Linux Log Analysis for Defenders: auth.log, journalctl, and auditd
The Linux security model, where Linux logs live, and how auditd turns a server into a system you can investigate. Module 5 of The Complete Blue Team Course.
What Is a SIEM? Log Management and Security Monitoring Explained
What a SIEM actually does, how to write queries that matter, and how to manage log retention and cost. Module 6 of The Complete Blue Team Course.
MITRE ATT&CK for Defenders: Mapping Detections to Techniques
How blue teams use MITRE ATT&CK to describe attacker behavior, track detection coverage, and build detections that produce signal instead of noise. Module 7 of The Complete Blue Team Course.
Threat Intelligence for Defenders: Turning Intel into Detections
What threat intelligence is for, the strategic, operational and tactical levels, and how defenders turn intel into real detections. Module 8 of The Complete Blue Team Course.
What Is EDR? Endpoint Detection and Response Explained
What EDR adds beyond antivirus, how to investigate an EDR alert by walking the process tree, and how to tune it. Module 9 of The Complete Blue Team Course.
Network Security Monitoring with Wireshark and Zeek
Why network visibility still matters, how Wireshark and Zeek differ, and what defenders can learn from encrypted traffic. Module 10 of The Complete Blue Team Course.
Threat Hunting 101: How to Build a Hunt from a Hypothesis
Hunting vs alerting, how to structure a hunt from a hypothesis, and where hunt ideas come from. Module 11 of The Complete Blue Team Course.
Incident Response Lifecycle: The Phases Every Defender Should Know
The standard phases of incident response, how to approach containment decisions under pressure, and how to make lessons learned actually change something. Module 12 of The Complete Blue Team Course.
Digital Forensics Fundamentals: Order of Volatility and Chain of Custody
The order of volatility, memory forensics basics, and chain of custody. Module 13 of The Complete Blue Team Course.
Malware Analysis Basics for Defenders: Static vs Dynamic Analysis
Static vs dynamic malware analysis, how to set up a safe environment, and what defenders actually need from analysis. Module 14 of The Complete Blue Team Course.