Blue Team.

Like red teams, the blue team concept comes from military exercises where the "blue" force represented the defenders. In cybersecurity, the blue team includes SOC analysts, detection engineers, incident responders, threat hunters, and the operators of security platforms (SIEM, EDR, XDR, SOAR, IAM). Their remit maps onto the six NIST CSF 2.0 functions — Govern, Identify, Protect, Detect, Respond, Recover — turning strategy into hardened systems, tuned detections, triaged alerts, and post-incident lessons fed back into architecture.

Modern blue teaming is increasingly engineering-led. Detection-as-code pipelines version-control Sigma, YARA, and Suricata rules and test them in CI; threat hunting is hypothesis-driven, using frameworks like MITRE ATT&CK to enumerate adversary techniques and D3FEND to map countermeasures. David Bianco's Pyramid of Pain (2013) guides prioritisation: detecting an attacker's TTPs hurts them far more than blocking a hash or IP they can trivially change. John Lambert's observation that "defenders think in lists, attackers think in graphs" pushes teams toward attack-path analysis rather than flat asset inventories.

Effectiveness is measured with MTTD, MTTR, detection coverage against ATT&CK, and — validated jointly with red teams in purple-team exercises — the share of emulated techniques that actually alert.

flowchart LR
  T[Threat intel + ATT&CK] --> H[Hypothesis / hunt]
  H --> D[Write & tune detections<br/>Sigma / YARA / EDR]
  D --> M[Monitor SIEM / XDR]
  M --> A{Alert?}
  A -->|Yes| IR[Triage & incident response]
  A -->|No| M
  IR --> L[Lessons learned]
  L --> D
  L --> P[Purple-team validation]
  P --> H