Blue Team Basics

# Blue team operations - defender perspective

> Authorised work only. The focus here is what a mature blue team looks
> like: people, process, tooling, and how to measure improvement.

## The blue team mandate

- Reduce mean time to detect (MTTD) and respond (MTTR)
- Reduce blast radius via prevention controls (IAM, segmentation)
- Provide ground truth to product + engineering on real risk
- Hunt proactively, not just react to alerts

## Operating model

- 24/7 on-call (or follow-the-sun) with documented escalation
- Tier 1 triage and Tier 2 investigation roles
- Detection engineering as a discipline (not just rule editing)
- Incident response playbooks per category (cred theft, ransomware, BEC, data exfil)
- Forensic readiness: log retention long enough to support investigation

## The tooling stack (defender-grade)

- SIEM: Splunk, Sentinel, Elastic, Chronicle
- EDR: Microsoft Defender for Endpoint, CrowdStrike, SentinelOne
- Network: Zeek, Suricata, NDR vendors
- Cloud: GuardDuty / Defender for Cloud / SCC
- Identity: Entra ID logs, Okta logs, conditional access events
- SOAR: Tines, Torq, XSOAR for runbook automation
- Vuln + asset: Tenable, Qualys, Wiz, Lacework

## Metrics that matter

- MTTD, MTTR, alert volume, alert quality (precision/recall)
- Coverage: percent of MITRE ATT&CK techniques with at least one detection
- Backlog age (how long alerts wait for triage)
- Time-to-tune (new false positive to suppressed)
- Purple-team coverage and improvement over time

## Working with red teams (and pen testers)

- Pre-engagement: signed RoE, scope, comms channels
- During: track which detections fired and which did not
- Debrief: every finding gets a detection + prevention pair
- Quarterly purple-team to measure detection improvement

## Anti-patterns to avoid

- Alert volume as a vanity metric (more is not better)
- Outsourced SOC with no internal context
- Buying tools without process to operate them
- Treating compliance scans as security testing

# Blue team mindset:
#   - Visibility first (logs, metrics, EDR).
#   - Alert with low false-positive rate (or you'll be ignored).
#   - Practise IR runbooks. The first response is the most valuable.