Dictionary · Hacking Techniques and Methodologies
Blue Team
Teams · Beginner
The defensive group that monitors, detects, responds, and hardens systems. In an exercise it tries to notice and contain the simulated adversary.
This is the day-to-day protection role: logs, alerts, patches, and incident response. An exercise is useful when this team can show what it saw and what it missed.
Example: During an exercise, the blue team correlates a suspicious login with a new process and isolates the host.
Common misconception
- The defensive team is not only the group that plays in an exercise. The same name covers everyday security operations.