Blue Team Handbook: SOC, SIEM, and Threat Hunting Use Cases
'Blue Team Handbook SOC Siem-threats-hunting-use-cases-notes-from-fields-v102-by-don murdoch' is a compact, operational field guide designed for SOC analysts, incident response leads, and defensive security engineers. Focusing on the practical aspects of detecting and containing cyber intrusions, this handbook provides immediate, actionable playbooks for cyber defense.
The book covers packet capture analysis, Windows event log and Sysmon telemetry, Linux system auditing, threat hunting hypotheses, SIEM correlation rules, memory triage, and post-compromise eradication steps. Key attack vectors including ransomware, phishing, and lateral movement are analyzed alongside concrete detection queries.
An invaluable desktop reference for SOC teams, incident responders, and security operations personnel working on the front lines of enterprise defense.
The book covers packet capture analysis, Windows event log and Sysmon telemetry, Linux system auditing, threat hunting hypotheses, SIEM correlation rules, memory triage, and post-compromise eradication steps. Key attack vectors including ransomware, phishing, and lateral movement are analyzed alongside concrete detection queries.
An invaluable desktop reference for SOC teams, incident responders, and security operations personnel working on the front lines of enterprise defense.
Contents at a Glance
Chapter 1: Introduction to SOC Operations and Incident Response Frameworks
Chapter 2: Network Analysis: Packet Capture, Flow Analysis, and Protocol Anomalies
Chapter 3: Host-Based Analysis: Windows Event Logs, Sysmon, and Linux Auditd
Chapter 4: Threat Hunting Methodologies and Hypothesis-Driven Investigation
Chapter 5: SIEM Architecture and Correlation Rule Development
Chapter 6: Investigating Common Attack Vectors: Phishing, Ransomware, Lateral Movement
Chapter 7: Incident Containment, Remediation, and Root Cause Analysis
Chapter 8: Post-Incident Review, Threat Intelligence, and Reporting
Index & Further Reading
Chapter 1: Introduction to SOC Operations and Incident Response Frameworks
Chapter 2: Network Analysis: Packet Capture, Flow Analysis, and Protocol Anomalies
Chapter 3: Host-Based Analysis: Windows Event Logs, Sysmon, and Linux Auditd
Chapter 4: Threat Hunting Methodologies and Hypothesis-Driven Investigation
Chapter 5: SIEM Architecture and Correlation Rule Development
Chapter 6: Investigating Common Attack Vectors: Phishing, Ransomware, Lateral Movement
Chapter 7: Incident Containment, Remediation, and Root Cause Analysis
Chapter 8: Post-Incident Review, Threat Intelligence, and Reporting
Index & Further Reading
