What is a blue team?
A blue team is the group that defends the organization. In everyday use the term covers the people who run security operations: SOC analysts who watch alerts, incident responders who investigate and contain, and the engineers who build and tune detection tools such as a SIEM, EDR and network sensors. In an exercise, the blue team is the side being tested, and the red team is the side attacking.
What blue teams do
- Monitor logs and alerts and sort real problems from noise
- Investigate suspicious activity and decide whether it is an incident
- Contain, eradicate and recover, following playbooks
- Hunt for threats that slipped past automated detection
- Harden systems and close the gaps that tests and incidents expose
Defensive testing measures the blue team
When an exercise evaluates the defenders, the questions concern detection and response rather than the attack itself. Did an alert fire? How long before someone noticed, and how long before the activity was contained? Did analysts follow the playbook and escalate to the right people? Useful measures include time to detect, time to contain, the share of emulated techniques that produced an alert, and whether the incident record was complete enough for a later review.
Example scenario
During an exercise, the red team runs a credential theft technique on a test workstation. The EDR raises an alert, but it lands in a queue nobody checks overnight, and an analyst opens it nine hours later. The technique was detected, yet the defensive test still fails on response time. The fix is a staffing and escalation change, not a new product.
Blue team vs. red team vs. purple team
The red team attacks, the blue team defends, and a purple team arrangement brings the two together so each attack technique is followed at once by a detection check and tuning. In a pure red team exercise the blue team usually is not told a test is underway, which measures real readiness. In purple teaming the defenders know what is coming, which builds detections quickly but cannot measure how they handle surprise.
Blue team on the CompTIA Security+ exam
SY0-801 objective 5.5 names defensive testing as a penetration testing type, and defensive testing is an evaluation of the blue team. Scenario clues: measuring whether the SOC detected an attack, how quickly responders contained it, or whether alerts and playbooks worked as written. Distractors are offensive testing (the red team running the attack), integrated testing (red and blue together) and threat hunting, which is blue team work but not a type of test. The blue team's daily monitoring and response work falls under the security operations objectives in domain 4.