What Is Blue Team Security? A Beginner’s Guide to Cyber Defense
Learn what blue team security is, how it differs from red team, what defenders do every day, and how to start a blue team career. Module 1 of The Complete Blue Team Course.
Learning Paths
Learning Paths
What Is a SOC? Roles, Tiers and Daily Workflow
What is a SOC? A Security Operations Center is the team, the processes and the tools that watch an organization’s
Learning Paths
SOC Analyst Tools: SIEM, EDR, SOAR and Ticketing
SOC analyst tools look overwhelming from the outside. Job posts list a dozen product names, and every vendor claims to
Learning Paths
Get-WinEvent Guide: Query Windows Logs in PowerShell
Get-WinEvent is the PowerShell cmdlet that turns Windows event logs into data you can filter, count and export. If you
Learning Paths
Linux Log Analysis: auth.log, journalctl and grep
Linux log analysis is mostly about knowing which file answers which question, and having a handful of commands you trust.
Learning Paths
Pyramid of Pain Explained with Real Detections
Not all indicators of compromise are equal. Blocking an IP address annoys an attacker for about five minutes. Detecting how
Learning Paths
Blue Team Home Lab: Build a Mini SOC for Free
You cannot learn blue team skills from slides alone. You need logs that you generated yourself, alerts that fired because
Learning Paths
Windows Security Event IDs Every Defender Should Know
Windows security event IDs are the vocabulary of every Windows investigation. When an alert says “4625 spike” or a colleague
Learning Paths
MITRE ATT&CK for Defenders: How to Use the Matrix
MITRE ATT&CK is the shared vocabulary of security teams. Every vendor report, detection rule and red team debrief uses it,
Learning Paths
Phishing Email Analysis: Headers, URLs, Attachments
Phishing is still the most common way attackers get a first foothold, so phishing email analysis is a core skill