Overview
Your complete guide to The blue team: detection, hunting and forensics
From an analyst who reads alerts to one who makes them: detection engineering with Sigma rules and MITRE ATT&CK, hypothesis-led threat hunting, and digital forensics from collecting evidence to the timeline.
Non-technical and technical learners alike. Every part opens two ways in: a plain path built on an analogy for someone starting from zero, and a detailed path for someone who knows the basics and wants depth.
An animation, then what you need before you start, then the idea with code you run, then a worked example, then review cards and "test your understanding" questions.
Do not leave a part before you can answer its questions without guessing. Reading alone proves nothing.
Pick a topic
A look at The blue team: detection, hunting and forensics
You write detection first, then search for what detection missed, then rebuild what happened from the evidence.
| Part | Topic | You learn |
|---|---|---|
| 1 | Detection engineering: write the rule that catches the attacker | Log sources and the event IDs that matter, Sysmon, a Sigma rule and its parts, detecting behaviour not indicators, false positives and tuning, testing with Atomic Red Team, ATT&CK coverage, detection as code |
| 2 | Threat hunting and threat intelligence | Monitoring versus hunting, hypothesis-driven hunting, the Pyramid of Pain, indicators versus behaviour, strategic, operational and tactical intelligence, TLP 2.0, STIX and MISP, hunting beacons |
| 3 | Digital forensics and a first look at malware | Order of volatility, chain of custody, forensic images and hashes, memory analysis with Volatility, Windows and Linux artefacts, the timeline, static and dynamic analysis and entropy, YARA rules, the isolated lab |
Done with this lesson?
Sign in to save your progress.