What is Blue Team?

NIST's glossary carries two definitions, both from CNSSI 4009-2022. The first is the exercise sense: the group that defends an enterprise's information systems against a group of mock attackers, the red team, over a significant period, in a representative operational context, under rules a neutral white team referees. The second describes an evaluation team that reviews a network's security posture and recommends mitigations, often before a red team is brought in. Working analysts use the word more loosely. Blue team means the standing defensive function, the people who handle real attacks every day, and a red team exercise is one of the tests that function has to pass.

Inside a SOC, the work splits into roles that read different telemetry. A tier 1 (L1) analyst works the alert queue: SIEM alerts and the raw events behind them, such as Windows Security events 4625 and 4624, EDR detections, proxy and firewall records and email gateway verdicts. The output is a verdict on each alert and, when needed, an escalation note. A tier 2 (L2) analyst or incident responder takes the escalation and reads deeper: EDR process trees and timelines, authentication history across hosts, and memory or disk artifacts when the case needs them. The output is scope, containment and a timeline. NIST SP 800-61 Rev. 3, published in April 2025 to supersede Rev. 2, places that work inside an organization's wider cybersecurity risk management as described by CSF 2.0.

A detection engineer writes and tunes the rules. They read the same logs in bulk: what a technique looks like in raw events, which fields are actually populated, and how often a candidate rule would have fired last month. The output is rules mapped to ATT&CK techniques, each with its known false positives written down. A threat hunter looks for what no rule caught. Hunts start from a hypothesis, for example that someone is enumerating domain groups from a workstation, and run over weeks of endpoint, DNS and authentication data. The output is findings, plus the new detections that come out of them. In a small team one person covers all four roles.

One escalation from start to finish (simulated example generated by SOCSimulator Research; names and addresses are invented). At 14:02 a SIEM rule fires: 38 Windows 4625 failed logons in nine minutes on file server FS-02, all for the account j.ortega, Logon Type 3 (network), Sub Status 0xC000006A (bad password), source address 10.40.12.77. At 14:11 FS-02 logs a 4624 successful logon for the same account from the same address. The L1 analyst checks the source: 10.40.12.77 is WS-MKT-014, a marketing laptop, and j.ortega works in finance. The query behind the alert, in Microsoft Sentinel:

SecurityEvent | where TimeGenerated > ago(1h) and EventID in (4625, 4624) | summarize Failures = countif(EventID == 4625), Successes = countif(EventID == 4624) by TargetAccount, IpAddress | where Failures >= 20 and Successes > 0

Escalated to L2 at 14:15. The EDR timeline on WS-MKT-014 shows net.exe group "Domain Admins" /domain at 14:13, started by a PowerShell process the laptop's user never opened. ATT&CK lists net group /domain under T1069.002, Domain Groups, and the password guessing before it under T1110, Brute Force. One more query checks whether the laptop is alone:

DeviceProcessEvents | where Timestamp > ago(1d) | where FileName in~ ("net.exe", "net1.exe") and ProcessCommandLine has "group" and ProcessCommandLine contains "/dom" | project Timestamp, DeviceName, AccountName, InitiatingProcessFileName, ProcessCommandLine

Matching /dom rather than /domain also catches the abbreviated form, which ATT&CK records in real intrusions. Only WS-MKT-014 comes back. At 14:21 L2 isolates the laptop from the Defender portal. Microsoft's documentation describes isolation as disconnecting the device from the network while it keeps its connection to the Defender for Endpoint service, so monitoring and investigation carry on; it also notes that isolation lifts automatically after seven days, so the release decision belongs in the ticket. The j.ortega password is reset and its sessions revoked. The last step goes to the detection engineer: the brute-force rule fired, nothing alerted on the discovery command, and that gap gets a ticket of its own.

Red team and purple team have their own glossary entries; this is where the three differ. A red team emulates an attacker for a defined engagement and measures how far it gets. Purple teaming puts both sides on the same call, technique by technique, and fixes detections on the spot. The blue team is the side whose detection and response are being measured, and the only one of the three that keeps running whether or not an exercise is booked.