Blue Teaming
Certified Blue Team Defense Engineer
Build and run the defensive side: security architecture, network and endpoint monitoring, log management, SIEM engineering, threat hunting, digital forensics and incident response.
What the blue team actually owns
The blue team is not "the people who patch". It owns the ability to know and the ability to
act, in that order:
- Know that something is happening — telemetry coverage, correlation, detection content
- Decide what it means — triage, scoping, judgement under uncertainty
- Act — containment, eradication, recovery, communication
- Improve — every incident must reduce the next one's cost
Most organisations are strong at 4 in theory and weak at 1 in practice. They have a documented
"continuous improvement" process and no idea what happened on the subnet in March.
The central skill: measurement
Defensive maturity is not a feeling. It is measurable, and every serious blue team tracks the same
small set of numbers:
| Metric | What it tells you | Bad sign |
|---|---|---|
| Mean time to detect (MTTD) | How long an adversary is invisible | Weeks |
| Mean time to respond (MTTR) | How long impact lasts | Days |
| Telemetry coverage | How much of the estate is visible | Patch management systems only |
| Detection coverage | How much of ATT&CK is alerted on | 10% of techniques |
| Alert-to-incident ratio | Whether your detections are worth anything | 100:1 with no tuning |
| False positive rate per analyst per day | Whether the SOC is drowning | Over 20 |
| Critical vulnerabilities unpatched beyond SLA | Whether you can be exploited | Growing |
| Percentage of incidents discovered internally | Whether detection works at all | Under 50% |
If you cannot state these numbers, you cannot improve them, and "improve the SOC" becomes an
opinion rather than a plan.
What you will be able to do
- Design a security architecture that assumes compromise rather than preventing it
- Specify log sources by what they can prove, not by what is convenient to collect
- Engineer detections that fire on adversary behaviour and can be tuned to a usable signal rate
- Run a full incident response, from first triage to a written timeline and lessons learned
- Perform disk, memory and network forensics to answer questions the logs cannot
- Hunt on a hypothesis, with a documented loop, rather than staring at dashboards
Syllabus
-
1
Blue team fundamentals and security architecture
Defensive mission, threat-informed design, and why prevention alone always fails.
Locked -
2
Log management and what each source can prove
Collecting by investigative value, not by convenience, and making logs defensible.
Locked -
3
SIEM engineering, detection content and tuning
Writing detections that fire on behaviour, and getting the false positive rate down.
Locked -
4
Threat hunting
Hypothesis-driven investigation, and when hunting is worth the time.
Locked -
5
Digital forensics and malware analysis fundamentals
Answering questions the logs cannot, and understanding what the malware actually did.
Locked -
6
Incident response and security monitoring
Running an incident from triage to lessons learned, and monitoring the defensive estate itself.
Locked
Final exam
Locked. Enrol in the course to unlock the final exam.