Blue Team

A blue team is the defensive side of security: the people responsible for protecting systems, monitoring for threats, responding to incidents and strengthening controls. In many organisations this overlaps with the security operations centre and incident responders.

Why it matters

Prevention eventually fails, so the ability to notice and act matters as much as blocking. Blue teams maintain logging, alerting, hardening, patching and playbooks. They also learn from exercises: when a red team simulates an attack, the blue team measures how quickly it spotted the activity and how well the response worked. Sometimes a joint effort, called purple teaming, shares findings in real time.

Example

During an exercise, the blue team sees an unusual login from a workstation that never normally connects to the finance server. They isolate the host, reset the affected account, preserve logs for review and write a short report about which detections worked and which rules need tuning.

Common mistakes

• Collecting logs but not reviewing or testing alerts.
• Lacking an up-to-date asset inventory, so unknown systems go unwatched.
• Having no practised incident plan.
• Burning out staff with unfiltered alert volume.

Related

• Red team
• SIEM
• SOC (Security Operations Center)
• Disaster recovery

This page is general information written by our editorial team and updated when documentation changes. Servers and providers differ, so test changes safely first. See our editorial policy and disclaimer.