Introduction
Blue team learning here focuses on judgment under incomplete information. Use the library filters for SOC materials and reinforce skills with CTF forensics and defensive-style challenges when available.
Learning objectives
- Read and interpret common telemetry sources with a defender mindset.
- Triage alerts with clear hypotheses and evidence trails.
- Practice detection engineering basics and hunting questions.
- Collaborate on incident narratives that are useful to responders.
Roadmap
- 01
Security operations foundations
SOC roles, alert lifecycle, severity vs. priority, and documentation discipline.
- 02
Telemetry literacy
Logs, endpoints, network signals, and how attackers leave measurable traces.
- 03
Triage and investigation
Hypothesis-driven analysis, enrichment, and escalating with context.
- 04
Detection and hunting
Writing useful detections, reducing noise, and proactive hunts.
- 05
Response collaboration
Containment communication, handoffs, and post-incident learning.
Tools & references
- SIEM concepts and query practice
- Packet / log analysis utilities
- Endpoint telemetry viewers
- Case notes and timeline tools