell logs
  • Sysmon logs
# View Security Event Log
Get-EventLog -LogName Security -Newest 100

# Failed login attempts
Get-EventLog -LogName Security | Where-Object {$_.EventID -eq 4625}

Linux:

  • /var/log/auth.log - Authentication
  • /var/log/syslog - System messages
  • /var/log/apache2/access.log - Web server
  • /var/log/secure - Security events (RHEL/CentOS)
# Failed SSH login attempts
grep "Failed password" /var/log/auth.log

# Successful sudo commands
grep "sudo" /var/log/auth.log | grep "COMMAND"

Network:

  • Firewall logs
  • Proxy logs
  • DNS logs
  • NetFlow/sFlow data

Log Analysis Example:

Scenario: Investigating potential data exfiltration

# 1. Large outbound transfer detected
# Check firewall logs
grep "203.0.113.50" /var/log/firewall.log

# 2. Identify source host
# 10.0.10.25 transferred 5GB to 203.0.113.50

# 3. Check what process made connection (EDR)
# Process: python.exe
# Command: python -m http.server 8000

# 4. Check user activity
lastlog -u jsmith
w jsmith

# 5. Timeline of events
# 13:00 - User jsmith logged in
# 13:15 - Accessed \\fileserver\sensitive-data\
# 13:30 - Started Python HTTP server
# 13:35 - Large data transfer to external IP

Conclusion: Data exfiltration by insider threat

Career Path: Becoming a Blue Teamer

Entry-Level Positions:

Security Analyst (SOC Tier 1)

  • Monitor SIEM alerts
  • Triage incidents
  • Follow playbooks
  • Salary: $50k-$70k

Requirements:

  • Understanding of networking (TCP/IP, DNS, HTTP)
  • Basic Linux and Windows knowledge
  • Security+ or similar certification
  • Strong analytical skills

Mid-Level Positions:

Incident Responder (SOC Tier 2)

  • Investigation and forensics
  • Malware analysis
  • Threat hunting
  • Salary: $70k-$100k

Requirements:

  • 2-3 years SOC experience
  • Scripting (Python, PowerShell)
  • GCIH, GCIA, or CEH certification
  • Deep technical knowledge

Security Engineer

  • Implement security tools (SIEM, EDR, firewalls)
  • Tune detection rules
  • Automation and orchestration
  • Salary: $90k-$130k

Senior-Level Positions:

SOC Manager / Lead

  • Team leadership
  • Metrics and reporting
  • Process improvement
  • Salary: $110k-$150k+

Threat Hunter

  • Proactive threat detection
  • Advanced analysis
  • Research and development
  • Salary: $100k-$140k

Security Architect

  • Design security infrastructure
  • Strategic planning
  • Vendor selection
  • Salary: $130k-$180k+

Entry:

  • CompTIA Security+
  • CompTIA CySA+ (Cybersecurity Analyst)
  • BTL1 (Blue Team Level 1)

Intermediate:

  • GCIH (GIAC Certified Incident Handler)
  • GCIA (GIAC Certified Intrusion Analyst)
  • GMON (GIAC Continuous Monitoring)
  • CEH (Certified Ethical Hacker)

Advanced:

  • GCFA (GIAC Certified Forensic Analyst)
  • GREM (GIAC Reverse Engineering Malware)
  • CISSP (Certified Information Systems Security Professional)
  • OSDA (Offensive Security Defense Analyst)

Blue Team vs. Red Team Exercises

Benefits of Red/Blue Exercises:

  1. Test detections - Do your tools actually work?
  2. Train analysts - Real-world practice
  3. Validate processes - Incident response under pressure
  4. Identify gaps - What didn't you detect?
  5. Build experience - Safe practice environment

Exercise Structure:

Pre-Exercise:

  • Define scope and objectives
  • Rules of engagement
  • Success criteria

During Exercise:

  • Red Team attacks per schedule
  • Blue Team monitors and responds
  • White Team observes and evaluates

Post-Exercise:

  • Debrief (Hot Wash)
  • Lessons learned
  • Action items for improvement

Example Scenario:

Day 1: Red Team sends phishing emails
      Blue Team: Should detect suspicious emails

Day 2: Red Team establishes C2 beacon
      Blue Team: Should detect unusual outbound connections

Day 3: Red Team attempts lateral movement
      Blue Team: Should detect abnormal authentication patterns

Day 4: Red Team exfiltrates data
      Blue Team: Should detect large outbound transfers

Common Blue Team Challenges

1. Alert Fatigue

Problem: Thousands of alerts daily, mostly false positives

Solutions:

  • Tune SIEM rules
  • Implement SOAR for automation
  • Focus on high-fidelity alerts
  • Regular rule review and updates

2. Skills Gap

Problem: Not enough trained security analysts

Solutions:

  • Training and mentorship programs
  • Hire for aptitude, train for skills
  • Cross-training with Red Team
  • Certifications and continuous learning

3. Tool Sprawl

Problem: Too many security tools, no integration

Solutions:

  • Consolidate vendors
  • Implement SOAR for orchestration
  • API integrations
  • Standardize on key platforms

4. Budget Constraints

Problem: Limited resources for tools and staff

Solutions:

  • Prioritize high-impact controls
  • Leverage open-source tools
  • Managed SOC services
  • Risk-based approach

5. Keeping Up with Threats

Problem: Threat landscape evolves rapidly

Solutions:

  • Threat intelligence feeds
  • Community participation
  • Continuous learning
  • Purple team exercises

Try It Yourself

Home Lab Setup:

1. Build Blue Team Lab:

Network Setup:
- pfSense firewall
- Security Onion (NSM platform)
- Windows Server (Domain Controller)
- Windows 10 client
- Linux server (web server)
- Splunk or ELK for SIEM

2. Generate Logs:

# Configure Sysmon on Windows
sysmon -i sysmonconfig.xml

# Forward logs to SIEM
# Configure WinLogBeat or Splunk Universal Forwarder

3. Practice Detection:

  • Run Mimikatz, see if you can detect it
  • Generate network scans, observe logs
  • Simulate phishing, track email logs

Beginner Exercises:

1. Log Analysis:

# Download sample security logs
# Analyze for:
# - Failed login attempts
# - Privilege escalation
# - Unusual process execution

2. Create SIEM Rules:

# Splunk: Detect brute force
index=windows EventCode=4625
| stats count by TargetUserName, IpAddress
| where count > 10

3. Incident Response:

  • Download a malware sample (use malware sandbox!)
  • Analyze in isolated VM
  • Write incident report

Platforms for Practice:

  • CyberDefenders - Blue team CTF challenges
  • Blue Team Labs Online (BTLO) - Defensive security training
  • LetsDefend - SOC analyst training platform
  • TryHackMe - Blue team learning paths
  • RangeForce - Enterprise SOC simulation

Resources

Books:

  • "Blue Team Handbook" by Don Murdoch
  • "The Practice of Network Security Monitoring" by Richard Bejtlich
  • "Applied Incident Response" by Steve Anson
  • "Intelligence-Driven Incident Response" by Scott J. Roberts

Training:

  • SANS FOR508: Advanced Incident Response
  • SANS SEC555: SIEM with Tactical Analytics
  • eLearnSecurity Blue Team courses
  • TryHackMe SOC Level 1 & 2 learning paths
  • Incident Response for Teams That Ship Daily - Playbooks, communication, and containment for fast-moving engineering teams
  • Logging and Detection Engineering - Writing logs that help you find attackers — structured, contextual, and actionable

Blogs & Communities:

Tools Collections:

Next Steps

  1. Next lesson: Set up your pentesting lab environment
  2. Download Security Onion: Practice NSM
  3. Join communities: Connect with other blue teamers
  4. Practice log analysis: Download sample logs and investigate
  5. Stay current: Follow security news and threat intelligence

Remember: Blue Team work is challenging but incredibly rewarding. You're the guardian standing between attackers and your organization's critical assets. Every day, you make the internet a safer place!

"Defense is not just about building walls—it's about understanding how attackers climb over them." - Blue Team Philosophy

Up next

Lab Setup

Setting up your own penetration testing lab environment.