Home / Cybersecurity / How To become Blue teamer
How To become Blue teamer
Beginner
v1.0.0
Master Blue Teaming from Security Fundamentals to Advanced Defense
A practical and structured roadmap designed to take learners from cybersecurity fundamentals to advanced Blue Team operations. Learn networking, Linux, Windows security, security monitoring, SOC operations, SIEM, log analysis, threat detection, incident response, digital forensics, threat intelligence, malware analysis, endpoint security, vulnerability management, detection engineering, threat hunting, security automation, and defensive security operations.
Your progress
0 / 112 topics
0 %
Saved in this browser. Clearing site data will reset it.
Topics in this roadmap
The interactive map needs JavaScript. Here is the full list.
Defensive Mindset
A defensive mindset means assuming that prevention will sometimes fail and planning to detect and respond quickly when it does. Instead of chasing perfect security, defenders reduce risk, shorten the time an attacker stays hidden, and make intrusions expensive. Thinking about attacker goals and behaviour, rather than only individual vulnerabilities, lets you build detections that catch whole categories of activity rather than single tools.
CIA Triad
The CIA triad describes the three core goals of security: confidentiality, keeping data private, integrity, keeping it accurate and unaltered, and availability, keeping systems usable. Every control and every incident can be understood in terms of which of these it protects or threatens. It is a simple but durable framework that helps you classify risks and explain to non technical stakeholders why a given issue matters.
Defense in Depth
Defense in depth layers multiple independent controls so that if one fails, others still stand between the attacker and the target. Network, host, application, identity and data controls each add a barrier, and monitoring wraps around them all. The idea is that no single control is perfect, so overlapping defences buy time and create multiple chances to detect an intruder before real damage occurs.
SOC Overview
A security operations centre is the team and technology responsible for continuous monitoring, detection and response. It is often organised in tiers, from analysts who triage alerts to responders and hunters who investigate deeper. Understanding how a SOC works, its shifts, its escalation paths and its tools, gives you the context for almost every blue team job, since most defensive roles feed into or grow from SOC operations.
ATT&CK for Defense
MITRE ATT&CK is a knowledge base of real attacker tactics and techniques, and for defenders it is a map for measuring and improving detection coverage. By mapping your detections to ATT&CK techniques, you can see which attacker behaviours you would catch and which you would miss. This turns defence from a guess into a measurable exercise and gives your whole team a shared language for describing threats.
MITRE ATT&CK
Cyber Kill Chain
The Cyber Kill Chain breaks an intrusion into stages from reconnaissance through to actions on objectives. For defenders it is valuable because stopping an attacker at any single stage can prevent the final impact. Mapping detections and controls to each stage shows where you can intervene earliest and cheapest, and it helps you communicate how far an attacker progressed during an incident.
TCP/IP for Defenders
Understanding TCP IP lets you interpret connection logs, spot scanning and read packet captures. TCP uses a three way handshake and reliable delivery, while UDP is connectionless. Recognising these patterns helps you tell a normal connection from a scan or a failed exploit attempt. Knowing which protocol a service uses also tells you what its normal traffic should look like, which is the baseline every detection depends on.
DNS Monitoring
DNS is a favourite channel for attackers because it is almost always allowed out and often lightly inspected, so monitoring it is high value. Logging and analysing DNS queries can reveal command and control beacons, data exfiltration hidden in subdomains, and connections to newly registered or suspicious domains. Because so much malware relies on DNS, strong DNS visibility catches activity that other logs miss.
Network Protocols
Defenders benefit from knowing the common protocols and their normal behaviour, including HTTP and HTTPS, SMB, RDP, LDAP and Kerberos. Each has telltale signs when abused, such as unusual SMB access patterns or anomalous authentication traffic. Learning what each protocol should look like in your environment is what lets you notice when an attacker uses it for lateral movement or credential theft.
Firewalls
Firewalls control which traffic is allowed between network zones, forming a first line of prevention and a rich source of logs. Understanding rule sets, default deny policies and how to read firewall logs helps you both restrict attacker movement and detect blocked or suspicious connection attempts. Firewall logs are often an early indicator of scanning, exfiltration attempts and connections to known bad destinations.
Network Segmentation
Segmentation divides a network into zones so that a compromise in one area cannot freely spread to others, which directly limits an attacker lateral movement. Well designed segmentation isolates sensitive systems, restricts east to west traffic and creates natural monitoring points. It is one of the most effective architectural defences, turning a single foothold into a contained problem rather than a network wide breach.
Linux Security
Linux runs most servers and infrastructure, so defending it is essential. Key areas include user and permission management, service hardening, auditing with the audit daemon, and monitoring logs such as authentication and system logs. Understanding how attackers escalate privileges and persist on Linux tells you which files, cron jobs and configurations to watch. Solid Linux visibility often reveals server side compromises that endpoint tools on desktops would never see.
Active Directory Security
Active Directory is the identity backbone of most enterprises and a primary attacker target, so securing and monitoring it is a core blue team task. This covers understanding authentication protocols, protecting privileged accounts, monitoring for suspicious ticket and logon activity, and hardening the directory against common attacks. Because domain compromise is often the attacker goal, detecting early stage Active Directory abuse can stop an incident before it becomes catastrophic.
Group Policy Hardening
Group Policy centrally configures Windows systems across a domain, making it a powerful hardening tool. Defenders use it to enforce secure settings, disable risky features, enable detailed logging and restrict which programs can run. Because Group Policy is so powerful, it is also a target for attackers who gain privilege, so understanding both how to harden with it and how to monitor changes to it is important.
System Services and Registry
Windows services and the registry are common places for attackers to gain privilege and persistence, so defenders must understand them well. Monitoring service creation, changes to auto start locations and modifications to sensitive registry keys reveals many persistence and escalation attempts. Knowing what normal service and registry activity looks like in your environment is what lets you spot the small malicious changes hidden among it.
Secure Baselines
A secure baseline is a documented, hardened configuration that every system of a given type should match, drawn from recognised benchmarks. Baselines reduce the attack surface, make systems consistent, and give you a reference to detect drift and tampering. When every host follows a known good baseline, unexpected changes stand out, and enforcing baselines closes many of the misconfigurations that attackers rely on.
Windows Event Logs
Windows event logs record security, system and application events, and they are a primary detection source once configured properly. Important events include logons, account changes, process creation and privilege use. Default settings miss much of this, so defenders enable extra auditing to capture the events attacks generate. Learning the key event identifiers and what they mean is one of the highest return investments a defender can make.
Syslog
Syslog is the standard logging protocol for Linux systems, network devices and appliances, sending events to a central server. It is the backbone of collecting logs from the many non Windows devices in an environment, including firewalls, routers and servers. Understanding syslog formats, facilities and severity levels helps you build a complete picture of activity across the diverse devices that make up a real network.
Sysmon
Sysmon is a free Windows tool that dramatically improves visibility by logging detailed events such as process creation with command lines, network connections, file changes and image loads. Its rich, filterable data is a favourite among defenders for building strong detections. A well tuned Sysmon configuration turns ordinary Windows hosts into a deep telemetry source that catches behaviour default logging would completely miss.
Sysmon
Log Sources
Choosing the right log sources is about coverage and value, not volume. High value sources include endpoint process and authentication logs, DNS, web proxy, firewall and cloud audit logs. Each source reveals different attacker behaviour, and gaps leave blind spots. Mapping your sources to the attacker behaviours you want to detect ensures you collect what matters rather than simply hoarding data that no one uses.
Log Retention
Retention policy decides how long logs are kept, balancing investigative need, compliance requirements and storage cost. Attackers often remain undetected for weeks or months, so short retention can mean the evidence you need is already gone when an incident is discovered. Planning retention carefully, with longer storage for the most valuable sources, ensures you can reconstruct an incident that began long before it was noticed.
Centralized Logging
Centralized logging gathers logs from every source into one platform where they can be searched, correlated and protected together. It prevents attackers from simply erasing local logs, enables cross host analysis, and is a prerequisite for a functioning SIEM. Reliable collection pipelines and consistent formatting are the unglamorous but essential foundation that makes all higher level detection possible.
Splunk
Splunk is one of the most widely used SIEM and log analysis platforms, known for its powerful search language that lets analysts slice large volumes of data quickly. Learning its query syntax, field extraction and dashboarding is directly employable, and free practice datasets let you build real skills. Because it appears in so many organisations, Splunk experience transfers well across blue team jobs.
Splunk Docs
Splunk Boss of the SOC
Elastic and ELK
The Elastic Stack, often called ELK, combines Elasticsearch for storage and search, Logstash or Beats for ingestion, and Kibana for visualisation, forming a popular open source SIEM foundation. It is flexible and free to start with, which makes it common in labs and cost conscious teams. Understanding its query language and detection rules gives you a strong, portable open source skill set.
Elastic Guide
Microsoft Sentinel
Microsoft Sentinel is a cloud native SIEM built on Azure that integrates tightly with Microsoft and third party data sources and uses the Kusto Query Language for detections. As organisations move to the cloud and to Microsoft ecosystems, Sentinel skills are increasingly in demand. Learning its analytics rules, workbooks and automation shows you can defend modern cloud centric environments.
Microsoft Sentinel
Correlation Rules
Correlation rules combine multiple events across time and sources into a single meaningful alert, such as many failed logons followed by a success from a new location. They turn low value individual events into high value detections and are the core of turning logs into actionable alerts. Writing precise correlation logic that catches real attacks without flooding analysts is one of the defining SIEM skills.
Dashboards
Dashboards summarise security data visually so analysts and leaders can grasp the state of the environment at a glance. Effective dashboards highlight anomalies, track key metrics and support investigations rather than just showing pretty charts. Designing them well requires knowing which few numbers actually matter, so that a dashboard drives attention to real problems instead of adding noise.
Alert Tuning
Alert tuning is the ongoing work of adjusting detections so they fire on real threats and stay quiet on benign activity. Too many false positives cause alert fatigue, where analysts start ignoring alerts, which is how real attacks slip through. Careful tuning, based on understanding your environment baseline, is one of the most valuable and underrated skills in a security operations centre.
Detection Engineering
Detection engineering treats detections like software, with a lifecycle of research, development, testing and maintenance. Engineers study attacker techniques, build detections against the underlying behaviour, validate them with real or simulated attacks, and refine them over time. This disciplined approach produces durable, high quality detections rather than brittle rules, and it is one of the most in demand blue team skill sets today.
MITRE ATT&CK
Sigma Rules
Sigma is a generic, vendor neutral format for writing detection rules that can be converted to run on many different SIEM platforms. It lets the community share detections in a portable way and lets teams avoid locking their detection logic to one product. Learning Sigma means you can read, write and share detections widely, and translate them to whatever platform your organisation uses.
Sigma Rules
YARA Rules
YARA is a pattern matching tool used to identify and classify files, especially malware, based on textual or binary patterns. Analysts write YARA rules to detect malware families across files, memory and network captures. It is a staple of malware analysis and threat hunting, giving defenders a precise way to hunt for known malicious content and to share indicators with others.
YARA
Behavioral Detection
Behavioural detection focuses on what an attacker does, such as a process spawning a shell or a service creating a scheduled task, rather than on specific file signatures that are easy to change. Because behaviours are harder for attackers to alter than tools, behavioural detections are more durable. Building them requires understanding attacker techniques deeply, which is why it sits at the more advanced end of detection work.
IOC versus IOA
Indicators of compromise are artifacts like file hashes or IP addresses that show an attack occurred, while indicators of attack describe the behaviour and intent behind an action as it happens. IOCs are easy to use but quickly outdated, whereas IOAs catch novel attacks by focusing on behaviour. Balancing both, using IOCs for known threats and IOAs for unknown ones, gives the strongest coverage.
Detection Maturity
Detection maturity models help a team assess how advanced their detection capability is, from relying on simple indicators to detecting sophisticated behaviour and adversary tactics. Understanding where you sit lets you prioritise improvements sensibly. Maturity is not about having more alerts but about detecting deeper, harder to evade behaviour, and measuring it keeps a program honest about its real coverage.
Antivirus
Antivirus provides a baseline layer of endpoint protection, mainly using signatures and heuristics to block known malware. It stops a large volume of commodity threats cheaply, but it struggles against novel or fileless attacks, which is why it is now paired with behaviour based tools. Understanding what antivirus can and cannot catch helps you set realistic expectations and layer stronger detection on top of it.
EDR Tools
EDR platforms go far beyond antivirus by continuously recording endpoint behaviour and using it for detection, investigation and response. They let analysts see the full story of what a process did, isolate a host remotely, and hunt across all endpoints. Learning to query their data and tune their detections turns them from an alert generator into a powerful investigation and hunting tool.
Atomic Red Team
Application Whitelisting
Application whitelisting, or allow listing, permits only approved programs to run and blocks everything else, which is one of the strongest preventive controls against malware. It flips the usual model from blocking known bad to allowing only known good. It requires careful setup and maintenance, but where it is deployed well it stops a huge range of attacks, including many that evade signature based tools.
Host Hardening
Host hardening reduces the attack surface of a system by disabling unnecessary services, applying secure configurations, enforcing least privilege and keeping software patched. A hardened host gives an attacker fewer options and generates cleaner logs, since unusual activity stands out more. Hardening works hand in hand with detection: prevention lowers the number of incidents, and cleaner baselines make the remaining ones easier to spot.
Endpoint Forensics
Endpoint forensics examines a host in detail to reconstruct what an attacker did, using artifacts such as event logs, prefetch data, registry hives and file system timelines. It is essential during incident response to determine scope and impact. Even with EDR present, deeper forensic analysis often reveals actions that alerts missed, making these skills valuable for thorough investigations and confident remediation.
IDS and IPS
An intrusion detection system inspects traffic and alerts on suspicious patterns, while an intrusion prevention system can also block them inline. They use signatures and sometimes behaviour to spot known attacks, scanning and exploit attempts. Understanding their placement, rule sets and limitations helps you deploy them effectively and interpret their alerts without being overwhelmed by the noise they can generate.
Zeek
Zeek is a powerful network analysis framework that turns raw traffic into rich, structured logs describing connections, protocols and files rather than just raising alerts. These logs are ideal for hunting and investigation because they summarise what happened in a searchable form. Zeek is a favourite of mature network monitoring programs for the depth and flexibility of the data it produces.
Zeek
Suricata
Suricata is a high performance open source engine that can act as an intrusion detection and prevention system and also extract files and metadata from traffic. It supports community rule sets that detect a wide range of known threats. Learning to run and tune Suricata gives you a capable, free network detection tool that fits well alongside deeper analysis frameworks.
Suricata
Packet Analysis
Packet analysis is the detailed inspection of captured network traffic to understand exactly what occurred, using tools that let you follow streams and decode protocols. It is the ground truth of network investigation, revealing the content and timing of communications. While too detailed for continuous monitoring at scale, it is indispensable for confirming and understanding a specific suspicious event during an investigation.
NetFlow Analysis
NetFlow and similar flow data summarise connections by who talked to whom, when, and how much data moved, without storing full packet contents. This lightweight view scales to large networks and is excellent for spotting beaconing, large transfers and unusual internal connections. Flow analysis often provides the first hint of command and control or exfiltration, which fuller packet analysis then confirms.
Indicators of Compromise
Indicators of compromise are concrete artifacts associated with an attack, such as file hashes, domains, IP addresses and file names. They let defenders quickly search their environment for known threats and block them. Their weakness is that attackers can change them easily, so indicators age fast. They are most useful for catching known campaigns and for sharing quickly, complementing deeper behaviour based detection.
Threat Feeds
Threat feeds deliver streams of indicators and intelligence from vendors, communities and government sources. They can enrich alerts and block known bad infrastructure automatically. The challenge is quality and relevance: unfiltered feeds create noise and false positives. Choosing trustworthy, relevant feeds and integrating them thoughtfully into detection and blocking is what makes them useful rather than a distraction.
Tactics Techniques Procedures
Tactics, techniques and procedures describe how a threat actor operates at increasing levels of detail, from broad goals to specific tooling. Because TTPs are harder to change than indicators, detecting them provides more durable protection. Studying the TTPs of relevant threat actors, often mapped to ATT&CK, lets defenders build detections and hunts that catch an adversary even when their tools and infrastructure change.
MITRE ATT&CK
Diamond Model
The Diamond Model analyses intrusions through four linked elements: adversary, capability, infrastructure and victim. Mapping an incident onto these helps analysts see connections, pivot from one known element to discover others, and understand a campaign as a whole. It is a structured way to reason about who is attacking and how, complementing frameworks like ATT&CK and the kill chain.
MISP
MISP is an open source platform for storing, sharing and correlating threat intelligence within and between organisations. It structures indicators and context so they can be used automatically in detection and shared with trusted partners. Learning MISP shows you can operationalise intelligence, turning shared knowledge about threats into concrete defensive action across a community rather than isolated data.
MISP
Hypothesis Driven Hunting
Hypothesis driven hunting starts with a specific, testable idea, such as an attacker using a particular technique for persistence, then searches the data to prove or disprove it. This focus keeps hunts productive and repeatable rather than aimless data browsing. A good hypothesis is grounded in threat intelligence and knowledge of your environment, and each hunt, whether it finds something or not, teaches you about your visibility.
Hunting with ATT&CK
Using ATT&CK to guide hunting gives you a structured catalogue of attacker techniques to hunt for, one at a time, and a way to track which you have covered. You pick a technique, understand how it would appear in your logs, and search for it. This methodical approach ensures broad, measurable coverage and steadily reveals gaps in both detection and logging.
MITRE ATT&CK
Baselining
Baselining is the process of learning what normal looks like in your environment so that abnormal activity becomes visible. Knowing typical logon times, common processes, usual network flows and standard admin behaviour lets you spot the outliers that may indicate an attack. Much of effective hunting and detection depends on this deep familiarity with normal, since anomalies only stand out against a well understood baseline.
Anomaly Detection
Anomaly detection looks for deviations from established baselines, such as a user logging in from an unusual location or a server making connections it never made before. Anomalies are not always malicious, so they require investigation, but they surface novel activity that signature based detection would miss. Combining anomaly detection with context and intelligence helps separate genuine threats from harmless unusual behaviour.
Hunt Metrics
Hunt metrics measure the value and progress of a hunting program, tracking things like techniques hunted, detections created and visibility gaps found. Because many hunts find no active intruder, metrics that reward improvement rather than only catching attackers keep the program justified and focused. Good metrics demonstrate that hunting steadily strengthens detection coverage even when it does not uncover a live breach.
IR Lifecycle
The incident response lifecycle, as described by standard frameworks, moves through preparation, detection and analysis, containment, eradication, recovery, and post incident activity. Each phase has clear goals, and following them keeps a response structured under pressure. Understanding the lifecycle turns a frightening event into a series of known steps, which is what allows a team to act quickly and correctly when a real incident occurs.
NIST SP 800-61
Preparation
Preparation is everything done before an incident to make response effective: building a plan, defining roles, creating playbooks, ensuring logging and access, and practising through exercises. It is the phase with the biggest impact, because you cannot improvise capabilities in the middle of a crisis. Well prepared teams respond faster and make fewer costly mistakes, so preparation is where response quality is truly decided.
Detection and Analysis
Detection and analysis is where a possible incident is identified and investigated to understand what happened, how far it spread and what is affected. Accurate scoping here is critical, because containment and recovery decisions depend on it. This phase blends alert triage, log analysis and forensics to build a confident picture of the incident before acting, avoiding both overreaction and missed compromise.
Containment
Containment stops an incident from spreading while preserving evidence and minimising disruption, for example by isolating affected hosts or disabling compromised accounts. It requires balancing speed against the risk of alerting the attacker or losing forensic data. Short term containment buys time to plan, while longer term measures hold the line until eradication, making this a delicate but decisive phase of response.
Eradication and Recovery
Eradication removes the attacker and their tools from the environment, and recovery restores systems to normal, secure operation. This may mean rebuilding hosts, resetting credentials and closing the vulnerabilities that allowed the intrusion. Rushing recovery risks leaving the attacker a way back, so it is done carefully and verified with monitoring, ensuring the same intruder cannot simply return once systems are back online.
Lessons Learned
The lessons learned phase reviews the incident honestly to improve future defence and response. It asks what worked, what did not, and what changes in tools, detections or processes would help. Without this step, organisations repeat the same mistakes. Turning each incident into concrete improvements is what steadily raises a team maturity, making lessons learned one of the most valuable parts of the whole lifecycle.
Disk Forensics
Disk forensics examines storage media to recover files, uncover deleted data, and analyse file system artifacts that reveal user and attacker activity. It relies on working from a forensic image so the original is never altered. Disk analysis often reveals persistence mechanisms, dropped tools and traces of what was accessed, providing durable evidence that complements the more volatile picture from memory and network sources.
Memory Forensics
Memory forensics analyses a capture of a system RAM to reveal running processes, network connections, injected code and credentials that never touch disk. It is essential against fileless and in memory attacks that leave little on the file system. Tools such as Volatility let analysts extract this rich, volatile evidence, which is why capturing memory early in an incident is a high priority.
Volatility 3
Network Forensics
Network forensics reconstructs events from captured traffic and flow records, showing what communicated, when, and often what was transferred. It provides an independent view that is hard for an attacker to tamper with once captured. Analysing packet captures and flows helps confirm command and control, exfiltration and lateral movement, filling gaps that host based evidence alone cannot cover during an investigation.
Timeline Analysis
Timeline analysis orders artifacts from many sources by time to reconstruct the sequence of an incident, turning scattered evidence into a clear story. Correlating file changes, log events and other timestamps reveals the attacker path from entry to objective. A well built timeline is often the centrepiece of an investigation, making it possible to explain exactly what happened and to scope the incident accurately.
Forensic Artifacts
Forensic artifacts are the many traces that operating systems leave as a side effect of normal use, such as records of executed programs, opened files and connected devices. Knowing where these artifacts live and what they mean lets an analyst reconstruct activity even when logs are missing. Mastery of artifacts is what allows a forensic investigator to find evidence that a casual review would overlook entirely.
Chain of Custody
Chain of custody is the documented record of who handled evidence, when and how, from collection to analysis to storage. It proves the evidence was not tampered with, which is essential if findings may be used in legal or disciplinary proceedings. Even outside court, disciplined evidence handling keeps an investigation credible, ensuring that conclusions rest on data whose integrity can be demonstrated.
Static Analysis
Static analysis examines a file without running it, inspecting strings, headers, imported functions and structure to infer capability. It is safe because the code never executes, and it can quickly reveal indicators and hints about behaviour. Static analysis is the sensible first step, giving context before any risky dynamic execution, though packing and obfuscation can limit what it reveals on its own.
Dynamic Analysis
Dynamic analysis runs the malware in a controlled, isolated environment and observes its behaviour, such as files created, processes spawned, registry changes and network connections. Watching real behaviour reveals what static analysis may hide behind obfuscation. It must be done in a safe lab that cannot reach production systems, and it produces valuable behavioural indicators that feed detections.
Sandboxing
A sandbox is an automated, isolated environment that runs a suspicious file and reports its behaviour, providing fast triage at scale. Sandboxes quickly surface network indicators, dropped files and suspicious actions without manual effort. Their limitation is that some malware detects sandboxes and stays dormant, so results guide but do not replace deeper manual analysis for important or evasive samples.
Reverse Engineering Basics
Reverse engineering disassembles or decompiles malware to understand its logic at the code level, revealing capabilities that behaviour alone cannot show, such as hidden triggers or encryption keys. It requires knowledge of assembly and program structure and is the deepest form of analysis. Even a basic ability to read disassembly greatly increases what you can learn from a sophisticated sample.
Unpacking
Many malware samples are packed or encrypted to hide their real code from analysis, so unpacking is the process of recovering the original code so it can be studied. This often involves running the sample until it decrypts itself in memory, then capturing the result. Unpacking is a common prerequisite for meaningful static analysis and reverse engineering of modern, protected malware.
Vulnerability Scanning
Vulnerability scanning uses automated tools to check systems against databases of known weaknesses, producing a list of issues to review. It gives broad, regular visibility into where an environment is exposed. Scans generate false positives and need verification, and they are only useful when paired with a process to prioritise and fix what they find, rather than producing reports that no one acts on.
Patch Management
Patch management is the disciplined process of testing and deploying software updates that fix vulnerabilities. It is one of the most effective defences, since many attacks target flaws that already have patches. The challenge is balancing speed against stability, so mature programs test patches, prioritise critical fixes, and track coverage to ensure that important systems do not fall behind and become easy targets.
CVSS Scoring
The Common Vulnerability Scoring System provides a standard way to rate the severity of a vulnerability from low to critical based on factors like how it can be exploited and its impact. It helps teams compare and prioritise issues consistently. CVSS is a useful starting point, but wise programs combine it with context such as asset importance and real world exploitation, since raw severity alone does not equal actual risk.
CVSS
Asset Inventory
An accurate asset inventory is the foundation of vulnerability management and security in general, because you cannot protect what you do not know exists. It tracks systems, software and their owners and importance. Unknown or forgotten assets are frequent entry points for attackers, so maintaining a current inventory is a prerequisite for meaningful scanning, prioritisation and incident response.
Risk Prioritization
Risk prioritisation decides which vulnerabilities to fix first by combining severity with context such as whether the asset is exposed, how critical it is, and whether the flaw is being actively exploited. Since no team can fix everything at once, sensible prioritisation focuses limited effort where it reduces the most real risk. This turns an overwhelming list of findings into a practical, defensible action plan.
Authentication
Authentication is how a system verifies identity, traditionally through passwords but increasingly through stronger methods. Understanding authentication protocols and their weaknesses, such as reused passwords and credential theft, is essential because compromised credentials drive so many breaches. Monitoring authentication events for unusual patterns, like impossible travel or bursts of failures, is one of the most reliable ways to detect account compromise early.
Multi Factor Authentication
Multi factor authentication requires more than one form of proof to log in, so a stolen password alone is not enough. It is one of the single most effective controls against account takeover. Defenders should understand its strengths, its weaknesses against phishing and fatigue attacks, and how to monitor for attempts to bypass it, since attackers now actively target weaker forms of it.
Least Privilege
The principle of least privilege gives every user and system only the access needed to do its job and nothing more. This limits the damage a compromised account can cause and shrinks the paths an attacker can take. Enforcing it requires regular access reviews and thoughtful role design. Least privilege is a quiet but powerful control that turns many potential disasters into contained, minor events.
Privileged Access Management
Privileged access management protects the powerful administrative accounts that attackers prize most, through measures like vaulting credentials, requiring approval, and recording privileged sessions. Because compromising a privileged account can mean controlling the whole environment, tight control and heavy monitoring of these accounts deliver outsized security value. Watching privileged activity closely is a key detection opportunity for serious intrusions.
AD Hardening
Active Directory hardening reduces the many attack paths that intruders exploit inside enterprises, by protecting privileged groups, tiering administrative access, removing risky configurations and enabling strong auditing. Because so many attacks aim for domain dominance, a hardened directory dramatically raises the difficulty of an intrusion. Combined with monitoring, hardening turns the enterprise identity core from a soft target into a defended one.
MITRE ATT&CK
Cloud Logging
Cloud platforms record detailed audit logs of every action taken through their control plane, which are the primary source of cloud detection. Collecting and analysing these logs reveals suspicious identity activity, configuration changes and access to sensitive resources. Because cloud attacks often happen through legitimate interfaces using stolen credentials, these logs are frequently the only place the activity is visible, making them essential to enable and monitor.
Microsoft Sentinel
Email Security
Email is the most common initial access vector, so securing it is a high priority. Email security combines filtering of malicious attachments and links, sender authentication, and user awareness. Understanding how phishing and malicious mail reach inboxes, and how gateways try to stop them, helps defenders tune protections and investigate the mail based incidents that make up a large share of real intrusions.
Phishing Defense
Phishing defence layers technical controls, monitoring and user education to reduce both the number of phishing messages that arrive and the harm when one succeeds. Reporting mechanisms let users flag suspicious mail, and rapid response can contain a campaign quickly. Since phishing exploits people rather than software, a strong defence blends technology with a culture where reporting is easy and encouraged rather than punished.
DMARC SPF and DKIM
SPF, DKIM and DMARC are email authentication standards that help verify that a message truly comes from the domain it claims and instruct receivers what to do when it does not. Properly configured, they make it much harder for attackers to spoof an organisation domain in phishing. Understanding and monitoring these records protects both the organisation and its partners from impersonation based attacks.
CASB
A cloud access security broker sits between users and cloud services to enforce policy, provide visibility into cloud usage, and detect risky or unauthorised activity. It helps organisations control the sprawl of cloud applications, including unsanctioned ones, and spot data movement that violates policy. For defenders, a CASB adds a useful monitoring and control layer over the many cloud services users rely on daily.
Playbooks
A playbook is a documented, repeatable procedure for handling a specific type of alert or incident, which can be followed manually or automated. Playbooks capture the best known way to respond so that every analyst handles a situation consistently and correctly, even under pressure. Building clear playbooks for common scenarios is the foundation of both reliable response and later automation of that response.
Automation
Automation executes routine security tasks without manual effort, such as enriching an alert with context, checking an indicator against intelligence, or isolating a host. It reduces response time and analyst fatigue and improves consistency. The key is to automate well understood, repetitive steps while keeping humans in the loop for decisions that require judgement, so speed does not come at the cost of costly mistakes.
Case Management
Case management systems track incidents and investigations from start to finish, recording actions, evidence and decisions in one place. They keep responses organised, support handover between analysts and shifts, and create a record for review and learning. Good case management ensures nothing falls through the cracks during a busy incident and provides the documentation needed for reporting and continuous improvement.
Metrics and KPIs
Metrics and key performance indicators measure how well security operations are working, tracking things like time to detect and time to respond. Sensible metrics drive improvement and demonstrate value to leadership, while poorly chosen ones can encourage unhelpful behaviour. Focusing on outcomes such as reducing attacker dwell time, rather than raw activity counts, keeps a team aimed at what actually reduces risk.
SOC Analyst
A SOC analyst is the front line of defence, monitoring alerts, triaging events and investigating suspicious activity, often across shifts. It is the most common entry point into blue teaming and builds broad, practical skills in logging, SIEM use and investigation. Strong analysts learn to separate real threats from noise quickly and grow naturally into more senior detection, hunting and response roles over time.
Incident Responder
An incident responder leads or supports the handling of confirmed incidents, from scoping and containment through eradication and recovery. The role demands calm judgement under pressure, strong forensic and analysis skills, and clear communication with technical and business stakeholders. It suits people who thrive in high stakes situations and enjoy piecing together what happened and driving an organisation back to safety.
Threat Hunter
A threat hunter proactively searches for attackers that automated detection has missed, using hypotheses, intelligence and deep knowledge of the environment. The role requires curiosity, strong analytical skills and familiarity with attacker techniques. It is usually reached after building solid SOC and detection experience, and it appeals to people who enjoy investigation and continually improving a team ability to catch stealthy intrusions.
Detection Engineer
A detection engineer designs, builds and maintains the detections that power a security program, treating detection as a software discipline. The role blends knowledge of attacker behaviour, data and platforms with careful testing and tuning. It is a fast growing specialisation that suits people who enjoy building durable, high quality detection logic and measuring coverage against real world attacker techniques.
Blue Team Fundamentals
Blue teaming is the discipline of defending an organisation by preventing, detecting and responding to attacks. Where a red team plays the intruder, the blue team builds the walls, the alarms and the response plan. It spans monitoring systems for signs of compromise, investigating alerts, containing incidents and continuously improving defences based on what real attackers do.
Why learn this
Every later topic, from logging to incident response, sits inside this defensive mission. Understanding the goal first stops you from collecting tools and alerts with no strategy behind them.
Core concepts
Prevention, detection and response as a cycle Thinking like an attacker to defend better The role of the security operations centre Measuring and improving defensive coverage Common mistakes
Buying tools without a detection strategy Ignoring how attackers actually behave Interview importance: High. Defensive interviews usually start by checking that you understand the mission and the detect and respond cycle.
MITRE ATT&CK
TryHackMe
Networking Fundamentals
Defenders must understand networks because attacks travel across them and much of your visibility comes from network data. Networking fundamentals cover how devices communicate, how traffic is routed, and what normal traffic looks like so that abnormal traffic stands out. A strong grasp of protocols and addressing lets you read logs, design segmentation, and understand what your monitoring tools are telling you.
Why learn this
Detection, monitoring and incident response all depend on reading network behaviour. Weak fundamentals here limit everything from alert triage to hunting.
Core concepts
OSI and TCP IP models IP addressing, subnets and routing Core protocols and their normal behaviour Where network visibility comes from Common mistakes
Not knowing what normal traffic looks like Ignoring internal east to west traffic Interview importance: High. Networking questions are standard in SOC interviews.
TryHackMe
Windows Security
Windows dominates enterprise environments, so defending it well is central to blue teaming. This means understanding authentication, privileges, services and the registry, and knowing which built in and add on logging sources reveal attacker activity. Strong Windows knowledge lets you harden systems, read the right event logs, and recognise the fingerprints of common attacks.
Why learn this
Most enterprise incidents involve Windows hosts and Active Directory. Deep familiarity here is what lets you detect and investigate real intrusions.
Core concepts
Authentication, tokens and privileges Services, registry and scheduled tasks Windows event logging and Sysmon Hardening and secure configuration Common mistakes
Relying on default logging that misses key events Not knowing where attackers commonly hide Interview importance: High. Windows internals and logging come up constantly.
Sysmon
Log Management
Logs are the raw material of detection and investigation, so managing them well is foundational to blue teaming. Log management covers deciding which sources to collect, transporting logs reliably to a central place, storing them for a useful period, and ensuring they are complete and trustworthy. Without good logging, detection and incident response are blind, no matter how good the tools above them are.
Why learn this
Every alert, hunt and investigation depends on having the right logs. Gaps in logging are gaps in your ability to see attacks at all.
Core concepts
Choosing high value log sources Central collection and reliable transport Retention and storage planning Log integrity and completeness Common mistakes
Collecting everything and drowning in noise Missing critical sources like process creation Interview importance: High. Log strategy is a core SOC discussion.
Sysmon
SIEM Fundamentals
A Security Information and Event Management platform collects logs from across the environment, normalises them, and lets analysts search, correlate and alert on them. It is the central nervous system of most security operations centres, turning scattered raw logs into detections and investigations. Learning to write queries, build correlation rules and tune alerts is a core, highly employable blue team skill.
Why learn this
The SIEM is where most SOC work happens. Fluency in querying and rule writing is expected of nearly every SOC analyst.
Core concepts
Log ingestion and normalisation Searching and correlation Alerting and dashboards Tuning to reduce noise Common mistakes
Alert rules so noisy they get ignored Not normalising data, breaking correlation Interview importance: Very High. Hands on SIEM skill is a common hiring bar.
Splunk Docs
Elastic Guide
Threat Detection
Threat detection is the practice of creating and maintaining the logic that identifies malicious activity in your data. It moves beyond buying default rules to engineering detections tailored to your environment and to attacker behaviour. Good detection engineering focuses on the actions attackers must take, so that a single well built detection catches many variations of a technique.
Why learn this
Detections are the product of a blue team. The quality of your detection logic directly determines whether you catch or miss real attacks.
Core concepts
Detection engineering as a discipline Behaviour based versus signature based detection Writing and testing detection rules Measuring coverage against ATT&CK Common mistakes
Detecting specific tools instead of behaviours Never testing whether detections actually fire Interview importance: High and rising. Detection engineering is a growing specialisation.
Sigma Rules
MITRE ATT&CK
Endpoint Detection and Response
Endpoint detection and response tools monitor activity on hosts in depth, recording process, file, registry and network behaviour and enabling investigation and remote response. Because so much attacker activity happens on endpoints, these tools are among the most valuable sources of visibility a defender has. Learning to read their telemetry, tune detections and respond through them is a core modern skill.
Why learn this
Endpoints are where most attacks land and unfold. Deep endpoint visibility is often the difference between catching an intrusion and missing it entirely.
Core concepts
Endpoint telemetry and behaviour recording Detection and response capabilities Host hardening and reducing attack surface Endpoint based investigation Common mistakes
Treating EDR as a black box you never tune Ignoring hardening because EDR is present Interview importance: High. EDR fluency is expected in most SOC roles.
Atomic Red Team
Network Security Monitoring
Network security monitoring collects and analyses network traffic to detect and investigate malicious activity that endpoint tools might miss. It provides an independent view of what is happening on the wire, which is invaluable when endpoints are compromised or unmanaged. Skills here include reading packet captures, deploying network sensors, and turning traffic into detections.
Why learn this
Attackers can tamper with endpoints, but network evidence is harder to hide. Network visibility catches command and control, exfiltration and lateral movement that hosts alone might miss.
Core concepts
Intrusion detection and prevention Traffic analysis with network sensors Packet and flow analysis Detecting command and control patterns Common mistakes
Monitoring only the perimeter, not internal traffic Drowning in packets without flow level summaries Interview importance: Medium to High, especially for network focused SOC roles.
Zeek
Suricata
Cyber Threat Intelligence
Cyber threat intelligence is the collection, analysis and use of information about attackers to inform defence. It answers who might target you, how they operate, and what to watch for, turning raw data about threats into decisions and detections. Good intelligence lets a team prioritise its limited resources against the threats that actually matter to its industry and environment.
Why learn this
Intelligence connects defence to reality. It directs your detection, hunting and hardening toward the attackers and techniques most likely to hit you.
Core concepts
Strategic, operational and tactical intelligence Indicators, techniques and threat actors Intelligence sources and sharing Turning intelligence into detections Common mistakes
Collecting feeds no one acts on Focusing on short lived indicators over behaviour Interview importance: Medium. Valued especially in mature and threat led teams.
MISP
MITRE ATT&CK
Threat Hunting
Threat hunting is the proactive search for attackers who have evaded existing detections, based on hypotheses about how they might operate. Rather than waiting for an alert, hunters assume a breach may already exist and go looking for the subtle traces it would leave. Successful hunts either find hidden intruders or produce new detections that catch them next time.
Why learn this
Determined attackers slip past automated detection. Hunting is how mature teams find the intrusions their alerts missed and continuously improve their coverage.
Core concepts
Hypothesis driven investigation Baselining and anomaly spotting Using ATT&CK to guide hunts Turning hunt findings into detections Common mistakes
Hunting without a clear hypothesis Not converting findings into lasting detections Interview importance: High for senior and specialist roles.
MITRE ATT&CK
The DFIR Report
Incident Response
Incident response is the organised process of handling a security incident from detection through to recovery and learning. A calm, practised response limits damage, preserves evidence and restores operations quickly, while a chaotic one makes everything worse. Standard frameworks provide a repeatable lifecycle so that under pressure the team follows a plan rather than improvising.
Why learn this
Breaches are a matter of when, not if. How well an organisation responds often matters more than how it was breached in the first place.
Core concepts
The incident response lifecycle Preparation and playbooks Containment, eradication and recovery Post incident learning Common mistakes
No plan, leading to panic and lost evidence Skipping the lessons learned that prevent repeats Interview importance: Very High. IR process questions are a staple of blue team interviews.
NIST SP 800-61
The DFIR Report
Digital Forensics
Digital forensics is the careful collection, preservation and analysis of digital evidence to reconstruct what happened during an incident. It answers exactly how an attacker got in, what they did, and what was affected, in a way that can withstand scrutiny. Sound forensic method protects the integrity of evidence so that conclusions are trustworthy and, where needed, legally defensible.
Why learn this
Deep investigation reveals the full scope of an incident that alerts only hint at, which is essential for confident containment, recovery and, sometimes, legal action.
Core concepts
Evidence handling and preservation Disk, memory and network forensics Timeline reconstruction from artifacts Chain of custody Common mistakes
Altering evidence during collection Analysing only one source and missing the full story Interview importance: High for DFIR roles.
Volatility 3
SANS Reading Room
Malware Analysis
Malware analysis is the study of malicious software to understand what it does, how it works, and how to detect and remove it. During an incident it answers urgent questions about capability and impact, and it produces indicators and detections to protect the wider environment. It ranges from quick behavioural checks to deep reverse engineering of the code itself.
Why learn this
Understanding a sample tells you what an attacker could do and how to catch it. Turning malware into detections protects everyone, not just the infected host.
Core concepts
Static versus dynamic analysis Safe analysis environments Extracting indicators and behaviour Reverse engineering basics Common mistakes
Running malware outside a safe, isolated lab Stopping at behaviour without extracting detections Interview importance: Medium to High for specialist roles.
YARA
Vulnerability Management
Vulnerability management is the continuous process of finding, assessing, prioritising and fixing weaknesses across an environment before attackers exploit them. It is not just scanning but a program that turns a flood of findings into a manageable, risk based plan of action. Done well, it steadily reduces the attack surface and closes the doors that attacks rely on.
Why learn this
Most breaches exploit known, unpatched issues. A working vulnerability program removes the low hanging fruit that attackers depend on.
Core concepts
Scanning and asset discovery Risk based prioritisation Patch and remediation workflows Tracking and reporting progress Common mistakes
Treating every finding as equally urgent Scanning without a plan to actually fix issues Interview importance: Medium. A common and practical operational topic.
CVSS
Identity and Access Management
Identity and access management governs who can access what, and it has become a central battleground of security as environments move to the cloud. Attackers increasingly log in with stolen credentials rather than breaking in, so controlling and monitoring identity is one of the most impactful defences available. Strong authentication and least privilege limit both entry and spread.
Why learn this
Identity is the new perimeter. Protecting and watching accounts stops many attacks at the door and slows those that get in.
Core concepts
Authentication and multi factor authentication Least privilege and access reviews Privileged account protection Monitoring identity for abuse Common mistakes
Over privileged accounts left unchecked Not monitoring authentication for anomalies Interview importance: High and growing with cloud adoption.
MITRE ATT&CK
Cloud Security Monitoring
As organisations move to the cloud, defenders must monitor cloud platforms, which have their own logs, identity models and attack techniques. Cloud security monitoring means collecting and analysing platform audit logs, watching for misconfigurations, and detecting the identity centric attacks common in cloud environments. The fundamentals of detection still apply, but the data sources and controls differ.
Why learn this
Cloud is where much of modern infrastructure now lives. Cloud specific visibility and detection skills are increasingly essential rather than optional.
Core concepts
Cloud audit and activity logs Identity centric cloud attacks Misconfiguration detection Email as a primary attack channel Common mistakes
Assuming the cloud provider handles all security Ignoring cloud logs until after an incident Interview importance: High and rising rapidly.
Microsoft Sentinel
SOAR and Automation
Security orchestration, automation and response tools automate repetitive parts of security operations, connecting tools together and running predefined playbooks. Automation frees analysts from tedious tasks so they can focus on judgement heavy work, and it speeds response so that containment happens in seconds rather than hours. It is how modern teams scale their limited human effort against a high volume of alerts.
Why learn this
Analysts are scarce and alerts are many. Automation is how a team responds faster and more consistently without simply hiring endlessly.
Core concepts
Playbooks and orchestration Automating triage and enrichment Case management workflows Measuring operational performance Common mistakes
Automating a broken process instead of fixing it Removing human judgement from decisions that need it Interview importance: Medium and growing.
Splunk Docs
Blue Team Careers
The defensive security field offers several career directions, and this roadmap builds the foundation for all of them. Roles range from front line alert triage to deep investigation, proactive hunting and detection engineering. Practising with realistic datasets, home labs and challenges, alongside recognised certifications, is the proven way to enter the field and progress.
Why learn this
Understanding the roles helps you focus your study, choose useful certifications, and present your skills clearly to employers.
Core concepts
The main defensive role types and their focus Labs, challenges and certifications Continuous learning as threats evolve Communication as a core defensive skill Common mistakes
Certifications without hands on practice Neglecting the writing and reporting side Interview importance: Useful context for planning your path.
TryHackMe
Splunk Boss of the SOC
