Название: Blue Team Handbook: SOC, SIEM, and Threat Hunting: Practical Techniques for Security Operations and Threat Hunting Teams (Final Release)
Автор: Don Murdoch
Издательство: O’Reilly Media, Inc.
Год: 2026
Страниц: 444
Язык: английский
Формат: True PDF, True EPUB
Размер: 21.6 MB

As cyberthreats become more sophisticated and alert volumes rise, security teams need more than just tools—they need strategy, structure, and field-tested guidance. Following the success of the original edition, this updated edition of Blue Team Handbook: SOC, SIEM, and Threat Hunting is still the essential resource for building, optimizing, and managing modern detection engineering practices and security operations centers.

This practical guide distills over 20 years of frontline cybersecurity experience into an actionable playbook for analysts, SOC managers, architects, detection engineers, and threat hunters. Author Don Murdoch delivers expert insights designed to help teams improve quickly. Whether you're refining your current operations or launching a SOC from scratch, this book empowers you with proven, real-world techniques to defend against today's most persistent threats.

This book covers many aspects of the security operations team from a “field notes” perspective. It is based on a long career implementing multiple SIEM technologies, building SOCs, conducting all manner of cyber investigations, developing and running an MSSP, and serving as the countermeasures lead for one of the largest Splunk installations in the United States. The major topics include:

• How to build a functional security operations unit, including provisioning plans, budget considerations, thought habits, analyst skills, and tiering structures
• Key considerations for structuring your security operations capability and defining the services it will offer
• Cybersecurity-focused use cases organized by data source, including what to monitor from each source, as succinctly as possible; many of these use cases have a threat hunting focus
• How to build security operations use cases using my Use Case Template, followed by a complete example and excerpts from additional use cases
• Over 100 pages of detection patterns from dozens of data sources
• Critical SOC analyst skills and investigation processes, based on practices my team used while I managed an MSSP operational unit for two years at a mid-sized consulting firm
• Applying modern threat hunting practices within the SOC
• Additional topics related to security operations, SOC analyst skills, and SIEM

It is my sincere hope that this book delivers on the Blue Team Handbook motto: “A zero-fluff reference guide for the security practitioner, written with the intention of sharing real-life experience.” I trust that you will learn something useful as you read it, as many readers of Blue Team Handbook: Incident Response Edition have shared with me over the years.

Who Should Read This Book:
This book is for cyber and IT professionals, security operations staff, security consultants, SOC analysts, SIEM designers and consultants, and line managers—those responsible for protecting information assets and training the next generation of security professionals.

Contents: