Blue team / defensive security
Blue Team Tools
Overview
The core toolset for defensive security work, organized by what layer of the environment each tool operates on.
Key concepts
- Monitoring: SIEM, SOAR, Sysmon
- Network defense: Wireshark, Zeek, Suricata, Snort
- Endpoint defense: Defender, CrowdStrike, SentinelOne
- Vulnerability management: Nessus, OpenVAS
Tools & techniques
| Tool | Purpose | When to use |
|---|---|---|
| SIEM | Centralize logs, correlate events, alert | Core ongoing monitoring |
| SOAR | Automate security workflows | Reducing manual response work |
| CrowdStrike Falcon / SentinelOne | Cloud-based EDR | Endpoint monitoring and response |
| Suricata / Snort | Network IDS/IPS | Network-layer detection |
How it works
Security monitoring tools
| Tool | Purpose |
|---|---|
| SIEM | Centralizes logs from many sources, correlates events, searches data, generates alerts. |
| SOAR | Automates repetitive security workflows — enriching alerts, blocking IPs, opening tickets, isolating endpoints. |
| Log management platform | Collects, stores, searches, and analyzes logs from devices, servers, apps, and cloud services. |
| Sysmon | Windows monitoring utility recording detailed endpoint events — process creation, network connections, file creation, driver loading. |
Network-defense tools
| Tool | Purpose |
|---|---|
| Wireshark | Captures and inspects network traffic. |
| Zeek | Produces detailed logs about connections, DNS, HTTP activity, files, and other network events. |
| Suricata | Open-source IDS/IPS and network-security-monitoring engine. |
| Snort | IDS/IPS that detects suspicious activity using rules and signatures. |
| Firewall | Permits, blocks, or inspects traffic based on defined rules. |
| Network access control (NAC) | Controls whether devices can connect based on identity, device status, and security requirements. |
Endpoint-defense tools
| Tool | Purpose |
|---|---|
| Microsoft Defender for Endpoint | EDR and endpoint-security platform for monitoring, detection, investigation, response. |
| CrowdStrike Falcon | Cloud-based endpoint security — monitoring, detection, response. |
| SentinelOne | Endpoint security using behavioral detection and automated response. |
| Windows Defender Firewall | Host-based firewall controlling inbound/outbound traffic on Windows devices. |
Vulnerability-management tools
| Tool | Purpose |
|---|---|
| Nessus | Identifies missing patches, insecure configurations, weak encryption, known vulnerabilities. |
| OpenVAS/Greenbone | Identifies known security weaknesses in systems and networks. |
| Configuration-management tools | Group Policy, Microsoft Intune, Ansible, Puppet, Chef — apply/maintain secure configurations at scale. |